SecurityX CAS-005 Exam Objectives Explained: All 23 Objectives and Domain Weights
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
SecurityX CAS-005 is built on 23 objectives in four domains, and Security Engineering and Security Architecture together are 58% of the exam. The exam has up to 90 multiple-choice and performance-based questions in up to 165 minutes and is graded pass/fail only, with no scaled score. CompTIA recommends at least ten years of IT experience, including five in security. This guide lists every official objective title with a plain-English explanation, grouped by domain with the published weights. The official CompTIA objectives document is the authoritative source, and the explanations here are our own wording.
SecurityX CAS-005 at a Glance
SecurityX is CompTIA's advanced security practitioner certification, previously branded CASP+. The current version is V5 (CAS-005), launched on December 17, 2024. Figures come from CompTIA's certification page.
| Exam fact | SecurityX CAS-005 |
|---|---|
| Questions | Maximum of 90 |
| Question types | Multiple-choice and performance-based |
| Length | Maximum of 165 minutes |
| Grading | Pass/fail only, with no scaled score |
| Recommended experience | At least 10 years of general hands-on IT experience, including 5 years of hands-on security, plus Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge |
| Retirement | Usually about three years after launch, estimated 2027 |
Because SecurityX reports only pass or fail, there is no score to compare or improve on, so practice should focus on being consistently right across all four domains.
Domain Weights and Objective Counts
SecurityX has four domains and 23 objectives. Security Engineering and Security Architecture together are 58% of the exam.
| Domain | Weight | Objectives |
|---|---|---|
| 1. Governance, Risk, and Compliance | 20% | 5 |
| 2. Security Architecture | 27% | 6 |
| 3. Security Engineering | 31% | 8 |
| 4. Security Operations | 22% | 4 |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Domain 1: Governance, Risk, and Compliance (20%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 1.1 | Given a set of organizational security requirements, implement the appropriate governance components. | Turning business and security requirements into policies, standards and a governance structure |
| 1.2 | Given a set of organizational security requirements, perform risk management activities. | Assessing, treating and tracking risk against the organization's requirements |
| 1.3 | Explain how compliance affects information security strategies. | How laws, regulations and standards shape security decisions |
| 1.4 | Given a scenario, perform threat-modeling activities. | Identifying likely attackers, targets and attack paths to guide design and defense |
| 1.5 | Summarize the information security challenges associated with artificial intelligence (AI) adoption. | The security and risk issues organizations face when they adopt AI |
Domain 2: Security Architecture (27%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 2.1 | Given a scenario, analyze requirements to design resilient systems. | Designing for availability, redundancy and recovery from stated requirements |
| 2.2 | Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages. | Building security in from design through operation and retirement |
| 2.3 | Given a scenario, integrate appropriate controls in the design of a secure architecture. | Choosing and placing controls so the architecture meets its security goals |
| 2.4 | Given a scenario, apply security concepts to the design of access, authentication, and authorization systems. | Designing identity, authentication and authorization that fit the risk |
| 2.5 | Given a scenario, securely implement cloud capabilities in an enterprise environment. | Adopting cloud services without losing control of data and access |
| 2.6 | Given a scenario, integrate Zero Trust concepts into system architecture design. | Applying zero trust principles, such as verifying explicitly and limiting access, to a design |
Domain 3: Security Engineering (31%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 3.1 | Given a scenario, troubleshoot common issues with identity and access management (IAM) components in an enterprise environment. | Diagnosing and fixing failures in identity, authentication and access systems |
| 3.2 | Given a scenario, analyze requirements to enhance the security of endpoints and servers. | Hardening and protecting endpoints and servers against stated threats |
| 3.3 | Given a scenario, troubleshoot complex network infrastructure security issues. | Finding the cause of security problems in segmentation, firewalls and network design |
| 3.4 | Given a scenario, implement hardware security technologies and techniques. | Using hardware-based protections to secure devices and keys |
| 3.5 | Given a set of requirements, secure specialized and legacy systems against threats. | Protecting operational technology, embedded and older systems that cannot be patched normally |
| 3.6 | Given a scenario, use automation to secure the enterprise. | Using scripting and orchestration to apply and verify security at scale |
| 3.7 | Explain the importance of advanced cryptographic concepts. | Deeper cryptographic ideas that underpin modern security design |
| 3.8 | Given a scenario, apply the appropriate cryptographic use case and/or technique. | Picking the right cryptographic approach for a given need |
Domain 4: Security Operations (22%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 4.1 | Given a scenario, analyze data to enable monitoring and response activities. | Reading logs, telemetry and alerts to detect and respond to events |
| 4.2 | Given a scenario, analyze vulnerabilities and attacks, and recommend solutions to reduce the attack surface. | Evaluating weaknesses and attacks and recommending changes that shrink exposure |
| 4.3 | Given a scenario, apply threat-hunting and threat intelligence concepts. | Using intelligence and hunts to find threats before they cause damage |
| 4.4 | Given a scenario, analyze data and artifacts in support of incident response activities. | Examining evidence to understand and contain an incident |
How to Study for SecurityX
Almost every objective starts with "Given a scenario" or "Given a set of requirements", so this exam tests judgment under constraints, not recall. Expect long scenarios with several defensible answers and a best one.
