CASP+ is now CompTIA SecurityX, and the current exam is CAS-005, so CASP+ practice questions should match the CAS-005 objectives. The exam allows up to 90 questions in 165 minutes, mixes multiple-choice and performance-based questions, and is graded pass or fail. This guide gives you original practice-style questions with explanations, the exam format and a study plan.
Key takeaways
- CompTIA renamed CASP+ to SecurityX when it released exam CAS-005 on December 17, 2024. The older CAS-004 was retired on June 17, 2025.
- CAS-005 has up to 90 questions, 165 minutes, multiple-choice plus performance-based questions, and no scaled score.
- The exam is built around four domains, including Governance, Risk and Compliance (20%) and Security Operations (22%).
- Use practice material written for CAS-005, not CAS-004, and build hands-on skills for the performance-based questions.
- The questions below are original practice items written for learning, not real exam questions.
Is CASP+ still available?
The certification is still available, but under the name CompTIA SecurityX. CompTIA rebranded CASP+ with the CAS-005 exam, and existing CASP+ holders keep their status. If you are studying with older CASP+ (CAS-004) books or tests, check that they still match the current objectives. Always confirm the latest exam details, objectives and fees on the official CompTIA page before you book.
What is the CASP+ and SecurityX exam format?
The SecurityX CAS-005 exam has up to 90 questions, a 165-minute time limit and a pass or fail result. Questions combine multiple-choice and performance-based items, such as drag-and-drop tasks and simulations. Because the questions are scenario-heavy, you need to apply concepts, not just recall definitions.
| Item | CAS-005 (SecurityX) |
|---|---|
| Previous name | CASP+ (CAS-004) |
| Launch date | December 17, 2024 |
| Questions | Up to 90 |
| Time limit | 165 minutes |
| Question types | Multiple-choice and performance-based |
| Scoring | Pass or fail, no scaled score |
| Level | Advanced, with several years of hands-on security experience assumed |
What topics does the exam cover?
The exam covers four domains: governance, risk and compliance, security architecture, security engineering and security operations. Governance, Risk and Compliance is about 20% of the exam and Security Operations about 22%, according to published exam breakdowns. Expect topics such as risk management, zero trust, cloud and hybrid architecture, public key infrastructure, identity and access management, incident response, threat modeling, automation and emerging areas such as AI risk and post-quantum cryptography.
What is a good CASP+ study plan?
A good study plan moves from the objectives to hands-on practice and then timed testing. The flow below works for most candidates.
- Read the official objectives. Download the CAS-005 objectives from CompTIA and tick off what you already know.
- Study by domain. Give more time to heavier and weaker domains.
- Build hands-on skills. Practice in a lab with a firewall, a SIEM, PKI tools and a cloud account, because performance-based questions test real tasks.
- Take timed practice tests. Use 165-minute sessions to practice pacing, and flag hard questions for later.
- Review your gaps. Read the explanation for every miss, then rebuild the topic in a lab.
What do CASP+ practice questions look like?
The questions below are original, scenario-style practice items written to match the SecurityX style. Try each one before you read the answer.
Question 1 (Governance, Risk and Compliance). A company buys a cyber insurance policy to cover the financial impact of a data breach. Which risk response is this?
A. Avoid. B. Mitigate. C. Transfer. D. Accept.
Answer: C. Insurance shifts the financial impact to another party, which is risk transfer. The risk still exists, but the cost moves.
Question 2 (Security Architecture). An organization adopts a zero trust model. Which design choice best limits lateral movement after one workstation is compromised?
A. A single flat network with a strong perimeter firewall. B. Micro-segmentation with per-request authentication and authorization. C. A longer password policy. D. A larger VPN pool.
Answer: B. Zero trust assumes breach and verifies each request. Micro-segmentation and continuous verification keep an attacker from moving freely between systems.
Question 3 (Security Engineering). A web server must prove its certificate has not been revoked without every client contacting the certificate authority. What should the administrator configure?
A. CRL distribution through email. B. OCSP stapling. C. A longer certificate lifetime. D. A wildcard certificate.
Answer: B. With OCSP stapling, the server fetches a signed revocation response from the CA and sends it during the TLS handshake, so clients do not need to query the CA themselves.
Question 4 (Security Operations). A SIEM generates hundreds of low-value alerts every day from a noisy rule, and analysts miss real incidents. What is the best first action?
A. Disable the SIEM. B. Tune the correlation rule and add context such as asset criticality. C. Add more analysts. D. Delete old logs.
Answer: B. Tuning rules and adding context reduces false positives while keeping detection. Disabling tools or deleting logs removes visibility and evidence.
Question 5 (Cloud Security). A company runs virtual machines on an IaaS platform. Under the shared responsibility model, who patches the guest operating system?
A. The cloud provider. B. The customer. C. The hardware vendor. D. The internet provider.
Answer: B. In IaaS the provider secures the underlying infrastructure, while the customer manages the guest operating system, applications and data.
Question 6 (Cryptography). An organization stores records that must stay confidential for 25 years. Which threat most strongly supports planning a move to post-quantum cryptography now?
A. Denial of service. B. Harvest now, decrypt later attacks. C. Cross-site scripting. D. Port scanning.
Answer: B. Attackers can collect encrypted data today and decrypt it later when quantum computers make current algorithms weak. Long-lived data needs a migration plan.
Question 7 (Incident Response). Analysts confirm ransomware is encrypting files on a file server. What should they do first?
A. Wipe and rebuild the server. B. Isolate the server from the network. C. Pay the ransom. D. Notify customers by press release.
Answer: B. Containment comes first to stop the spread. Eradication, recovery and communication follow, and evidence should be preserved.
Question 8 (Supply Chain). A critical library used by many applications has a new vulnerability. Which artifact helps the team find affected applications fastest?
A. A software bill of materials (SBOM). B. A network diagram. C. A password policy. D. A backup schedule.
Answer: A. An SBOM lists the components inside each application, so you can search for the vulnerable library. See our SBOM template.
How should you use practice questions?
Use practice questions to find gaps, not to memorize answers. For each question, explain why the right answer is right and why the others are wrong. Take timed sets to build pacing, and avoid unofficial exam dumps, which can violate CompTIA rules, risk your certification and teach wrong answers. Pair question practice with the governance basics in our guides to a virtual CISO, a IT strategy template and a data retention policy, and with threat context from the top cybersecurity threats in 2026. Identity topics also appear often, so review two-factor authentication.
Frequently asked questions
What replaced CASP+?
CompTIA SecurityX replaced CASP+. The current exam is CAS-005, released on December 17, 2024.
How many questions are on the SecurityX exam?
The exam has up to 90 questions, including multiple-choice and performance-based questions, with 165 minutes to finish.
Is CASP+ hard?
It is an advanced exam that assumes several years of hands-on security experience, and its scenario questions require applied thinking. Candidates with lab practice and domain knowledge find it more manageable.
Are CAS-004 practice questions still useful?
Partly. Many topics overlap, but CAS-005 changed domain weights and added newer topics such as AI risk and post-quantum cryptography, so use material aligned to CAS-005.
How long should I study for SecurityX?
It varies with your experience. Many candidates plan several weeks to a few months. Use practice test results, not a fixed number of days, to decide when you are ready.
Conclusion
SecurityX is the new name for CASP+, and the best preparation matches the CAS-005 objectives. Learn the format, practice scenario questions, build hands-on lab skills and review every mistake. Check CompTIA official pages for current fees, objectives and policies before you book.
