Practice for CompTIA SecurityX (formerly CASP+) with 700 CAS-005 questions, each with a full explanation. 40 free CAS-005 practice exam questions.
700 practice questions for CompTIA SecurityX (CAS-005), formerly CASP+, written to CompTIA's current objectives, with an explanation on every question and 40 free to try.This CAS-005 practice exam prepares you for CompTIA SecurityX, the advanced cybersecurity certification CompTIA aims at security architects and senior security engineers, known as CASP+ until CompTIA renamed it with the launch of CAS-005 on December 17, 2024. It is written to version 3.0 of CompTIA's CAS-005 exam objectives, the current version of the exam, and holds 700 questions across all 23 objectives, in exactly the proportions CompTIA publishes for the four domains. CompTIA has published draft objectives for a future version with no launch date; CAS-005 is the version you can book today.
| Domains | ||
| 1.0 Governance, Risk, and Compliance | 20% | 140 |
| 2.0 Security Architecture | 27% | 189 |
| 3.0 Security Engineering | 31% | 217 |
| 4.0 Security Operations | 22% | 154 |
Governance, Risk, and Compliance - 140 questions. The security program and its documents - policies, standards, procedures and guidelines, and knowing which is which - with change management and GRC tooling. Risk management with the reasoning attached: quantitative against qualitative assessment, appetite and tolerance, breach response, and privacy and third-party risk. Compliance through the GDPR, PCI DSS, HIPAA, the NIST Cybersecurity Framework, ISO/IEC 27001 and SOC 2. Threat modeling is the largest group: threat actors, attack surface, attack trees, STRIDE, MITRE ATT&CK and CAPEC. Objective 1.5 closes it with the security of adopting AI: prompt injection, training-data poisoning, deepfakes and excessive agency.
Security Architecture - 189 questions. Where firewalls, IDS and IPS, web application firewalls, proxies, API gateways and NAC belong, and how the design stays available. Security across the life cycle: requirements, CI/CD controls such as branch protection and linting, software assurance testing and the SBOM, and supply-chain and end-of-life risk. Identity architecture, from federation and conditional access to access control models and PKI down to OCSP stapling. Cloud keys, data remanence, a CASB, containers, API security and infrastructure as code with Terraform and Ansible. And Zero Trust: microsegmentation, continuous authorization and context-based reauthentication.
Security Engineering - 217 questions, the largest domain. Troubleshooting identity: conditional access, cloud IAM trust policies, secrets rotation, SAML, OAuth, OpenID Connect, Kerberos and 802.1X. Endpoints: EDR, application allow listing and SELinux hardening. Networks: IDS and IPS tuning, DDoS, configuration drift, DNSSEC, SPF, DKIM and DMARC, and TLS and PKI failures. Hardware: TPMs, HSMs, secure enclaves, Secure Boot and measured boot. SCADA, ICS, IoT and the plant controller that cannot be patched. Automation with SOAR playbooks, SCAP, PowerShell, Bash, Python and cloud APIs. And cryptography: envelope encryption, forward secrecy, homomorphic encryption, post-quantum algorithms, tokenization, code signing and cryptographic erase.
Security Operations - 154 questions. Monitoring and response: SIEM parsing and retention, correlation, behavior baselines, and alert tuning against false positives and false negatives. Vulnerability analysis: injection, request forgery, overflows, insecure deserialization and embedded secrets, and the fixes, from input validation and output encoding to patching and least privilege. Threat hunting and intelligence: ISACs, honeytokens, STIX and TAXII, and detection rules in Sigma, YARA, Snort and RITA. Incident response: sandbox detonation, reverse engineering, disk, memory and email artifacts, timelines and root cause analysis.