Practice trade-off reasoning
For each scenario, name the requirement that decides the answer, such as cost, risk appetite, compliance or availability, and explain why the other options fail it.
Weight your time by domain
Give Security Engineering (31%) and Security Architecture (27%) the most time, but do not skip Governance, Risk, and Compliance at 20%, since it frames every design decision.
Fill gaps from the earlier exams
CompTIA recommends Network+, Security+, CySA+, Cloud+ and PenTest+ knowledge. If you are weak in an area, such as cloud or testing, close that gap first.
Rehearse performance-based questions
Practice configuring or analyzing in a simulated environment, and pace yourself across up to 165 minutes.
Learn the AI objective
Objective 1.5 covers information security challenges with AI adoption, so be ready to discuss both the risks and the controls.
Where SecurityX Fits
SecurityX sits at the top of CompTIA's security track and expects around a decade of experience. See our guide to the CompTIA security certification path for how it follows Security+, CySA+ and PenTest+, and our CISSP domains guide for a senior credential from a different body.
Studying With DD Academy
DD Academy covers SecurityX CAS-005 with flashcards, scenario practice questions and an AI tutor that explains every answer, alongside Security+, Network+, CySA+, PenTest+, CISA and CISSP. It is free to start on iPhone and the web.
The bottom line
SecurityX tests judgment under constraints, so practice scenario questions, weight your time toward engineering and architecture, and close gaps from the earlier CompTIA exams. Confirm the current version and retirement date on CompTIA's page before a long plan.
Frequently asked questions
How many questions are on the SecurityX CAS-005 exam?
SecurityX CAS-005 has a maximum of 90 questions, a mix of multiple-choice and performance-based, in up to 165 minutes. It is graded pass/fail only, with no scaled score, according to CompTIA.
What are the SecurityX CAS-005 domains and weights?
Governance, Risk, and Compliance 20%, Security Architecture 27%, Security Engineering 31%, and Security Operations 22%. The exam has 23 objectives across the four domains.
Is SecurityX the same as CASP+?
SecurityX is CompTIA's current name for its advanced security practitioner certification, which was previously branded CASP+. The current exam is CAS-005, launched December 17, 2024.
What experience does CompTIA recommend for SecurityX?
At least 10 years of general hands-on IT experience, including 5 years of hands-on security, plus Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge. These are recommendations and not prerequisites.
Does SecurityX have a passing score?
CompTIA grades SecurityX pass/fail only, with no scaled score. That means there is no numeric score to report, and candidates simply pass or fail.
When does SecurityX CAS-005 retire?
CompTIA says versions are usually retired about three years after launch, and estimates 2027 for CAS-005, which launched December 17, 2024. Check CompTIA's SecurityX page for the confirmed date.
Is there an AI objective in SecurityX?
Yes. Objective 1.5 asks you to summarize the information security challenges associated with AI adoption. It is part of Domain 1, Governance, Risk, and Compliance, which is 20% of the exam.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
