Skip to content
CertGPS

CompTIA SecurityX

CompTIA's senior engineering and architecture exam, formerly CASP+, scored pass/fail and built almost entirely on scenario and requirements-based objectives

AdvancedCompTIA

The exam

Exam cost
$544
Study time
6-12 months
Passing score
Pass/fail only; no scaled score
Valid for
3 years

Before you book

  • None required
  • Recommended: 10 years of hands-on IT experience, including 5 years of hands-on security
  • Recommended: Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

CompTIA SecurityX (CAS-005, Formerly CASP+) Study Guide: Exam, Domains and Plan

SecurityX is CompTIA's most senior security certification, called CASP+ until the CAS-005 exam launched on December 17, 2024. It's written for security engineers and architects, and CompTIA recommends ten years in IT, five of them in hands-on security. CompTIA reports the result as pass or fail only, with no scaled score. If you hold an active CASP+, the rename didn't change your status or your renewal.

Who SecurityX is for

The fit is a senior engineer who designs and fixes rather than manages: the person deciding where the web application firewall and the API gateway sit, writing cloud identity policies, or chasing a TLS cipher mismatch across a hybrid network. CompTIA maps SecurityX to DoD 8140 and NICE work roles including security architect, systems requirements planner and security control assessor. You don't need Security+ or CySA+ first, although CompTIA's recommended knowledge covers Network+, Security+, CySA+, Cloud+ and PenTest+.

If you're under five years in security, CySA+ or PenTest+ will match your work better. If you're heading toward a CISO or security manager role, CISSP or CISM says more about running a program. SecurityX gives governance, risk and compliance a fifth of the exam and spends the rest on technical work.

CAS-005 at a glance

ItemCAS-005 (V5)
StatusLaunched December 17, 2024; retirement estimated 2027, no date announced
QuestionsUp to 90, multiple-choice and performance-based
TimeUp to 165 minutes
ScoringPass or fail only; no scaled score
Price (US list)$544 voucher; $709 with one retake
DeliveryPearson VUE test center or online proctoring
LanguagesEnglish and Japanese
PrerequisitesNone required; 10 years in IT including 5 in hands-on security recommended
ValidityThree years; renew with 75 CEUs and a $150 fee

What the four domains test

Security Engineering carries the most weight in CAS-005:

  • Governance, Risk, and Compliance: 20%
  • Security Architecture: 27%
  • Security Engineering: 31%
  • Security Operations: 22%

Of its 23 objectives, 17 begin "Given a scenario" and three more begin "Given a set of requirements". Only compliance (1.3), artificial intelligence (1.5) and advanced cryptography (3.7) ask you simply to explain or summarize. CompTIA says CAS-005 has fewer, more targeted objectives than CAS-004.

It's also the widest domain, with eight objectives. It asks you to troubleshoot identity systems (SAML, OAuth, Kerberos, 802.1X) and network security faults such as DNSSEC, DKIM and DMARC errors. It also covers hardware roots of trust (TPM, HSM, virtual TPM, measured boot), securing operational technology and legacy systems, and automation with Python, PowerShell and Bash alongside SCAP, OVAL and XCCDF. The cryptography objective goes past what a working engineer usually touches: post-quantum cryptography, homomorphic encryption, authenticated encryption with associated data and envelope encryption.

Architecture covers resilient design, security in the development life cycle (SAST, DAST, IAST, software bills of materials), cloud and Zero Trust. Governance stays practical as well. Threat modeling with STRIDE, MITRE ATT&CK and CAPEC sits there, next to compliance regimes from PCI DSS and SOC 2 to GDPR and Brazil's LGPD. Objective 1.5 lists all ten entries of OWASP's 2023–24 Top 10 for LLM Applications, from prompt injection to model theft, under threats to and risks of AI adoption.

Because the result is pass or fail, you won't learn how close you came. Plan for that by testing only once your practice results are consistently strong across all four domains.

A gap-based study plan

At this level, studying mostly means finding the objectives your job never touched. Go through the CAS-005 objectives PDF and score each of the 23 objectives from one to three for how often you do that work. We'd expect the gaps to cluster in hardware security (3.4), specialized and legacy systems (3.5), advanced cryptography (3.7) and AI (1.5).

CompTIA publishes no hour estimate. For someone with the recommended experience, we'd budget 8 to 12 weeks at six to eight hours a week, with half the time going to the objectives you scored lowest. Make the hands-on work concrete:

  • Write a cloud identity policy and a trust policy that are deliberately too broad, then tighten them, and deploy the same environment twice with Terraform or Ansible, both of which objective 2.5 names.
  • Set up single sign-on with SAML or OpenID in a test identity provider, then break it and troubleshoot it as objective 3.1 expects.
  • Publish SPF, DKIM and DMARC records for a test domain and read the reports.
  • Write a short Python or PowerShell script that pulls vulnerability scan results and opens a ticket, in the spirit of objective 3.6.
  • Build a STRIDE threat model for one system you know well, with an attack tree and data flows.

CompTIA's SecurityX products are the main dedicated material: CertMaster Perform ($984), CertMaster Labs ($264), CertMaster Practice ($284) and the CertMaster Study guide ($199). For the governance and AI objectives, read the primary documents the outline names (NIST CSF, MITRE ATT&CK, CAPEC and the OWASP LLM list) rather than summaries of them.

Renewal, and what sits beside SecurityX

SecurityX is valid for three years. Renewing through continuing education takes 75 continuing education units (CEUs) and a $150 fee per three-year cycle, paid only when you upload CEUs. CompTIA also accepts a single qualifying activity, such as passing the newest SecurityX exam or earning a comparable non-CompTIA certification. SecurityX is at the top of CompTIA's hierarchy, so keeping it current renews CySA+, PenTest+, Security+, Network+ and A+ for that one fee.

Two credentials to weigh against it:

  • CISSP, which needs five years in two of its eight domains. SecurityX is on ISC2's list of credentials that can waive one of those years.
  • CISM, which ISACA organizes around governance, risk management, the security program and incident management, the management half of the work.

Our view

SecurityX is unusual among senior certifications because it tests doing more than describing. Twenty of its 23 objectives are scenario or requirements based. What it doesn't check is experience. The ten-year experience figure is a recommendation, not a requirement, so the certificate shows you passed an exam, while CISSP also requires five years of experience. At $544 we think it's worth it for senior engineers in DoD-mapped architect roles, or for anyone holding several CompTIA certifications who wants one renewal to cover them all. If your next job is managing a security program, take CISSP or CISM instead.

Sources