CompTIA writes 20 of the 23 SecurityX objectives as "given a scenario" or "given a set of requirements" tasks, and the paper tests exactly that. A question describes an environment with its constraints attached - a legacy controller that cannot be patched, a regulator with a reporting clock, a budget that buys one control and not three - and asks which design, change or next step fits all of it. Every option is usually a real control that works somewhere; the question is whether it works here. Security+ knowledge tells you what the options are, not which one this situation calls for, and preparation written for CASP+ V4 prepares you for a different exam: CompTIA cut the objectives from 28 to 23 for SecurityX, raised security engineering from 26% to 31% and governance, risk, and compliance from 15% to 20%, and cut security operations from 30% to 22%.
The questions follow each of these as it stands now:
Every question carries a full explanation, and none of them restates the winning option. An explanation that says "the answer is an HSM because an HSM is correct here" teaches nothing you can carry to the next question. Each one here names the test that sorted the options - which control acts first, which requirement the design cannot trade away, whether the evidence proves the conclusion or only suggests it - and where a neighboring answer would have been right instead. Each closes by naming the CompTIA objective it tests.
CompTIA calls SecurityX a hands-on, performance-based certification, so this bank does not stop at picking one answer. 155 of the 700 questions are drag-and-drop boards, and every board carries at least one tile that belongs nowhere, so elimination alone cannot finish it. 207 questions have two or three correct answers and say how many, the shape that exposes a half-learned distinction. And 28 questions put a real artifact in front of you: a CI/CD pipeline, Terraform, a Kubernetes role, cloud IAM policies, a SAML assertion, an SELinux denial, an SPF record, a SOAR playbook, a CVSS 4.0 vector, Sigma, Snort and YARA rules, vulnerable C, JavaScript and Python, and a PE section table. Each asks you to read it the way a senior engineer would: what it permits, what it misses, what it proves. The other 310 questions have one answer.
Exam Coach AI sits next to the question you are on and explains the concept behind it while the clock runs. Ask it what makes an MFA method phishing-resistant, what "harvest now, decrypt later" means, or what separates Secure Boot from measured boot, and it answers in the terms this exam uses. What it will not do is tell you which option to pick - that part is yours, and it is the part the real exam measures. It is built in-house by PrepifyLabs and tuned for SecurityX rather than a general assistant bolted on.
CompTIA recommends Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge before SecurityX, and every one of those exams is sold here. The Security+ practice exam is the vocabulary SecurityX assumes: this paper never asks what a control is, only whether it is the right one. The CySA+ practice exam is the analyst's view of the security operations domain, and SecurityX asks you to design the program those analysts work inside. The PenTest+ practice exam covers the attacker's side of vulnerability analysis, which SecurityX turns into threat models and mitigations, and Network+ and Cloud+ sit under its network and cloud questions.
Candidates also weigh SecurityX against the CISSP practice exam. Both cover governance, risk, architecture and engineering, for experienced practitioners; the difference is register. CISSP asks what a security leader should decide and whether the decision would satisfy an auditor. SecurityX asks what a senior engineer should build or change and expects the configuration to be right.
The pass mark here is 70% of our own questions, scored out of 100, with a breakdown by domain so you can see which area is costing you the attempt. A sitting draws 90 questions from the pool of 700, the most CompTIA puts on the real paper, in proportion to the four domains and with 150 minutes on the clock, so two attempts are not the same exam twice. Every question you get wrong is kept for review with its explanation, and partial credit applies to the multi-answer questions and the drag-and-drop boards. The real SecurityX exam reports only a pass or fail result, so the percentage here is the only number to measure yourself against.
Forty questions are free, and they are spread across all four domains - 8 from governance, risk, and compliance, 11 from security architecture, 12 from security engineering and 9 from security operations - rather than being 40 easy ones from the front of the bank. They include 15 drag-and-drop boards and 10 multi-answer questions, enough to see the explanation style and Exam Coach AI at work before deciding anything.
The most advanced examination and certification readiness platform available. Train autonomously, pass effortlessly.
Prepifylabs LLC, 5900 Balcones Drive STE 38508, Austin, TX 78731, United States