CompTIA SecurityX (CAS-005): CertMaster Study and the Complete Preparation Guide

CompTIA SecurityX is the expert-level cybersecurity certification for people who design and run enterprise security, not just operate it. It is the certification formerly known as CASP+, rebranded in December 2024 and carried by the exam code CAS-005. If you are a security architect or senior engineer weighing where to put your next block of study time, this page covers what the certification is, what the exam actually tests, every official preparation product and how they differ, how SecurityX stacks up against CISSP, CISM, and CISA, and the roles it opens.

This store exists for one certification. Everything here, from the official study guide to the exam voucher, is built around helping you pass CAS-005 and get back to work.

What CompTIA SecurityX (CAS-005) is

SecurityX is the top security credential in CompTIA's Xpert Series, the expert tier that also includes DataX and CloudNetX. It replaced CASP+ when CompTIA retired the CAS-004 exam on June 17, 2025. If you already held CASP+, nothing changed for you: existing holders received the SecurityX badge automatically, with no retesting and no interruption to their continuing education cycle.

The certification is vendor-neutral and hands-on. Where an entry credential like Security+ proves you understand security fundamentals, and CySA+ proves you can analyze threats, SecurityX proves you can architect, engineer, and lead an organization's entire security posture across cloud, on-premises, and hybrid environments. It is accredited to ISO 17024 and ANSI standards and is approved by the U.S. Department of Defense to meet directive 8140/8570.01-M requirements, which is why it appears in DoD and government contracting role requirements.

A few practical facts about the exam:

• Up to 90 questions, a mix of multiple-choice and performance-based questions that put you inside realistic scenarios rather than asking for definitions.
• 165 minutes.
• Pass or fail, with no scaled score published.
• Delivered through Pearson VUE, including online proctoring.
• CompTIA recommends roughly 10 years of general IT experience with at least 5 years of hands-on security experience, and suggests Security+, CySA+, and PenTest+ as a lead-in. Note the word recommended: unlike the certifications it competes with, SecurityX has no formal work-experience requirement you must document before you can be certified. You earn it by passing the exam.

The four exam domains

CAS-005 is organized into four weighted domains. The weightings tell you where your study hours should go.

• Governance, Risk, and Compliance — 20 percent. Managing organizational risk, regulatory compliance, and threat modeling as a continuous practice.
• Security Architecture — 27 percent. Designing secure infrastructure across cloud and hybrid environments, data security, and resilience.
• Security Engineering — 31 percent. The largest domain. Building and hardening controls, cryptography, and secure implementation.
• Security Operations — 22 percent. Automation, monitoring, detection, and incident response at enterprise scale.

The CAS-005 refresh modernized the content heavily compared with the old CASP+ exam. The objective count was consolidated from 28 to 23, and several topics that barely existed a few years ago are now central: AI threat modeling, post-quantum cryptography, zero trust and SASE as core architecture rather than passing mentions, and compliance-as-code built into DevOps pipelines. Cloud-native and hybrid environments are now the default assumption, not the exception. If a study resource still says CASP+ and references CAS-004 objectives, it is out of date. Check that anything you buy is aligned to CAS-005.

Start with CertMaster Study

The natural starting point is the official study guide. CompTIA SecurityX CertMaster Study is CompTIA's own content, written to cover every CAS-005 objective, with review questions to check yourself lesson by lesson. It reads like a well-structured textbook and works as the backbone of a study plan: you move through the objectives in order, confirm each one, and know exactly what you have and have not covered.

For a certification this broad, that structure matters. The experienced practitioners SecurityX is aimed at rarely have gaps everywhere; they have a handful of specific gaps hidden inside years of habit. A complete, objective-mapped guide is the fastest way to find them.

The complete SecurityX preparation lineup

Different people prepare in different ways, and CompTIA's products are built to be mixed. Here is what each one does and when it earns its place.

