CompTIA SecurityX (CAS-005) Study Strategy¶

What kind of exam this is¶

Up to 90 questions in up to 165 minutes, a mix of multiple choice and performance-based items, graded pass/fail with no scaled score. Performance-based questions take longer; skip them first, do the multiple choice, then come back.

Reading questions¶

1. Underline the constraint: regulated data, legacy system, budget, unmanaged devices, multi-cloud, must keep running.
2. Decide the layer: governance (policy and risk), architecture (design), engineering (build and automate) or operations (detect and respond). Wrong-layer answers are common distractors.
3. Prefer the answer that satisfies the constraint with the strongest control and least complexity. "Best" and "most appropriate" mean several answers work, so rank them.
4. Reject answers that remove a control to fix a usability problem, or that depend on a person doing a repeatable task.

Distinctions to own¶

• Policy, standard, procedure, guideline.
• Qualitative and quantitative risk assessment, SLE and ALE.
• API-based and proxy-based CASB.
• Segmentation and microsegmentation.
• Preventative, proactive and detective cloud controls.
• CVE, CVSS, CPE, OVAL, XCCDF - what each is.
• Tokenization, encryption, hashing, cryptographic erase.
• Threat hunting and alert triage.
• Static and dynamic malware analysis.

Weights¶

Resources¶

Use the SecurityX page as the checklist, the notes for explanation, and the practice questions to find gaps. If you also hold or plan Security+ or CISSP, see Security+ and CISSP for overlap.