Prepare for SecurityX CAS-005 by covering governance, architecture, engineering, and operations, then practicing decisions under stated requirements. This guide includes a syllabus map, an original signature exercise, and preparation advice. Learn the different navigation rules for simulation and virtual PBQs before testing.
Which SecurityX version should you study?
The current exam is CompTIA SecurityX CAS-005, version V5, launched December 17, 2024. SecurityX is the new name for the credential formerly called CASP+, and it targets security architects and senior security engineers who design and implement secure solutions in complex environments.
SecurityX is the name of the credential formerly called CASP+. The current code is CAS-005. Check the exam code on an older book or course rather than judging it by the credential name alone, and map its coverage to the current objectives.
CompTIA states that exam versions usually retire about three years after launch, which puts an estimated SecurityX V5 retirement around 2027. Treat that as an estimate, not a booking deadline: check the certification page for any announced successor before you schedule.
This guide reflects the official certification page and the V5 exam objectives document (document version 7.0) as retrieved on September 14, 2026.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: SecurityX Certification | CompTIA — Certification page, exam details and skills sections, retrieved September 14, 2026; CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0
What experience is recommended?
CompTIA recommends at least 10 years of general, hands-on IT experience, including at least 5 years of broad, hands-on IT security experience.
CompTIA also recommends knowledge at the level of Network+, Security+, CySA+, Cloud+, and PenTest+ or equivalent knowledge. This describes a preparation profile, not a requirement to hold each listed credential.
Map your own experience to the CAS-005 tasks in the objectives document. Use that comparison to target your study and lab work, rather than assuming a job title covers the whole syllabus.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: SecurityX Certification | CompTIA — Certification page, exam details and skills sections, retrieved September 14, 2026; CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0
What to expect on the exam
Expect a maximum of 90 questions, a mix of multiple-choice and performance-based items, in a test of up to 165 minutes. Scoring is pass/fail only — CompTIA publishes no scaled score, so there is no number of questions you can calculate as 'safe.'
The question count is a maximum, so you may receive fewer items. Use timed practice to assess pacing while leaving time for performance-based tasks; do not assume a fixed number or length of those tasks.
Because reporting is pass/fail, unofficial claims about passing percentages or mistake allowances are speculation. The exam is currently delivered in English; CompTIA lists other languages as to be determined, so verify delivery options before booking in another language.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: SecurityX Certification | CompTIA — Certification page, exam details and skills sections, retrieved September 14, 2026; CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0
What to study in each domain
The four domains cover Governance, Risk, and Compliance; Security Architecture; Security Engineering; and Security Operations.
Use the weights alongside your knowledge gaps, rather than treating them as a fixed study schedule or an exact question count. The complete objectives provide the detailed tasks, and their example lists are not exhaustive.
The activities below are study suggestions. Use the relevant technical or governance source when checking a control's actual behavior or requirements.
| Domain | Weight | Topics and suggested practice |
|---|---|---|
| Governance, Risk, and Compliance | 20% | Program documentation, frameworks, data governance, risk, third parties, threat modeling, and compliance. Identify the requirement, accountable decision-maker, and evidence needed in a fictional risk review. |
| Security Architecture | 27% | Resilience, cloud security, network design, segmentation, and Zero Trust concepts. Compare a design with its stated protection and availability requirements. |
| Security Engineering | 31% | IAM, endpoint and network controls, hardware, specialized systems, automation, and cryptography. Trace a specified request or control and explain the assumptions behind its result. |
| Security Operations | 22% | Monitoring, vulnerabilities, attack surfaces, threat hunting, intelligence, and incident response. Distinguish observed evidence from a theory in a sample investigation. |
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0; SecurityX Certification | CompTIA — Certification page, exam details and skills sections, retrieved September 14, 2026
Practice: what does a valid signature establish?
Under the stated trust and implementation assumptions, a valid signature supports origin authentication and integrity. It does not make readable content confidential or establish that software is harmless.
NIST describes digital signatures as providing origin authentication, data integrity, and signatory non-repudiation when properly implemented. The exercise focuses on the cryptographic properties supported by its explicit premises; it does not ask for a legal finding or a software-safety assessment.
