Watch the clock on long scenarios.
A February 2026 CAS-005 candidate with eight years in IT had 78 questions, with PBQs first, and found time tight at the end because of the long scenarios.
CompTIA SecurityX (CAS-005) Exam Guide
Validates knowledge of enterprise security architecture and engineering, including governance, risk, compliance and security operations.
SecurityX tests whether you can design, build and run security for a whole organization. Expect long scenarios where several options look reasonable and you choose the best fit for the business. Learn the objectives with one course, practise the hands-on tasks, then use timed tests to work on judgment and pacing.
Understand the exam
Syllabus
1.0Governance, risk, and compliance20%
- 1.1Given a set of organizational security requirements, implement the appropriate governance components.
- 1.2Given a set of organizational security requirements, perform risk management activities.
- 1.3Explain how compliance affects information security strategies.
- 1.4Perform threat-modeling activities.Scenario
- 1.5Summarize the information security challenges associated with artificial intelligence (AI) adoption.
Example scenario: A new vendor will process customers' personal data in another country, and there is no data protection agreement yet. What would you require before the contract is signed?
2.0Security architecture27%
- 2.1Analyze requirements to design resilient systems.Scenario
- 2.2Implement security in the early stages of the systems life cycle and throughout subsequent stages.Scenario
- 2.3Integrate appropriate controls in the design of a secure architecture.Scenario
- 2.4Apply security concepts to the design of access, authentication, and authorization systems.Scenario
- 2.5Securely implement cloud capabilities in an enterprise environment.Scenario
- 2.6Integrate Zero Trust concepts into system architecture design.Scenario
Example scenario: Two merging companies run different identity providers. How would you let staff reach shared applications without weakening either company's access controls?
3.0Security engineering31%
- 3.1Troubleshoot common issues with identity and access management (IAM) components in an enterprise environment.Scenario
- 3.2Analyze requirements to enhance the security of endpoints and servers.Scenario
- 3.3Troubleshoot complex network infrastructure security issues.Scenario
- 3.4Implement hardware security technologies and techniques.Scenario
- 3.5Given a set of requirements, secure specialized and legacy systems against threats.
- 3.6Use automation to secure the enterprise.Scenario
- 3.7Explain the importance of advanced cryptographic concepts.
- 3.8Apply the appropriate cryptographic use case and/or technique.Scenario
Example scenario: The code-signing key for your company's software sits on the build server in plain text. What would you change, and how would you know the fix worked?
4.0Security operations22%
- 4.1Analyze data to enable monitoring and response activities.Scenario
- 4.2Analyze vulnerabilities and attacks, and recommend solutions to reduce the attack surface.Scenario
- 4.3Apply threat-hunting and threat intelligence concepts.Scenario
- 4.4Analyze data and artifacts in support of incident response activities.Scenario
Example scenario: A critical vulnerability is announced in the VPN appliance your company uses. What would you hunt for while the patch is being tested?
Official CAS-005 exam objectives · CAS-005 (V5)
Format
- Questions
- Up to 90
- Duration
- 2h 45m
- Passing score
- Pass/fail
- Delivery
- Test centre or online
- Languages
- English, Japanese
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A company is moving administration of its cloud workloads to a provider portal. Management wants each administrator session to prove who the user is and that the device is healthy, with no standing trust for being on the corporate network. Which approach BEST meets this requirement?
Show answer
B. Zero trust access verifies identity and device health every time. A VPN, a shared account or an IP list all rely on trust that is given once.
Complete a task in a simulated environment, such as reviewing logs, configuring a control or matching findings to responses.
CertUp example
Match each finding from a log review to the best first response. Responses: revoke sessions and require sign-in again; isolate the host and block the domain; renew and deploy the certificate.
Show answer
Two-country sign-in → revoke sessions and require sign-in again; rare-domain traffic → isolate the host and block the domain; expired certificate → renew and deploy the certificate.
Make a study plan
Read the objectives and mark the areas you have not worked in. Choose one main course, then spend the remaining time on hands-on tasks and long scenario questions.
Most candidates spend 60–120 hours. Plan for the low end if you recently passed CySA+ or PenTest+ and design security day to day; add time for domains outside your daily work.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.60 h
- 4Practice with mock examsTake timed practice tests and review every mistake.30 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h
Learn the core concepts
Use one complete CAS-005 course as your main resource and the objectives as your checklist.
Best complete courseSecurityX CAS-005 Complete Course, Labs & Practice Exams
Best low-cost courseCompTIA SecurityX (CAS-005) Complete Course & Practice Exam
Best bookCompTIA SecurityX CAS-005 Certification Guide, 2nd editionExplain the trade-off. For each scenario you study, say why the best option fits the business better than the second-best one. That is the judgment the exam tests.
Practice with mock exams
Use fresh questions to find weak domains, then review why each option is right or wrong. Practise PBQs and take full timed tests, because the long scenarios make pacing harder than on other CompTIA exams.
SecurityX (V5) Practice Questions
Free SecurityX Practice TestCompTIA SecurityX (CAS-005) 6 Practice ExamsAre you ready?
- You can explain the best answer and why the closest alternative is weaker.
- You can complete hands-on configuration and analysis tasks without notes.
- You can finish a timed practice exam with time left to review.
Prepare for exam day
Buy a voucher and schedule with Pearson VUE. The voucher is valid for 12 months, subject to the exam retirement date.
At a test centre
Testing from home
- Bring the identification listed in your appointment confirmation, with the same name as your booking.
- Arrive at the time specified in your confirmation and store personal belongings as instructed.
- Use the exam tutorial before the 165-minute timer starts.
- Run the OnVUE system test on the computer and connection you will use.
- Prepare a private room and clear your desk.
- Have your accepted ID ready and begin check-in at the time stated in your confirmation.
Advice from exam takers
One course plus a large question bank.
Several pass reports describe the same combination, a Dion course and practice exams followed by extra questions from Pocket Prep, with the official objectives as the checklist.
Read for the detail that decides the answer.
A CAS-004 candidate found acronyms the hardest to memorize but said the exam leaned more on scenario judgment than vocabulary. Look for the detail in each question that separates two plausible answers.