How to Pass CompTIA SecurityX (CAS-005), formerly CASP+

First, the name change

If you are searching for CASP+, you are in the right place. CompTIA rebranded CASP+ as SecurityX, and the exam code moved from CAS-004 to CAS-005. CAS-004 retired on 17 June 2025, so CAS-005 is the only version you can now sit. The certification still occupies the same place in CompTIA's lineup, and many employers and job postings continue to say "CASP+", so treat the two names as the same credential.

Everything below targets CAS-005.

SecurityX: CompTIA's Advanced Security Certification

SecurityX is the apex of CompTIA's security certification path. While Security+ covers foundational knowledge, SecurityX tests advanced technical skills and the ability to design and implement security solutions for complex enterprise environments. It is performance-based and scenario-heavy, there are no simple recall questions.

The exam has up to 90 questions in 165 minutes and is scored pass/fail with no numerical score, which is unusual among CompTIA exams and means there is no partial credit target to aim at. It covers four domains.

Domain-by-Domain Strategy

Note the weighting shift in CAS-005: Security Engineering is now the heaviest domain at 31%, ahead of Architecture. If you are working from older CASP+ material that put Architecture first, rebalance your study time accordingly.

Security Architecture (27%)

Covers enterprise security design, cloud and hybrid architecture, and emerging technology security.

Key concepts: Zero trust architecture implementation (not just theory, how to actually design it). Micro-segmentation strategies. Software-defined networking security. Cloud security architecture: multi-cloud, hybrid cloud, cloud-native application protection platforms (CNAPP). Infrastructure as Code (IaC) security. Containerization and orchestration security (Kubernetes, Docker). Serverless security considerations.

CASP+ questions in this domain present complex enterprise scenarios and ask you to DESIGN the solution, not just identify the concept. Example: "An organization with 50,000 employees across 12 countries needs to implement zero trust for their hybrid cloud environment. Which architecture decision addresses the most critical risk while minimizing operational disruption?"

Security Operations (22%)

Covers threat management, vulnerability management, and security monitoring at an advanced level.

Key concepts: Threat intelligence integration: STIX/TAXII, threat intelligence platforms, IOC lifecycle management. Advanced threat hunting: hypothesis-driven hunting, data analytics, MITRE ATT&CK-based hunting. SOAR (Security Orchestration, Automation, and Response) implementation. Advanced vulnerability management: vulnerability chaining, business context prioritization, exception management.

Digital forensics at an advanced level: memory forensics (Volatility), network forensics, cloud forensics, mobile forensics. Incident response: advanced containment strategies, threat actor attribution, coordination with law enforcement.

Security Engineering (31%)

The highest-weighted domain in CAS-005. Covers cryptographic implementations, secure protocols, and hardware security.

Key concepts: Cryptographic agility, designing systems that can transition to new algorithms (post-quantum cryptography consideration). Key management at enterprise scale. Hardware security: TPM, HSM, secure enclaves (Intel SGX, ARM TrustZone). Secure boot chain and firmware security. API security: OAuth 2.0 flows, API gateways, rate limiting, input validation. Blockchain and distributed ledger security considerations.

Advanced PKI: certificate pinning, CT (Certificate Transparency) logs, DANE, automated certificate management (ACME protocol).

Governance, Risk, and Compliance (20%)

The smallest domain but still tested. Covers risk management strategies, compliance, and business continuity at a strategic level.

Key concepts: Risk management frameworks at enterprise scale. M&A (mergers and acquisitions) security due diligence. Supply chain risk management: SBOM (Software Bill of Materials), third-party risk assessment, vendor security scoring. Privacy engineering: data minimization, purpose limitation, privacy by design. Cross-jurisdictional compliance challenges.

CASP+ vs CISSP

Both are advanced certifications, but they test differently:

CASP+ is for practitioners who design and implement. CISSP is for managers who oversee and direct. If a question asks you to choose between a technical solution and a management recommendation, CASP+ wants the technical solution.

Study Strategy

CASP+ requires deep, practical knowledge that cannot be crammed. You need real-world experience with enterprise security architecture.

Weeks 1-3: Domain 1 (Security Architecture), design exercises with real-world scenarios.

Weeks 4-6: Domain 2 (Security Operations), focus on threat hunting and advanced IR.

Weeks 7-9: Domain 3 (Security Engineering), hands-on with cryptographic implementations.

Week 10: Domain 4 (GRC) and practice exams.

PBQ Strategy

CASP+ has more PBQs than any other CompTIA exam, and they are more complex. Common PBQ types:

Practice advanced scenario analysis with CyberCertPrep's CASP+ question bank, featuring enterprise-grade security architecture and engineering problems.