CompTIAExpert Level2026 Updated

CompTIA SecurityX (CAS-005, formerly CASP+)

Updated May 1, 202612 min readCertsqill Editorial

Quick facts — CAS-005

Exam cost

$544 USD

Questions

Time limit

165 minutes

Passing score

Not published by the vendor

Testing

Pearson VUE

Who this exam is for

The CompTIA SecurityX (CAS-005, formerly CASP+) certification is designed for professionals who work with or want to work with CompTIA technologies in a professional capacity. It is taken by cloud engineers, DevOps practitioners, IT administrators, and technical professionals looking to validate their expertise.

You do not need extensive prior experience to attempt it, but you will benefit from hands-on familiarity with the subject matter. The exam tests applied knowledge and architectural judgment, not just memorization. If you can reason about trade-offs and real-world scenarios, structured practice will handle the rest.

Domain breakdown

The CAS-005 exam is built around official domains, each with a fixed percentage of the question pool. This distribution should directly inform how you allocate your study time.

Domain

Weight

Focus areas

Governance, Risk and Compliance

20%

Security program documentation (policies, procedures, standards, guidelines), program management including training and RACI, frameworks such as COBIT and ITIL, configuration management with CMDB and asset life cycle, and GRC tooling for mapping, automation and compliance tracking.

Security Architecture

27%

Cloud capabilities including CASB, shadow IT detection and the shared responsibility model; CI/CD pipelines, Terraform, Ansible, container security, orchestration and serverless workloads; cloud data security covering exposure, leakage, remanence and encryption keys; and zero trust subject-object relationships.

Security Engineering

31%

Automation with PowerShell, Bash and Python, event triggers, IaC, cloud APIs, generative AI, containerisation, patching and SOAR; vulnerability management with SCAP (OVAL, XCCDF, CPE, CVE, CVSS); and advanced cryptography including post-quantum, key stretching, homomorphic encryption and forward secrecy.

Security Operations

22%

Monitoring and data analysis with SIEM event parsing, retention and false positives, aggregate analysis for correlation and trends, and behaviour baselines for network, systems and users; plus attack surface work on injection, XSS, insecure configuration, outdated software and weak ciphers.

Note the domain with the highest weight — many candidates under-invest here because it feels conceptual. In practice, this is where the exam is most precise, with scenario-based questions that test specifics.

What the exam actually tests

This is not a memorization exam. Questions require applied judgment under constraints. Almost every question includes a scenario with explicit requirements and asks you to select the most appropriate solution.

Here are examples of the question types you will encounter:

Enterprise Architecture PBQ

Given a network diagram with DMZ, internal zones, and a new cloud integration requirement, design the security architecture including firewall rules, segmentation, and monitoring placement.

CASP+ PBQs require you to synthesize multiple security domains into a coherent design. There is no single right answer — the exam awards points for demonstrating sound reasoning and trade-off analysis.

Post-Quantum Cryptography

A government contractor must ensure data confidentiality beyond 2035. Current RSA-2048 infrastructure is in place. What migration strategy BEST addresses quantum computing threats?

CASP+ tests awareness of NIST post-quantum standards (CRYSTALS-Kyber for encryption, CRYSTALS-Dilithium for signatures). Know the harvest-now-decrypt-later threat model and crypto-agility strategies.

Security Trade-Off Analysis

A business unit requires real-time access to production data for analytics. Security policy prohibits direct production access. Which solution BEST balances business requirements with security controls?

CASP+ tests practitioner-level judgment: no purely correct answer. The exam rewards solutions that acknowledge trade-offs, use compensating controls, and document residual risk — not solutions that simply block business requirements.

How to prepare — 4-week study plan

This plan assumes one hour per weekday and roughly 30 minutes of lighter review on weekends. It is calibrated for someone with some relevant experience. If you are starting from zero, add an extra week before Week 1 to familiarise yourself with the basics.

Week 1: Enterprise Security Architecture

Study the Security Architecture domain (27%): cloud capabilities, CASB, shared responsibility, container and serverless security, zero trust subject-object relationships
Review network security zone models: DMZ design, microsegmentation, east-west traffic inspection
Study supply chain security, third-party integration risk, and secure design patterns for APIs
Complete 60 architecture-focused practice questions and 1 full PBQ scenario

Week 2: Security Operations & Advanced Threat Response

Study the Security Operations domain (22%): SIEM event parsing and retention, aggregate analysis, behaviour baselines, and attack-surface mitigation
Cover advanced incident response: malware analysis basics, memory forensics concepts, threat attribution
Practice vulnerability prioritization in complex enterprise environments with multiple asset classes
Complete 80 security operations practice questions

Week 3: Cryptography, Engineering & GRC

Study the Security Engineering domain (31%), the largest one: automation and SOAR, vulnerability management with SCAP, advanced cryptography and crypto-agility
Cover post-quantum cryptography: NIST PQC algorithm families and migration planning strategies
Study the Governance, Risk and Compliance domain (20%): program documentation, COBIT and ITIL, configuration management and GRC tooling
Complete 2 full 90-question mock exams under timed conditions

Week 4: PBQ Intensive & Final Review

Spend 4+ hours on CASP+ PBQ practice — scenario-based questions requiring multi-step responses
Review trade-off analysis frameworks: how to evaluate security vs. usability vs. cost in exam scenarios
Study CAS-005 specific content: generative AI in automation, post-quantum cryptography, and cloud control strategies
Focus on areas below 70% accuracy; CASP+ rewards depth of knowledge over breadth

Common mistakes candidates make

These patterns appear repeatedly among candidates who resit this exam. Knowing them in advance is worth several percentage points.

Underestimating the practical difficulty of PBQs

CASP+ has a higher PBQ density than other CompTIA exams. These are not simple drag-and-drop — they require designing security architectures, analyzing complex scenarios, and justifying multi-layered decisions. Practice with realistic enterprise scenarios.

Not knowing post-quantum cryptography concepts

NIST finalized post-quantum standards in 2024: CRYSTALS-Kyber (ML-KEM) for key encapsulation and CRYSTALS-Dilithium (ML-DSA) for digital signatures. CASP+ tests awareness of quantum threats and migration strategies including crypto-agility.

Treating CASP+ like a harder Security+

CASP+ is not just more Security+ content. It tests practitioner judgment in ambiguous situations where you must weigh business requirements against security controls. Right answers often involve accepting residual risk with compensating controls, not eliminating risk entirely.

Expecting a numerical score

CASP+ reports only pass or fail — there is no scaled score. You cannot calculate "how close" you were. This means you need consistent performance across all domains, not just strong performance in a few.

Is Certsqill right for you?

Honestly: Certsqill is built for candidates who have already done some studying and want to convert knowledge into exam performance. If you have never touched the subject, start with a foundational course first — then come to Certsqill when you are ready to practice.

Where Certsqill is strong: question depth, expert-developed explanations, and domain analytics. Every question is mapped to the exam blueprint. When you get something wrong, a detailed explanation shows why the right answer is right and why each wrong answer fails under the specific constraints in the question.

Where Certsqill is not a replacement: video courses and hands-on labs. Use Certsqill to test and sharpen — not as your first exposure to a topic you have never encountered.

Ready to start practicing?

Exam-accurate CAS-005 practice questions. Detailed explanations. Try 20 free.