CompTIA · CAS-005
CompTIA SecurityX (CAS-005) Practice Tests
CompTIA SecurityX (formerly CASP+) is an advanced-level cybersecurity certification for senior security engineers and architects that validates the ability to design, implement, and integrate secure solutions across complex enterprise environments. It covers governance, risk, compliance, security architecture, engineering, and operations.
Exam Details
Practice Questions
599
≈ 6 practice exams
Duration
165 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
Oct 2026
Topics Covered
Security EngineeringSecurity ArchitectureSecurity OperationsGovernance, Risk, and ComplianceHybrid and Multicloud SecurityCryptography and IdentityAutomation and Incident Response
CompTIA SecurityX CAS-005 Practice Exam
SecurityX is CompTIA's advanced practitioner credential for security architects and senior security engineers. CAS-005 weights Security Engineering at 31%, Security Architecture at 27%, Security Operations at 22%, and Governance, Risk, and Compliance at 20%, so most of the scored outline tests implementation and design judgment in complex enterprise environments.
The exam contains no more than 90 multiple-choice and performance-based questions and allows up to 165 minutes. CompTIA reports only pass or fail and does not publish a numeric cut score. There is no enforced prerequisite, but the recommended background is 10 years in IT, including five years of hands-on technical security, with knowledge comparable to Network+, Security+, CySA+, Cloud+, and PenTest+.
Use these 599 questions to practise architectural trade-offs, secure implementation, threat-informed operations, automation, cryptography, identity, hybrid-cloud controls, and risk decisions. Do not convert the pass/fail result into an invented percentage: readiness is better judged by consistent reasoning across all four domains and by practising performance-based scenarios.
Exam Domain Breakdown
Security Engineering31%
Security Architecture27%
Security Operations22%
Governance, Risk, and Compliance20%
Exam Overview
CompTIA SecurityX (CAS-005) is the advanced practitioner certification that succeeded CASP+. It validates the ability to engineer, architect, integrate, and operate security controls across complex enterprise environments while making governance and risk decisions.
The official outline assigns 31% to Security Engineering, 27% to Security Architecture, 22% to Security Operations, and 20% to Governance, Risk, and Compliance. The credential is vendor-neutral and focuses on senior technical judgment rather than one product stack.
Who Should Take This Exam
SecurityX is designed for security architects, senior security engineers, and other practitioners responsible for designing and integrating enterprise security solutions. CompTIA maps it to advanced technical work rather than an entry-level analyst role.
The recommended background is 10 years of IT experience, including five years of hands-on technical security, with knowledge comparable to Network+, Security+, CySA+, Cloud+, and PenTest+.
Prerequisites
CompTIA does not enforce a prerequisite certification or experience check for CAS-005. Its recommendation is substantial: 10 years of general hands-on IT experience, including five years of hands-on technical security.
Candidates should already be comfortable with enterprise networking, identity, cloud and hybrid architectures, cryptography, vulnerability management, incident response, automation, and governance before attempting SecurityX.
Exam Format
The CAS-005 exam consists of a maximum of 90 questions, delivered in a maximum of 165 minutes. Question types include both multiple-choice and performance-based questions (PBQs), where candidates must interact with simulated environments or scenarios to demonstrate applied skills. The exam is available in English via online proctoring through Pearson VUE's OnVUE platform or at a physical Pearson VUE testing center.
The exam uses a pass/fail grading model — no scaled score is reported. CompTIA does not publish a numeric passing threshold for SecurityX; candidates simply receive a pass or fail result. The certification is valid for three years and can be renewed through CompTIA's Continuing Education (CE) program by earning 75 CEUs within the three-year cycle.
Skills Measured
- 1.Security Engineering (31%): Applies secure configurations and integrates security solutions across enterprise systems, including cloud-native and hybrid architectures, containers, CI/CD pipelines, and infrastructure-as-code. Covers PKI, cryptographic protocol selection, key management, and the security implications of AI and emerging technologies.
- 2.Security Architecture (27%): Designs secure network and system architectures for complex environments including on-premises, cloud, and hybrid. Addresses zero trust principles, network segmentation, identity federation, CASB, shadow IT detection, shared responsibility models, and integration of security controls across multi-vendor ecosystems.
- 3.Security Operations (22%): Supports continuous security operations through automation, monitoring, threat hunting, and incident response. Covers SIEM/SOAR integration, vulnerability management, digital forensics, log analysis, and coordinating response activities across enterprise and third-party stakeholders.
- 4.Governance, Risk, and Compliance (20%): Addresses enterprise risk management frameworks, regulatory compliance (GDPR, HIPAA, CMMC, FedRAMP), third-party risk, security policy development, privacy requirements, and aligning security programs with business objectives and legal obligations.
Study Tips
- Use the current official CAS-005 Exam Objectives as the master checklist for every domain and subdomain.
- Allocate 58% of study time to Security Engineering (31%) and Security Architecture (27%), while keeping operations and governance above your minimum readiness level.
- Practise performance-based scenarios involving configuration, analysis, architecture, and troubleshooting rather than relying only on multiple-choice recall.
- For architecture questions, identify the business, risk, compliance, and technical constraints before comparing controls.
- Connect cryptography, identity, network, endpoint, cloud, application, and data controls into complete designs instead of studying each in isolation.
- Rehearse incident and vulnerability decisions from detection through containment, remediation, validation, documentation, and improvement.
Career Benefits
SecurityX provides an advanced, vendor-neutral signal for senior technical security work. It is most relevant to roles such as security architect, senior security engineer, security integration engineer, and security operations lead.
