What is on the CompTIA SecurityX (CAS-005) Exam

The CompTIA SecurityX exam covers four domains in 165 minutes with up to 90 questions. Performance-based questions show up early and weigh more than multiple choice. Plan for that.

The four domains and their weights

CompTIA publishes approximate weights for the CAS-005 exam blueprint. The numbers below match the public objectives document as of 2026:

• Governance, Risk and Compliance · roughly 20 percent. Risk methodologies, regulatory frameworks, threat modeling, GRC tooling.
• Security Architecture · roughly 27 percent. Zero-trust, identity federation, cryptographic primitives, AI-aware design.
• Security Engineering · roughly 31 percent. The heaviest domain. IAM, endpoint hardening, PKI, container and serverless security, automation pipelines.
• Security Operations · roughly 22 percent. Detection engineering, threat hunting, incident response, forensics.

What the blueprint does not tell you

Two patterns show up in CAS-005 that are easy to miss if you only study from the objectives document.

First, the exam tests integration, not isolated knowledge. A typical performance-based question puts you inside a scenario that crosses three domains. Architecture students who only know architecture fail this style of question. The bootcamp curriculum is sequenced specifically to prevent that gap.

Second, the exam includes emerging content that the published blueprint hints at but does not fully detail. AI-aware design, supply-chain incident scenarios, and adversarial machine learning all appear in current question pools. CompTIA is updating these areas more frequently than the older CASP+ exam saw.

How to prioritize study time

If you have limited prep time, weight your study by domain. Spend roughly a third of your time on Security Engineering, a quarter on Security Architecture, and the remainder split between Governance and Operations. The exam rewards depth in the high-weight domains more than balance across all four.

Practice with hands-on labs, not flashcards. The CAS-005 performance-based questions test whether you can do the work, not whether you can recall a definition. Set up a home lab, run real tools, write real configs.