Cryptography questions on CompTIA SecurityX (CAS-005) are notorious for being either trivially easy (a candidate who has done the work answers in seconds) or unfair-feeling (a candidate who memorized definitions hits unfamiliar terrain). The difference is whether you studied algorithms or whether you studied implementations.
What CompTIA actually tests
The cryptographic content on CAS-005 splits across two domains. Domain 2 (Architecture) tests cryptographic primitive selection: when to use which algorithm, key length appropriate to the threat model, post-quantum considerations for long-lived data. Domain 3 (Engineering) tests implementation: PKI standup, key rotation, secret management, the specific operational mistakes that turn good cryptography into bad security.
Surface knowledge of algorithms (RSA exists, AES exists) shows up on maybe 5 percent of cryptographic questions. The other 95 percent test judgment and implementation.
The primitives worth knowing cold
You do not need to know every algorithm. You need to know the small set that actually shows up in 2026 deployments.
Symmetric encryption: AES with GCM mode for authenticated encryption. AES-128 for general use; AES-256 for long-lived secrets or compliance requirements. Understand why CBC mode without HMAC is a problem and why ECB mode is a problem at any key length.
Asymmetric encryption: RSA 2048-bit as the floor for current use; 3072 or 4096 for new deployments with multi-decade lifespan. ECDSA P-256 for signatures where performance matters. Understand when to use which.
Key derivation: Argon2id is the current recommendation for password hashing. scrypt and bcrypt remain acceptable. PBKDF2 still appears in compliance contexts but needs high iteration counts (600,000+ for SHA-256 as of 2026). MD5 and SHA-1 are dead for security purposes, but SHA-256 and SHA-512 remain appropriate for non-password hashing.
Post-quantum: NIST finalized three post-quantum algorithms in 2024 (ML-KEM, ML-DSA, SLH-DSA). The exam asks about migration timelines and the "harvest now, decrypt later" threat model for long-lived data. You do not need to implement the algorithms; you need to know they exist and why they matter.
The implementation patterns the exam rewards
CAS-005 performance-based questions on cryptography look like real configuration scenarios: a snippet of OpenSSL config, a Kubernetes Secret YAML, a Terraform block describing a KMS key policy. The exam wants you to identify the actual problem.
The most common problem patterns: keys committed to source control, secrets in environment variables that get logged, KMS policies that grant too much principal access, certificate chains broken by a misconfigured intermediate, HSTS missing or misconfigured, TLS termination at the wrong layer for the data sensitivity, and key rotation policies that exist on paper but not in practice.
Study the patterns of failure more than the patterns of success. The exam is engineered to test whether you recognize a real-world mistake.
How to prepare in limited time
If cryptography is your weak area, the highest-leverage prep is a hands-on PKI lab. Stand up an offline root CA, issue an intermediate, issue server certificates, configure a real service to use them, then break the chain in three different ways and observe the failure modes. That single lab covers more testable material than 20 hours of flashcard study.
For post-quantum content, read the NIST FIPS 203/204/205 standards summaries. You do not need to read the full documents; the 10-page summaries cover everything CAS-005 tests.
Leave a Reply