- A SecurityX is an expert-level credential earned by passing CompTIA's CAS-005 exam.
- The exam has up to 90 questions, a 165-minute limit, and pass/fail scoring only.
- Security Engineering (31%) is the largest of four domains on the current CAS-005 objectives.
- CompTIA recommends 10 years of IT experience, including 5 years in hands-on security.
What Is A SecurityX, Exactly?
When people ask "what is a SecurityX," they're really asking about a person or a credential: someone who has passed CompTIA's CAS-005 exam and holds the expert-level cybersecurity certification formerly known as CASP+. A SecurityX is administered by the Computing Technology Industry Association through Pearson VUE testing centers or online proctoring, and it's designed to validate the kind of judgment that only comes from years of hands-on security work - not entry-level checklist knowledge.
Unlike associate or intermediate certifications that test whether you know a concept exists, SecurityX tests whether you can apply that concept correctly inside a real enterprise environment, often under conflicting constraints like budget, legacy systems, and business risk tolerance. If you want the full definitional breakdown, our companion pieces on What Is SecurityX? and SecurityX Meaning cover the naming history and how it replaced CASP+ in CompTIA's lineup. For a shorter answer to a related question, see What Does SecurityX Stand For?
How the CAS-005 Exam Works
The exam itself is a mix of traditional multiple-choice items and performance-based questions (PBQs), where you're dropped into a simulated scenario - analyzing a network diagram, reviewing logs, or configuring a control - and asked to make a decision rather than pick a definition. There is a maximum of 90 questions total, and you have 165 minutes to complete them, which averages out to roughly 1.8 minutes per question, though PBQs typically eat far more time than the multiple-choice items.
Scoring is pass/fail. There's no scaled score reported to candidates, which is a meaningful departure from some other CompTIA exams - you either demonstrate the required competency or you don't, and CompTIA does not publish a numeric cut score for CAS-005. This format shift affects how people prepare: many candidates find it more useful to think in terms of "can I reason through this scenario" rather than "can I hit a target percentage." If you're weighing how tough that bar actually is, our guide on How Hard Is the SecurityX Exam? Complete Difficulty Guide 2026 goes deeper into the difficulty factors.
| Exam Detail | Specification |
|---|---|
| Exam Code | CAS-005 |
| Delivery | Pearson VUE testing center or online proctored |
| Question Count | Maximum 90 (multiple-choice and performance-based) |
| Time Limit | 165 minutes |
| Scoring Model | Pass/Fail (no scaled score) |
| Objectives Version | Version 3.0 |
| Certification Validity | 3 years |
Because exam mechanics and fee structures change periodically, check the current cost details in SecurityX Certification Cost 2026: Complete Pricing Breakdown before you register, and confirm domain weightings against the latest objectives in SecurityX Exam Domains 2026: Complete Guide to All 4 Content Areas.
The Four Domains That Define the Exam
The current CAS-005 objectives (Version 3.0) organize content into four domains, each carrying a different weight on the exam. Understanding these weights isn't just trivia - it should directly shape how you allocate study time.
Domain 1: Governance, Risk, and Compliance (20%)
Covers enterprise risk management, regulatory and legal considerations, governance frameworks, and how security decisions map to business risk appetite.
- Risk assessment methodologies and third-party risk
- Compliance frameworks and legal/regulatory obligations
- Business continuity and organizational governance structures
Domain 2: Security Architecture (27%)
Focuses on designing resilient, secure infrastructure - cloud, hybrid, on-premises - and translating business requirements into architectural decisions.
- Secure network and infrastructure design principles
- Cloud and hybrid architecture trade-offs
- Data security architecture and secure data lifecycle
Domain 3: Security Engineering (31%)
The largest domain on the exam, covering hands-on implementation: configuring controls, hardening systems, and integrating security into engineering practices.
- Identity and access management implementation
- Cryptographic solutions and PKI
- Secure software development and automation/orchestration
Domain 4: Security Operations (22%)
Addresses day-to-day defensive operations - detection, incident response, threat hunting, and vulnerability management at an enterprise scale.
- Threat intelligence and proactive hunting
- Incident response and digital forensics processes
- Vulnerability management and remediation prioritization
Because Security Engineering carries the heaviest weight, candidates who under-prepare there tend to struggle most. For domain-by-domain study material, our dedicated guides break each one down in detail: Domain 1: Governance, Risk, and Compliance, Domain 2: Security Architecture, Domain 3: Security Engineering, and Domain 4: Security Operations.
Key Takeaway
Since Security Engineering is worth 31% of the exam, it deserves the largest single block of your study calendar - more than governance or operations combined with architecture, proportionally.