Its distinction is breadth at implementation and architecture depth: candidates must connect engineering, architecture, operations, and governance rather than specialise in only management or offensive testing.
Sample Questions
5 sample questions with answers and explanations. The full bank has 599 questions, enough for 6 full-length practice exams.
Preview — answers shown1. Litware's incident response team is conducting memory forensics on a suspected compromised Windows server using the Volatility framework. Which Volatility plugins should be used to identify processes with injected malicious code and extract network connection information? (Select two!)
Multiple correct answersApslist
Bmalfind
Cnetscan
Dhivelist
Ehashdump
Explanation
The malfind plugin identifies injected code and memory segments with suspicious characteristics such as executable memory regions not backed by files on disk, which is typical of code injection techniques. It scans process memory for indicators of malicious code injection including unusual memory protections like RWX regions and packed or encoded code. The netscan plugin extracts network connection information from memory, showing active and recently closed TCP/UDP connections, listening sockets, and associated processes—critical for identifying command-and-control communications. The pslist plugin lists running processes but does not detect injected code. The hivelist plugin lists registry hives in memory, and hashdump extracts password hashes—both useful for forensics but not for the specific requirements of identifying injection and network activity.
2. Litware is implementing security for an industrial control system. Which security objective priority order aligns with OT/ICS security principles? (Select one!)
AAvailability > Integrity > Confidentiality
BAvailability > Confidentiality > Integrity
CConfidentiality > Integrity > Availability
DIntegrity > Confidentiality > Availability
Explanation
OT/ICS environments prioritize Availability first (continuous operations and safety), then Integrity (accurate sensor data and control commands are critical for safety), and finally Confidentiality (while important, it's secondary to keeping systems running safely). This is the opposite of traditional IT environments which typically prioritize Confidentiality first. Any security control that might impact system availability must be carefully evaluated in OT environments.
3. Adatum is investigating a security incident on a compromised Windows server. The analyst needs to identify both active and hidden processes, including those that may have unlinked themselves from normal process lists. Which Volatility plugin provides the most comprehensive process discovery? (Select one!)
Apsscan
Bmalfind
Cpslist
Dnetscan
Explanation
The psscan plugin in Volatility scans physical memory for EPROCESS structures to find processes, including those that have been unlinked from the active process list (as rootkits commonly do). Unlike pslist, which traverses the doubly linked list of active processes and misses hidden processes, psscan performs a raw scan of memory and can find terminated and hidden processes. Netscan identifies network connections not processes, and malfind finds injected code rather than providing comprehensive process enumeration.
4. Litware's incident response team is conducting memory forensics on a compromised Windows server using the Volatility framework. Which Volatility plugin should the analyst use to identify potentially injected or malicious code residing in process memory that may not be backed by a file on disk? (Select one!)
Amalfind
Bnetscan
Cpslist
Dhashdump
Explanation
The malfind plugin in Volatility is specifically designed to detect injected or malicious code in process memory by identifying memory segments with unusual permissions (such as executable and writable), code that isn't backed by files on disk, and other indicators of code injection. The pslist plugin lists running processes, netscan shows network connections, and hashdump extracts password hashes from memory, none of which directly identify injected malicious code.
5. Northwind Traders is implementing NIST Risk Management Framework (RMF) for their federal contract systems. The CISO asks which step was added in RMF Rev 2 to establish organization-level risk management context before system-specific activities begin. Which RMF step addresses this requirement? (Select one!)
APrepare
BMonitor
CCategorize
DSelect
Explanation
The Prepare step was added in NIST RMF Rev 2 (SP 800-37 Rev 2) as the first step in the seven-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor). Prepare establishes organization-level and system-level contexts, identifies roles and responsibilities, and sets up the risk management strategy before system-specific categorization and control selection activities begin. This step recognizes that effective risk management requires organizational preparation before individual system authorization activities.
Frequently Asked Questions
How many questions are on SecurityX CAS-005?
CAS-005 has a maximum of 90 multiple-choice and performance-based questions and allows up to 165 minutes.
What is the SecurityX passing score?
CompTIA reports pass or fail and does not publish a numeric cut score for SecurityX.
What are the CAS-005 domain weights?
Security Engineering is 31%, Security Architecture 27%, Security Operations 22%, and Governance, Risk, and Compliance 20%.
Does SecurityX have prerequisites?
There are no enforced prerequisites. CompTIA recommends 10 years of IT experience, including five years of hands-on technical security.
Is SecurityX the same as CASP+?
SecurityX is the current name of CompTIA's advanced security certification; CAS-005 replaced the CASP+ CAS-004 exam.
How long is SecurityX valid?
SecurityX is valid for three years and participates in CompTIA's Continuing Education program.
More CompTIA Practice Exams
CompTIA Security+ (SY0-701)
SY0-701 · 700 questions
CompTIA Cybersecurity Analyst+ (CySA+) (CS0-003)
CS0-003 · 700 questions
CompTIA Cloud+ (CV0-004)
CV0-004 · 700 questions
CompTIA Project+ (PK0-005)
PK0-005 · 696 questions
CompTIA SecAI+ Certification (CY0-001)
CY0-001 · 600 questions
CompTIA Tech+ IT Fundamentals (FC0-U71)
FC0-U71 · 599 questions
$29.99
One-time access to this exam
599 questions (6 practice exams' worth)
Unlimited timed exam simulations
Lifetime $29.99 or $9.99/month, cancel anytime
Detailed explanations
Free preview stays available