SecurityX is CompTIA's expert-level security certification. It was called CASP+ (CompTIA Advanced Security Practitioner) until December 17, 2024, when CompTIA rebranded it with the launch of the V5 exam, CAS-005. The older CAS-004 exam retired in June 2025. If you held an active CASP+, CompTIA converted it to SecurityX automatically, and continuing education works the same way it did before.
The exam is written for people who already design and run security programs: architects, senior engineers, and senior analysts. Questions describe an enterprise situation and ask you to choose the design, control, or fix that best fits stated requirements. Knowing what a technology is will rarely be enough. You need to know when it is the right answer and when a nearby option is better.
SecurityX is scored pass/fail with no scaled score. Unlike Security+ or CySA+, you will not get a number on a 100 to 900 scale, and CompTIA does not publish a cut score, so you will never know how close you were. Prepare accordingly: do not rely on one strong domain to carry a weak one, aim for steady results across all four, and trust your practice scores only once they hold up across several attempts. This guide follows the official CAS-005 objectives (version 3.0). CompTIA estimates retirement around 2027 but has not announced a date.
Practice as you read
600+ SecurityX (CASP+) questions with explanations, plus timed mock exams.
Get startedThe exam at a glance
| Exam code | CAS-005 (SecurityX V5), launched December 17, 2024 |
|---|---|
| Questions | Maximum of 90 |
| Time | 165 minutes |
| Scoring | Pass/fail only, no scaled score |
| Question types | Multiple-choice and performance-based |
| Price (US voucher) | $544 USD list price at the CompTIA Store |
| Prerequisites | None required. CompTIA recommends at least 10 years of hands-on IT experience, including 5 years of hands-on security, plus Network+, Security+, CySA+, Cloud+, and PenTest+ or equivalent knowledge |
What each domain tests
Governance, Risk, and Compliance
20%Building and running a security program that satisfies regulators, auditors, and the business, including threat modeling and the security impact of AI adoption.
- Policies, standards, procedures, guidelines, RACI, COBIT, and ITIL
- Quantitative vs. qualitative risk, appetite vs. tolerance, third-party and subprocessor risk
- PCI DSS, ISO/IEC 27000, SOC 2, NIST CSF, CIS, CSA, GDPR, CCPA, LGPD, COPPA
- Legal holds, e-discovery, export controls, due diligence vs. due care
- Threat modeling with ATT&CK, CAPEC, Cyber Kill Chain, Diamond Model, STRIDE, and attack trees
- AI threats: prompt injection, training data poisoning, model inversion, excessive agency
Security Architecture
27%Designing resilient, secure systems across on-premises, cloud, and hybrid environments, from component placement to Zero Trust.
- Placement of firewalls, IPS/IDS, WAF, proxies, API gateways, taps, and collectors
- Software assurance: SAST, DAST, IAST, RASP, SCA, SBoM, and CI/CD controls
- Federation, SSO, conditional access, policy decision and enforcement points
- Access control models (RBAC, rule-based, ABAC, MAC, DAC) and PKI architecture
- Cloud: CASB (API vs. proxy), shared responsibility, IaC, containers, serverless, key ownership
- Zero Trust: continuous authorization, microsegmentation, SASE, SD-WAN
Security Engineering
31%Implementing and troubleshooting the controls themselves: identity, endpoints, networks, hardware, specialized systems, automation, and cryptography.
- Troubleshooting SAML, OpenID, OAuth, Kerberos, 802.1X/EAP, PAM, and secrets rotation
- Endpoint hardening: EDR, application control, SELinux, HIPS, MDM, attacker TTPs
- Network issues: DNSSEC, SPF/DKIM/DMARC, TLS cipher mismatch, PKI errors, IDS tuning
- Hardware roots of trust: TPM, vTPM, HSM, secure enclave, Secure Boot vs. measured boot
- OT, ICS/SCADA, IoT, and legacy systems that cannot be patched
- Automation (scripting, IaC, SOAR, SCAP) and advanced crypto (PQC, forward secrecy, AEAD, envelope encryption)
Security Operations
22%Using data to detect, hunt, and respond: SIEM analysis, vulnerability remediation, threat intelligence, and incident response.