• CertMaster Study — the official study guide. Full objective coverage in a readable, textbook-style format with review questions. The backbone for self-directed study.
• CertMaster Learn — the official self-paced eLearning platform. Instructional content, videos, and performance-based questions built around a proven learning progression. Choose this when you want a guided course rather than a book.
• CertMaster Labs — hands-on practice on live virtual machines through the browser. This is where you prepare for the performance-based questions, by doing the work rather than reading about it.
• CertMaster Practice — an adaptive assessment tool for the final stretch. It confirms your strong areas, surfaces weak ones, and closes gaps quickly before test day.
• CertMaster Perform — CompTIA's flagship all-in-one course. It combines the content of Learn and Labs, simulated and live, in a single product. Choose this when you want theory and hands-on work under one access key instead of buying them separately.
• SecurityX Exam Voucher — the official CompTIA voucher that pays for one CAS-005 exam attempt, redeemed through Pearson VUE.
• SecurityX Exam Voucher with Retake — the same official voucher bundled with a second attempt. If you do not pass the first time, you can sit the exam once more on the same voucher before it expires. Worth it for anyone who wants a safety net on an expert-level exam.

If you want a simple recommendation: pair CertMaster Study or CertMaster Learn for the knowledge, CertMaster Labs for the hands-on skills, and CertMaster Practice to confirm readiness, then book the exam with a voucher that includes a retake. CertMaster Perform folds the first two together if you prefer a single course.

SecurityX compared with CISSP, CISM, and CISA

These four are often mentioned in the same breath, but they certify different jobs. Choosing well is mostly a question of which job is yours.

SecurityX is a technical, hands-on credential for the people who design and build security. CISSP sits at the intersection of management and technical breadth. CISM is a management and governance credential. CISA is for auditors. The single biggest practical difference is the experience gate: CISSP, CISM, and CISA all require you to document and have verified several years of relevant work experience before you can hold the certification. SecurityX only recommends experience; you become certified by passing the exam.

None of this makes one certification better than another in the abstract. CISSP carries the widest name recognition in HR filters and is often the credential a hiring manager lists by reflex for senior roles. CISM and CISA are the standard on the governance and audit tracks respectively, and ISACA's brand is strong in those worlds. What SecurityX offers that the others do not is a technical, build-and-operate validation with no experience gate to entry and a lower cost to sit, aligned to how enterprises actually run security today. Many practitioners hold SecurityX alongside CISSP rather than instead of it: SecurityX proves the hands-on capability, CISSP satisfies the résumé filter.

Benefits and career opportunities

SecurityX maps to a specific band of roles: security architect, senior or principal security engineer, security operations lead, and the technical-lead positions that blend architecture decisions with operational responsibility. Its four-domain structure mirrors that job, one that expects you to move between a governance decision, an architecture tradeoff, an engineering control, and an incident response in a single afternoon.

Two benefits stand out. First, the DoD 8140/8570.01-M approval makes SecurityX directly relevant to U.S. defense and government contracting roles, where an approved certification is often a hard requirement rather than a nice-to-have. Second, because the credential is technical and vendor-neutral, it signals capability across whatever stack an employer runs, rather than proficiency with one vendor's products. For senior practitioners, that combination, technical depth plus recognized accreditation, is what moves a candidate from qualified to hired.

The certification also future-proofs your knowledge in the areas hiring is moving toward. The CAS-005 content on AI security, post-quantum cryptography, and zero-trust architecture is exactly the ground where senior security roles are being redefined right now.

How to prepare

A realistic path for an experienced professional looks like this. Confirm you have the background SecurityX assumes, ideally Security+ and CySA+ or PenTest+, or equivalent time in the field. Work through CertMaster Study or CertMaster Learn against the official CAS-005 objectives, giving the Security Engineering and Security Architecture domains the most time since together they are well over half the exam. Build hands-on fluency with CertMaster Labs, because the performance-based questions reward doing, not memorizing. Use CertMaster Practice in the last few weeks to find and close your remaining gaps. Then book the exam with a voucher that includes a retake, so a single hard day does not cost you a second purchase.

Everything you need for that plan is on this site, aligned to CAS-005 and nothing else. Start with CertMaster Study, and add the pieces that match how you work.