CompTIA SecurityX (CASP+)
CompTIA SecurityX (CAS-005, formerly CASP+) is CompTIA's expert-level cybersecurity credential. Five domains: security governance, security architecture, security engineering, security operations, and security risk and incident response. Exam is 90 multiple-choice and performance-based questions in 165 minutes, pass / fail (no scaled score is published).
Exam fee at last check: $529, per the vendor. The official objectives are at www.comptia.org/en-us/certifications/securityx/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Governance, Risk, and Compliance
Enterprise governance, risk management, third-party risk, compliance frameworks.
- Risk-management frameworks: NIST RMF, ISO 31000, FAIR (Factor Analysis of Information Risk)
- Compliance regimes: HIPAA, PCI DSS 4.0, GLBA, SOX, GDPR, CCPA / CPRA
- Third-party risk: vendor questionnaires (SIG, CAIQ), contract clauses, ongoing monitoring
- Privacy frameworks: data lifecycle, DSAR handling, privacy by design
- Security governance: charters, RACI, board reporting
Primary sources: NIST SP 800-37 Rev. 2 Risk Management Framework
Security Architecture
Enterprise architecture, secure design, advanced cryptography.
- SASE / SSE architectures, zero trust
- Secure SDLC: threat modeling (STRIDE, PASTA), SAST, DAST, IAST
- Cryptography: PKI, HSMs, key escrow, post-quantum cryptography (NIST candidates: Kyber/ML-KEM, Dilithium/ML-DSA, SPHINCS+)
- Identity architecture: federation, OIDC, SAML, SCIM, FIDO2
- Cloud architecture: shared responsibility, multi-cloud, hybrid
Primary sources: NIST SP 800-207 Zero Trust Architecture, NIST Post-Quantum Cryptography Project
Security Engineering
Implementing the architecture: secure configuration, network security, endpoint, application.
- Network: NGFW, IDS/IPS, deception (canaries, honeypots), micro-segmentation
- Endpoint: EDR/XDR, secure boot, TPM, full-disk encryption
- Application: secure code review, WAF, RASP, container security
- Cloud workload: CSPM, CWPP, CNAPP
- Cryptographic engineering: TLS configuration, certificate transparency, OCSP stapling
Primary sources: NIST SP 800-218 Secure Software Development Framework (SSDF)
Security Operations
SOC operations at expert level: detection engineering, threat hunting, vulnerability management.
- SOAR playbook design, integration with SIEM
- Threat-informed detection (MITRE ATT&CK-aligned analytics)
- Threat hunting hypotheses and methodology
- Vulnerability management lifecycle, exploitation-prediction prioritization (EPSS, CISA KEV)
- Cyber threat intelligence integration into operations
Primary sources: MITRE ATT&CK, EPSS (Exploit Prediction Scoring System)
Security Risk and Incident Response
Incident response at enterprise scale, business continuity, disaster recovery.
- Incident response lifecycle (NIST SP 800-61 Rev. 2) at enterprise scale
- Tabletop exercise design
- Business continuity: BIA, RTO, RPO, recovery strategies
- Disaster recovery: hot / warm / cold site, multi-region cloud DR
- Forensic readiness: chain of custody, e-discovery, legal hold
Primary sources: NIST SP 800-61 Rev. 2, NIST SP 800-34 Rev. 1 Contingency Planning Guide
Exam-day strategy
Identify the domain first. CASP+ / SecurityX questions often have multiple plausible answers across domains; the right one belongs to the specific domain the scenario sets up.
On PBQs, take the time to understand the scenario, then commit and move on. PBQs cannot always be revisited.
Watch for scenarios where the right answer requires combining two layers (architecture + engineering, or governance + operations). The exam tests this synthesis.
Post-quantum cryptography is a hot exam topic on CAS-005. Memorize the FIPS 203 / 204 / 205 mapping (ML-KEM, ML-DSA, SLH-DSA).
Pace at roughly 105 seconds per question. 165 minutes for 90 questions is moderate.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of CompTIA. SecurityX (CASP+) is a trademark of CompTIA. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.