Practice scenario
A vendor publishes a firmware image for free download. The file is not encrypted — anyone can fetch and read it. The vendor signs the image with its private key, and you already hold the vendor's public key, which you verified through an approved independent channel. The signature validates over the entire file, the signing key has not been compromised, and the cryptographic implementation is correct. A colleague claims: because the signature is valid, the file is confidential, and because it came from the vendor, it is free of malicious behavior. Is either claim correct?
Show answer
Neither claim is correct. With the trusted publisher key, uncompromised signing key, correct implementation, and complete signature coverage stated in the scenario, validation supports the signed artifact's origin and integrity. The file is publicly readable, so the signature does not make it confidential. No evidence about the software's behavior is supplied.
The signature check concerns the bytes covered by the signature and the signing key associated with the independently validated publisher identity. Those premises matter. A signature alone does not encrypt the file or evaluate what its code will do. Do not extend this result into proof that publication was authorized by a particular person, a legal non-repudiation conclusion, or a guarantee that an audit would establish harmless behavior.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: Digital Signature — NIST CSRC Glossary — Definition under FIPS 186-5; CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0
How to practice decisions from stated requirements
Identify the requirement, the supplied evidence, the relevant control, and any missing information before choosing an answer.
As a study habit, summarize the scenario in a few factual statements. Separate the security property needed from the product name offered. Then explain which facts support your choice and which assumptions would change it.
For a fictional third-party service review, list the data, access, business constraints, contractual responsibilities, and evidence that need assessment. A deadline and team size alone do not establish that one tokenization, encryption, or hosting design is suitable.
For technical lab work, use an environment you control and current documentation for the implementation. A syllabus topic names what to study; it does not verify a generic configuration recipe.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0
Simulation and virtual PBQs: different navigation rules
SecurityX is one of the CompTIA exams that uses both simulation and virtual performance-based questions (PBQs). The rule that matters most: you can skip a simulation PBQ and return to it later, but a virtual PBQ must be completed when you reach it — once you move on, you cannot go back.
A simulation approximates a tool or environment and may restrict functionality. You can skip it and return later, with work saved as you move between questions. Reset clears that question only.
A virtual PBQ uses a full virtual environment. Its warning tells you that you cannot return after moving on. Complete your work on that item before continuing; the simulation skip-and-return advice does not apply to it.
CompTIA says multiple valid solution paths may be recognized and partial credit may be available. It keeps per-item scoring confidential. Use its PBQ guidance and available samples to understand the format without assuming a sample reproduces every feature or question you will receive.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: Performance-Based Questions Overview | CompTIA — Simulation and virtual PBQ descriptions and completion tips; Performance-Based Questions FAQs | CompTIA Blog — FAQ items on reset, navigation, partial credit, and multiple valid paths
Your preparation checklist
Review the full objectives, address your gaps, and practice explaining the evidence behind each answer.
- Check CAS-005 coverage in your books, courses, and practice sets.
- Map experience and study gaps across all four domains.
- Work the signature example before checking its answer and identify why each trust assumption matters.
- Review the simulation and virtual PBQ navigation rules separately.
- Use current technical documentation when checking lab tasks and control behavior.
- Use timed practice and explain mistakes against the relevant objectives.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: CompTIA SecurityX CAS-005 V5 Certification Exam Objectives, Document Version 7.0 — About the Exam, test details, domain weights, and objectives 1.0–4.0; SecurityX Certification | CompTIA — Certification page, exam details and skills sections, retrieved September 14, 2026
Booking and retakes
After a first failure there is no required wait before a second attempt. Before a third or later attempt, wait at least 14 calendar days after your last attempt.
Each attempt normally requires payment. The standard policy does not promise free retests; any retake-assurance bundle has its own terms. After earning a certification, retaking the same exam code requires prior CompTIA consent.
Check current prices, voucher terms, language availability, and appointment instructions with CompTIA before booking.
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition: CompTIA Certification Retake Policy | CompTIA — Retake waiting periods, payment, and same-code rules
Based on CompTIA's certification page, objectives document, PBQ guidance, and retake policy; NIST CSRC for the signature definition
Exam facts checked against official CompTIA sources, September 14, 2026: