CompTIA SecurityX CAS-005 (V5) Exam Objectives
This page translates the CompTIA SecurityX CAS-005 (V5) exam objectives into clear, practical language. You’ll see what each domain covers, realistic task themes, and a focused study plan that turns objectives into repeatable labs, PBQs, and executive-level security skills. Test at a glance: maximum 90 questions, 165 minutes, multiple-choice + performance-based, pass/fail only, recommended 10+ years IT with 5+ in security.
Last updated: November 9, 2025. Always verify against the official CompTIA blueprint before your exam.
TL;DR: SecurityX validates advanced capability to architect, engineer, secure, and operate complex, hybrid enterprises—covering Governance/Risk/Compliance (20%), Security Architecture (27%), Security Engineering (31%), and Security Operations (22%).
Table of Contents
- What Is Covered on CompTIA SecurityX CAS-005 (V5)?
- Objective-By-Objective Breakdown (with examples)
- Why SecurityX for Senior Security Roles?
- Study Plan: How to Master the CAS-005 Objectives
- Free Checklist & Next Steps
- Frequently Asked Questions
What Is Covered on CompTIA SecurityX CAS-005 (V5)?
SecurityX (formerly CASP+) certifies that you can design and implement secure solutions, leverage automation/monitoring/IR, secure cloud + on-prem + hybrid, apply cryptography appropriately, and use governance/risk/threat-modeling throughout the enterprise. Expect scenario-heavy items and PBQs aligned to real environments.
Note
The wording below is learner-friendly. Map your prep directly to the official CAS-005 objectives before test day.
Objective-By-Objective Breakdown (with examples)
1) Governance, Risk, and Compliance (20%)
Implement governance components and run risk/compliance programs that enable—not block—delivery.
- Security program: policies, standards, procedures, guidelines; awareness & training (phishing, privacy, OPSEC), RACI, reporting.
- Frameworks & change: COBIT, ITIL; CMDB, asset lifecycle, inventory; GRC tooling (mapping, automation, compliance tracking, documentation, continuous monitoring).
- Risk management: qualitative/quantitative analysis, appetite & prioritization, third-party/supply-chain, BCDR availability, confidentiality/integrity/privacy risks, crisis & breach response.
- Compliance: industry regs (healthcare, financial, government, utilities), PCI DSS, ISO/IEC 27000-series, SOC 2, NIST CSF, CIS, CSA; GDPR/CCPA/LGPD/COPPA; audits vs. assessments vs. certifications; cross-jurisdiction items (e-discovery, legal holds, export controls).
- Threat modeling: actors/motivation/resources/capabilities; MITRE ATT&CK, CAPEC, Kill Chain, Diamond, STRIDE, OWASP; attack surface (architecture, data flows, trust boundaries, code reviews, org change, cloud discovery, third-party links).
- AI risk (new): legal/privacy implications, explainability, policy & ethics; threats like prompt injection, insecure output handling, poisoning, model DoS, supply-chain/model theft/inversion; AI-enabled attacks (deepfakes, pipeline injection, social engineering, automated exploit gen); risks (overreliance, sensitive data disclosure, excessive agency), and AI assistants guardrails/DLP/permissions/disclosure.
2) Security Architecture (27%)
Analyze requirements to design resilient systems and secure architectures for modern stacks.
- Component placement & config: firewalls, IPS/IDS, VPN, NAC, WAF, forward/reverse proxies, API gateways, taps/collectors, CDN; availability & integrity design (LB, recoverability, interoperability, geo, vertical vs. horizontal scaling, persistence patterns).
- Early/through-lifecycle security: requirements (functional vs. non-functional; security vs. usability), software assurance (SAST/DAST/IAST/RASP, vuln analysis, SCA/SBOM, formal methods), CI/CD (coding standards, branch protection, canary/regression/integration/unit/automated tests), supply-chain risk (software/hardware), hardware assurance and EOL.
- Control design & attack-surface reduction: hardening, defense-in-depth, legacy isolation, centralized logging/continuous monitoring/alerting/sensor placement, data classification/labeling/tagging, DLP (at rest/in transit/data discovery), hybrid infra and third-party integrations, and measuring control effectiveness.
- Access/auth/authz systems: provisioning/deprovisioning (including self-service), federation & SSO, conditional access, IdPs/SPs, attestations, PDP/PEP, access control models (RBAC, rule-based, ABAC, MAC, DAC), logging & auditing, PKI (extensions, OCSP stapling, CA/RA, templates, deployment).
- Cloud security: CASB types (API/proxy), shadow-IT detection, shared responsibility, Terraform/Ansible & pipeline security, container and serverless security, API security (auth, logging, rate-limits), cloud vs. customer-managed keys/licenses, cloud data security (exposure/leakage/remanence/insecure storage), cloud control strategies, connectivity & service integration.
- Zero Trust integration: continuous authorization, context-based re-auth, segmentation/microsegmentation, always-on VPN, API validation, asset identification/attestation, data perimeters/secure zones, SASE/SD-WAN/SDN, and subject-object relationships.
3) Security Engineering (31%)
Implement the designed controls, automate safely, and secure specialized systems.
