Skip to content

CompTIA SecurityX (CAS-005)

CompTIA's advanced security certification, formerly CASP+. It is aimed at senior security engineers and architects who design and run controls across cloud, network and applications, and who answer for them to governance. It is hands-on rather than managerial: expect performance-based questions where you configure or analyse something.

Exam Details

  • Exam Code: CAS-005 (V5, released December 17, 2024)
  • Duration: maximum of 165 minutes
  • Questions: maximum of 90, multiple choice and performance-based
  • Passing Score: pass/fail only; no scaled score
  • Cost: not verified (the CompTIA page states no price)
  • Recommended experience: 10 years of general IT including 5 years of hands-on security

A draft V6 objectives document exists on CompTIA's "under development" page. Check the current version before you book. Full detail and sources in the fact sheet.

Domains

Domain Weight Notes
1. Governance, Risk, and Compliance 20% 01
2. Security Architecture 27% 02
3. Security Engineering 31% 03
4. Security Operations 22% 04

How the exam thinks

SecurityX questions describe a business constraint and ask for the best design or response, and several answers are technically possible. The right one satisfies the constraint with the least complexity and the strongest control. Typical constraints: regulated data, a legacy system that cannot change, a multi-cloud estate, a limited budget, or a requirement to keep working during an attack. Performance-based items give you logs, configurations or diagrams to interpret.

Security Engineering is the largest domain (31%) and mixes automation, vulnerability management and cryptography, so budget the most time there.

Study sequence

  1. Governance, risk and compliance (20%) - the vocabulary and the frameworks that justify every later decision.
  2. Security architecture (27%) - cloud, network, boundaries and zero trust.
  3. Security engineering (31%) - automation, vulnerability management and cryptography.
  4. Security operations (22%) - monitoring, hunting and incident response.

Schedule in the practice plan.

Study resources