- SIEM parsing, duplication, non-reporting devices, retention, correlation, baselines
- Alert prioritization by criticality, impact, asset type, residual risk, data classification
- Vulnerabilities and mitigations: injection, XSS, CSRF, SSRF, TOCTOU, deserialization, confused deputy
- Threat hunting and intel: hypothesis-based searches, honeypots, STIX/TAXII, Sigma, YARA, Snort
- Incident response: sandboxing, reverse engineering, volatile storage, email header and metadata analysis
- Timeline reconstruction, root cause analysis, CWPP, and insider threat
Study plan
This eight-week plan assumes you work in security full time and can study 6 to 8 hours a week. If your background is heavy in one area, shorten those weeks and give the time to Security Engineering, which is the largest domain at 31%. Start with a short set of practice questions in each domain (CyberExamPrep sorts its question bank by domain for this) so you study your gaps instead of what you already know. Keep the official objectives PDF open the whole time and check off each bullet only when you could explain it to a junior colleague and choose it correctly in a scenario.
- Weeks 1-2
Baseline and Governance, Risk, and Compliance
Take a domain-by-domain diagnostic to find weak spots. Then work through GRC: governance frameworks, risk analysis, the compliance standards and privacy laws listed in objective 1.3, and threat modeling. Finish with objective 1.5 on AI security, which is new material for many candidates.
- Weeks 3-4
Security Architecture
Study design decisions, not product features. For each component in objective 2.1, know where it sits and what it protects. Spend real time on cloud shared responsibility, CASB deployment modes, federation design, and Zero Trust building blocks, then drill architecture practice questions until your reasoning holds up on unfamiliar scenarios.
- Weeks 5-6
Security Engineering
This is the biggest domain, so give it two full weeks. Practice troubleshooting: read a broken SAML assertion, a failing TLS handshake, or a misconfigured DMARC record and identify the fault. Cover hardware roots of trust, OT and legacy constraints, SCAP components, and the advanced cryptography in objectives 3.7 and 3.8.
- Week 7
Security Operations
Work with real artifacts: SIEM queries, packet captures, email headers, and vulnerability scan output. Learn the mitigation that matches each vulnerability class in objective 4.2. Review the threat intelligence formats and rule languages until you can tell Sigma, YARA, and Snort use cases apart without thinking.
- Week 8
Timed mocks and remediation
Take at least two full-length timed mock exams under real conditions: 90 questions in 165 minutes, no notes. After each one, review every miss and every lucky guess, and map it back to an objective. When an explanation does not click, ask Aurora, the CyberExamPrep AI tutor, to walk through why the correct option beats the one you picked. Use the remaining days to close those specific gaps and run through the acronym list with flashcards.
- Exam week
Light review and logistics
Stop learning new material two days out. Do short mixed sets to stay sharp, reread your notes on the topics you confuse most, confirm your appointment and IDs, and get a full night of sleep before the exam.
Most-missed topics
These concepts look alike on paper, which is exactly why they trip people up. Know the difference cold.
- Picking the right framework or report
- COBIT is IT governance, ITIL is service management, NIST CSF and CIS are control and best practice frameworks, ISO/IEC 27001 is certifiable, and SOC 2 is an attestation report about a service organization. Questions often hinge on what the requester actually needs, so also be clear on audits vs. assessments vs. certifications.
- Shared responsibility in IaaS, PaaS, and SaaS
- Know which layers move to the provider at each service model and which never do: data, identities, and access configuration stay with you. Pair this with cloud-managed vs. customer-managed encryption keys, since key ownership changes who can access data and who carries the risk.
- SAML vs. OpenID Connect vs. OAuth
- OAuth delegates authorization and issues access tokens. It does not on its own prove who the user is. OpenID Connect adds an identity layer and ID token on top of OAuth 2.0, and SAML uses XML assertions, typically for enterprise browser SSO. Study how each fails, too: clock skew, audience or redirect mismatches, and expired signing certificates.
- Forward secrecy and post-quantum cryptography
- Forward secrecy comes from ephemeral key exchange (DHE or ECDHE), so stealing a server's long-term private key does not decrypt past sessions. Separately, understand why quantum computing threatens RSA, Diffie-Hellman, and ECC, and why symmetric algorithms with longer keys hold up much better.