- IAM troubleshooting & enhancement: biometrics; secrets mgmt (tokens/certs/passwords/keys, rotation/deletion); conditional access (user-device binding, geo/time), attestation; cloud IAM trust policies; logging/monitoring; PIM/PAM; authentication (SAML, OpenID, SSO, MFA, Kerberos, EAP, OAuth, SAE, identity proofing, 802.1X, federation).
- Endpoint/server security: application control, EDR, logging/monitoring, endpoint privilege mgmt, attack-surface reduction, HIPS/HIDS, anti-malware, SELinux, host firewalls, browser isolation, config mgmt, MDM, and common TTPs (injection, privesc, credential dumping, lateral movement, evasion).
- Network infrastructure issues: drift, routing/switching errors, insecure routing, VPN/tunnel errors; IPS/IDS misconfigs/false-pos/false-neg/placement; DNS security (DNSSEC, poisoning, sinkholes, zone transfers); email security (SPF/DKIM/DMARC/S/MIME); TLS/cipher/PKI problems; crypto implementations; DoS/DDoS; resource exhaustion; ACL issues.
- Hardware security: roots of trust (TPM/HSM/vTPM), CPU security extensions/secure enclave, host encryption/SED, Secure/Measured Boot, self-healing/tamper detection; threats (firmware tampering, shimming, USB attacks, BIOS/UEFI, memory, EMI/EMP).
- Specialized & legacy systems: OT/SCADA/ICS/HVAC, IoT/embedded/SoC, RF/wireless; privacy/safety/regulatory considerations; sector nuances (utilities, transport, healthcare, manufacturing, finance, gov/defense); constraints (unsupported/obsolete/highly constrained).
- Automation to secure the enterprise: scripting (PowerShell/Bash/Python), cron/scheduled tasks, event triggers, IaC, config files (YAML/XML/JSON/TOML), cloud APIs/SDKs & webhooks, containerization, automated patching, auto-containment, SOAR (runbooks/playbooks), vuln scanning & reporting, SCAP (OVAL/XCCDF/CPE/CVE/CVSS), workflow automation.
- Advanced crypto concepts & use cases: PQC awareness; key stretching/splitting; homomorphic encryption; forward secrecy; hardware acceleration; envelope encryption; secure MPC; AEAD; mutual auth; tunnels, data at rest/in transit/in use; non-repudiation; software provenance & code integrity; centralized vs. decentralized key mgmt.
4) Security Operations (22%)
Operate, monitor, hunt, and respond—measuring what matters.
- Monitoring & analytics: SIEM parsing/duplication, non-reporting devices, retention, false-pos/neg reduction; correlation & audit-log reduction, prioritization, trend analysis; baselining (network/systems/users/apps).
- Diverse sources: third-party intel, vuln scans, CVEs/bounties, DLP, endpoint/infrastructure/app logs, CSPM data; alerting prioritization (criticality, impact, asset type, residual risk, data classification, malware/vulns). Reporting that drives action.
- Vulnerabilities & attacks: injection/XSS/CSRF/SSRF, unsafe memory, race conditions, directory misconfig, overflows, deprecated functions, third-party risks, TOCTOU, deserialization, weak ciphers, confused deputy, implants; mitigations (input validation, output encoding, safe/atomic/memory-safe/thread-safe functions, patching OS/firmware/hypervisor, least privilege/functionality, defense-in-depth, dependency mgmt, code signing, encryption, allow-listing).
- Threat hunting & intel: internal sources (emulation, reconnaissance, hypothesis-based searches, honeypots/honeynets, UBA), external OSINT/dark web/ISACs; reliability factors; TIPs/vendors; STIX/TAXII; rule languages (Sigma, YARA, Snort, Rita); indicators of attack (TTPs).
- Incident response & forensics: detonation/IoC extraction, sandboxing, code stylometry/variant matching/similarity; reverse engineering (disassembly/decompilation); volatile/non-volatile storage, network/host analysis, metadata, JTAG; data recovery/extraction; threat response, exercises, timeline reconstruction, root cause, CWPP, insider threat.
Why SecurityX for Senior Security Roles?
SecurityX proves you can design the blueprint, implement the controls, and run the operation—across cloud, on-prem, and hybrid—with governance and measurable outcomes. It aligns with lead security architect/engineer, senior blue-team/IR lead, and principal security roles.
Study Plan: How to Master the CAS-005 Objectives
- Map every domain to a lab
Design a segmented, Zero-Trust-aligned reference architecture (IDP, PDP/PEP, WAF, API gateway, EDR, SIEM). Implement minimal controls end-to-end and document trust boundaries. - Build secure-SDLC pipelines
Add SAST/DAST/SCA to CI/CD, enforce branch protection, and run canary/regression gates. Capture evidence (reports, SBOMs) and a rollback plan. - Engineer & automate
Script least-privilege IAM changes, rotate secrets, deploy hardened images with IaC, and wire SOAR playbooks for triage/containment. Track CVEs and control effectiveness metrics. - Hunt and respond
Create two hypothesis-driven hunts (e.g., suspicious OAuth tokens, DNS tunneling). Document queries, true/false-positive patterns, and resulting detections. Practice an IR cycle with forensics artifacts. - Govern continuously Run a mini-GRC cadence: risk register updates, third-party assessment, BCDR test with RTO/RPO, and an AI-risk review (prompt-injection tabletop + data-handling policy).