Who Actually Earns a SecurityX and Why
Because the exam sits at the expert level, the people pursuing it are rarely newcomers to IT. Typical candidates include security architects, senior security engineers, SOC leads moving into architecture roles, and IT professionals aiming for governance or risk management positions. Employers in government contracting, financial services, healthcare, and large enterprise IT departments frequently list this certification - often interchangeably referenced under its former CASP+ name - as a requirement or strong preference for senior security roles.
If you're evaluating whether pursuing it makes sense for your career stage, two resources are worth reading together: SecurityX Jobs for the kinds of roles that reference this credential, and SecurityX Salary Guide 2026: Complete Earnings Analysis for how compensation trends for certified professionals. For a broader cost-benefit view, Is the SecurityX Certification Worth It? Complete ROI Analysis 2026 weighs the investment against career outcomes.
Experience Expectations Before You Sit For It
CompTIA doesn't enforce a hard prerequisite gate for CAS-005 the way some vendor certifications do, but it does publish a strong recommendation: at least 10 years of hands-on IT experience, with at least 5 years of that being broad, hands-on IT security experience specifically. This isn't a formality - the exam's performance-based questions are built around scenarios that assume you've actually configured the systems being described, not just read about them.
Practically, this means candidates coming in with only theoretical knowledge, even if well-studied, often find the PBQs disorienting on first attempt. The scenario framing rewards pattern recognition built from real incidents, real architecture reviews, and real compliance audits - things that are difficult to simulate purely through reading. For an honest look at how experience level affects outcomes, see SecurityX Pass Rate 2026: What the Data Shows.
Key Takeaway
The 10-years/5-years experience recommendation is a signal, not a bureaucratic hurdle - candidates below that threshold should expect the performance-based questions to feel unfamiliar regardless of how much they've studied.
Keeping It Valid: Renewal and CEUs
A SecurityX certification is valid for three years from the date you pass CAS-005. To keep it active beyond that window, you renew through CompTIA's Continuing Education (CE) program, which requires accumulating 75 CEUs during the three-year cycle. CEUs can typically be earned through a mix of qualifying training, higher-level certifications, teaching, or other approved professional activities recognized by CompTIA's CE program.
This renewal structure matters when you're planning your broader certification roadmap - some professionals stack CAS-005 with other credentials specifically because the activities that satisfy one certification's CE requirement often overlap with another's. Plan your renewal activities early in the three-year cycle rather than scrambling near expiration.
Mapping a Study Plan to the Domain Weights
Rather than studying domains in the order they appear in the objectives, it makes sense to sequence preparation around exam weight and dependency. Governance concepts (Domain 1) tend to be foundational vocabulary for the other three domains, so many candidates start there before moving into the heavier, more technical material in Architecture and Engineering.
Governance, Risk, and Compliance (20%)
- Build vocabulary around risk frameworks and regulatory obligations that recur across other domains
Security Architecture (27%)
- Work through cloud, hybrid, and on-prem design scenarios; practice translating requirements into architecture decisions
Security Engineering (31%)
- Allocate the longest block here since it's the largest domain; focus on IAM, cryptography, and secure development practices
Security Operations (22%)
- Practice incident response and threat-hunting scenarios using performance-based question formats
Full Review and Timed Practice
- Run full-length timed sessions to build comfort with the 165-minute limit and PBQ pacing
This is only a starting framework - the exact pacing depends heavily on your existing experience in each domain. For a fuller walkthrough of study resources, practice question strategy, and common pitfalls, see our SecurityX Study Guide 2026: How to Pass on Your First Attempt. And once you're ready to test your readiness under realistic conditions, our practice test platform mirrors the CAS-005 question format so you can gauge domain-by-domain strengths before exam day.
Frequently Asked Questions
Yes - SecurityX is the current name for the certification earned by passing the CAS-005 exam, which succeeded the earlier CASP+ branding while keeping the same expert-level positioning within CompTIA's certification lineup.
The exam has a maximum of 90 questions, combining traditional multiple-choice items with performance-based questions, delivered within a 165-minute time limit.
No. CAS-005 uses pass/fail scoring with no scaled score reported, so your result is a straightforward pass or fail rather than a numeric percentage.
Security Engineering, at 31% of the exam, is the largest domain under the current Version 3.0 objectives and typically warrants the most study time, followed by Security Architecture at 27%.
It's valid for three years. Renewal happens through CompTIA Continuing Education by earning 75 CEUs during that period through qualifying training, higher-level certifications, or other approved activities.
For a deeper dive into related terminology and how this certification fits into broader career planning, explore What Does SecurityX Mean?, What Is SecurityX Certification?, and SecurityX Training for structured learning options, or start practicing directly on our SecurityX practice test platform.