CompTIA SecurityX CAS-005 — Lesson 3: Risk Analysis, Threat Modeling, Supply Chain, and Resilient Design

Learning Objectives

• Explain the roles, prerequisites, dependencies, and decision points shaping risk analysis, threat modeling, supply chain, and resilient design.
• Complete the workflow and produce risk-informed resilient design report that another practitioner can review.
• Resolve “a critical supplier dependency lacks an executable contingency” through a controlled and evidence-led troubleshooting process.

Detailed Topics

• threat modeling
• quantitative risk
• third-party risk
• supply chain
• resilience
• control gaps
• exceptions
• architecture review
• Security, performance, resilience, rollback, documentation, and support considerations for risk analysis, threat modeling, supply chain, and resilient design

Instructor Demonstration

The instructor demonstrates the complete risk analysis, threat modeling, supply chain, and resilient design workflow, records each material checkpoint in risk-informed resilient design report, and contrasts the accepted state with a controlled condition where a critical supplier dependency lacks an executable contingency.

Hands-On Exercise

Implement or analyze Risk Analysis, Threat Modeling, Supply Chain, and Resilient Design in a controlled environment. Establish a baseline, reproduce or examine “a critical supplier dependency lacks an executable contingency,” isolate the proven cause, apply a reversible correction, and retain the accepted outcome in risk-informed resilient design report.

1. Confirm scope, access, dependencies, expected behavior, and safety constraints.
2. Execute the planned workflow while preserving configuration and operational checkpoints.
3. Test an expected path, a boundary condition, and the identified failure or exception.
4. Retest after correction and document rollback, ownership, escalation, and preventive action.

Scenario Analysis

• Identify the requirement with the greatest influence on risk analysis, threat modeling, supply chain, and resilient design.
• Compare two valid implementation or recovery choices using impact and evidence quality.
• Explain how the risk-informed resilient design report should be retained and transferred to the operational owner.

Troubleshooting Guidance

Start with effective configuration, recent changes, identities, connectivity, health, logs, and timing. Use risk-informed resilient design report to locate the earliest divergence between intended and observed behavior. Treat “a critical supplier dependency lacks an executable contingency” as a hypothesis until the corrected path passes the original test and a relevant boundary test.

Validation Checklist

• The implemented state for risk analysis, threat modeling, supply chain, and resilient design is traceable to approved requirements and inputs.
• The risk-informed resilient design report contains baseline, test, exception, correction, and accepted-result evidence.
• Security, data handling, capacity, performance, resilience, downstream impact, and rollback were considered where relevant.
• Monitoring, escalation, recovery, documentation, and support ownership are clear.

Lesson Outcome

Learners can apply Risk Analysis, Threat Modeling, Supply Chain, and Resilient Design, explain the decisions made, and defend the result with risk-informed resilient design report.