- Hashing vs. MAC vs. digital signature vs. AEAD
- A hash gives integrity only. A MAC adds authenticity using a shared secret, a digital signature uses a private key and supports non-repudiation, and AEAD modes such as AES-GCM provide confidentiality and integrity together. Scenario questions usually ask for the minimum mechanism that meets the requirement.
- Zero Trust components
- Separate the policy decision point (which evaluates access) from the policy enforcement point (which allows or blocks it), and know how continuous authorization and context-based reauthentication differ from a one-time login. Microsegmentation is not just more VLANs, and SASE is not the same thing as SD-WAN.
- Data sovereignty vs. data residency
- Sovereignty is about which country's laws apply to data, which depends on where it is stored and processed. Residency is the choice of where data physically lives. Read cross-border questions carefully, because a residency control does not always satisfy a sovereignty or export control requirement.
- Choosing a threat modeling method
- STRIDE categorizes threats against a design, ATT&CK and CAPEC catalog real adversary techniques and attack patterns, the Cyber Kill Chain describes attack stages, and the Diamond Model links adversary, capability, infrastructure, and victim. Match the method to the question: designing a new system, analyzing an intrusion, or mapping detections.
How to handle PBQs
Performance-based questions put you in a simulated task: placing controls on a network diagram, fixing a configuration, reading logs to find an attack, or matching cryptographic techniques to requirements. CompTIA does not publish how many PBQs appear on CAS-005, but they take far longer than multiple-choice items and test hands-on judgment that reading alone will not build. The best preparation is repetition on realistic tasks, which is what the PBQ labs at pbq.cyberexamprep.com are designed for.
- Read the entire prompt and every tab or panel before you change anything. The requirements that decide the answer are often in a note or exhibit.
- Write the stated requirements on your whiteboard as a short checklist, then confirm your final answer satisfies each one.
- If a PBQ is taking too long, flag it, move on, and come back after you have banked the multiple-choice points.
- For log and artifact questions, find the timestamp, source, and indicator first, then reason about the attack. Do not pattern-match on one keyword.
- In design and placement tasks, think about trust boundaries and data flow. Ask what each control protects and where traffic actually passes.
- Partial work may still earn credit, so never leave a PBQ blank. Make your best configuration before time runs short.
Exam day
- Choose your delivery: a Pearson VUE test center or OnVUE online proctoring from home or work. For OnVUE, run the system test on the exact computer and network you will use, well before exam day.
- CompTIA's ID policy calls for two valid, unexpired IDs: a government-issued primary ID with your photo and a secondary ID with your name and signature or photo. Your first and last name must match your registration exactly. U.S. military IDs cannot be used for online testing.
- For OnVUE, begin check-in 30 minutes before your appointment to complete ID photos, a room scan, and technology checks. At a test center, arrive early enough to finish check-in and store your belongings.
- At the start of the exam you must accept the CompTIA Candidate Agreement, which includes a nondisclosure requirement. Declining it ends the session.
- Use the flag-for-review feature freely. Answer every question on your first pass, flag anything you are unsure of, and return to flagged items with the time you have left. Unanswered questions cannot help you.
- Pacing: 165 minutes for up to 90 questions is about 1 minute 50 seconds per question. If PBQs take you 8 to 10 minutes each, protect your multiple-choice time by targeting roughly 90 seconds per multiple-choice item and keeping 15 minutes at the end for flagged questions.
FAQ
- How long does it take to study for SecurityX?
- Experienced practitioners typically study 2-3 months. If you're missing experience in areas like cryptography or security architecture, budget more time. This is not a cert to rush.
- Is SecurityX/CASP+ worth it?
- Yes, especially for government/DoD roles (it aligns with DoD 8140 work roles such as security architect and security control assessor), senior enterprise positions, and if you want to stay on the technical track rather than moving into pure management (CISSP path).
- CISSP or SecurityX: which should I get?
- They serve different audiences. CISSP (ISC2) is management-oriented and widely recognized globally. SecurityX is more technical and hands-on. Many senior practitioners hold both. If you want to stay technical, start with SecurityX.
- How does SecurityX compare to CISSP?
- SecurityX is more technical and focused on implementation and architecture. CISSP is broader and more managerial. SecurityX does not require experience verification, while CISSP does. Both require ongoing continuing education to stay current (CEUs for SecurityX, CPEs for CISSP).