CAS-005 — CompTIA SecurityX (V5)
CompTIA

CompTIA SecurityX (V5) (CAS-005) Practice Questions

★★★★★★ 4.9 124 verified reviews
135 questions
June 14, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Governance, Risk, and Compliance (20%)
  • Security Architecture (27%)
  • Security Engineering (31%)
  • Security Operations (22%)

Sample Questions (14 of 135 shown)

Q1 Governance, Risk, and Compliance
A compliance officer is reviewing data sovereignty laws in several countries where the organization does not have a business presence. What is the most likely reason for reviewing these laws?
  1. The organization is performing due diligence for potential tax issues
  2. The organization has been subject to legal action in countries where it does have a presence
  3. The organization is concerned about new regulatory enforcement in other countries
  4. The organization is suffering brand reputational damage due to incorrect media reports
✓ Correct Answer: C
Data sovereignty laws define how data must be stored and processed within specific countries. Even without a local business presence, organizations may need to comply if they process data from citizens of those countries (e.g., GDPR's extraterritorial applicability). Reviewing these laws proactively prepares the organization for new regulatory requirements.
Q2 Governance, Risk, and Compliance
A company's load balancer has reached end-of-life (EOL) and is scheduled for replacement. A new critical vulnerability is discovered that affects an unused feature of the load balancer. Which two options best address the organization's risk? (Select TWO)
  1. Disable the vulnerable service
  2. Request indefinite risk acceptance for the vulnerability
  3. Exclude these devices from vulnerability scans
  4. Immediately decommission the hardware
  5. Disallow any network traffic to or from the hardware
  6. Request a 90-day risk acceptance for the vulnerability
✓ Correct Answer: A, F
Since the device is EOL and the vulnerability affects an "unused feature," the most effective immediate mitigation is to disable the vulnerable service, which eliminates the risk entirely. Since the device is already scheduled for replacement, management can request a 90-day risk acceptance as a transitional measure while the replacement is deployed.
Q3 Governance, Risk, and Compliance
When operating with a constrained budget, which of the following best explains the importance of determining organizational risk appetite?
  1. Risk appetite directly impacts acceptance of high-impact, low-likelihood events
  2. Organizational risk appetite varies from organization to organization
  3. Budgetary pressure drives risk mitigation planning in all companies
  4. Risk appetite directly influences which breaches are disclosed publicly
✓ Correct Answer: A
Risk appetite defines the amount and type of risk an organization is willing to accept. With a constrained budget, not all risks can be mitigated. A well-defined risk appetite allows leadership to consciously accept certain high-impact, low-likelihood events where the cost of mitigation exceeds the potential loss, enabling focused spending on higher-priority risks.
Q4 Governance, Risk, and Compliance
An organization receives an OSINT report indicating increased ransomware attacks targeting file shares at peer companies. The organization wants to deploy hardening policies to its servers and workstations to contain potential ransomware. How should the engineer best achieve this?
  1. Enable biometric authentication mechanisms on user workstations and block traffic on port 53
  2. Only allow interactive logon by users on workstations and restrict traffic on port 445 to file shares
  3. Instruct users to use password managers to generate new credentials and protect traffic on port 443
  4. Grant users permission to rotate admin passwords and deny traffic on port 80
✓ Correct Answer: B
Ransomware often spreads laterally using the SMB protocol (port 445) to encrypt file shares. Restricting interactive logon reduces the risk of credential theft being used for remote logins. Restricting port 445 traffic limits the ransomware's ability to spread and attack file shares across the network.
Q5 Governance, Risk, and Compliance
Compliance audit findings indicate employee role or department changes have led to privilege creep. Which two are the best solutions to mitigate this problem? (Select TWO)
  1. Implement role-based access policies
  2. Design least privilege policies
  3. Establish mandatory vacation policies
  4. Perform periodic access reviews
  5. Require regular job rotation
✓ Correct Answer: A, D
RBAC ensures that when employees change roles, they are assigned new roles and removed from old ones, preventing privilege accumulation. Periodic access reviews serve as a detective control to identify and remove privileges that may have been missed during role transitions.
Q6 Governance, Risk, and Compliance
A compliance officer is facilitating a Business Impact Analysis (BIA). What are the primary outputs that directly inform the risk management strategy? (Select TWO)
  1. Maximum Tolerable Downtime (MTD) for key business functions
  2. A complete inventory of all hardware and software assets
  3. A list of identified threats and vulnerabilities
  4. The Annualized Rate of Occurrence (ARO) for system failures
  5. Recovery Time Objectives (RTOs) for critical processes
✓ Correct Answer: A, E
The BIA identifies critical business functions and their recovery requirements. MTD defines the maximum downtime a function can tolerate before causing significant business harm. RTO specifies the target time for restoring a function after disruption. Both directly inform continuity planning and risk management prioritization.
Q7 Governance, Risk, and Compliance
A mature security organization wants to leverage its GRC platform to automate the risk management lifecycle. Which two automated workflows best represent this goal? (Select TWO)
  1. Automatically generating a plan of action and milestones (POA&M) when a control test fails
  2. Deploying patches to vulnerable systems identified by a scanner
  3. Pushing security awareness training modules to new employees
  4. Triggering a third-party risk assessment when a new vendor is added to the procurement system
  5. Correlating SIEM alerts to build a timeline of a security incident
✓ Correct Answer: A, D
GRC platforms excel at automating risk governance workflows. Automatically generating a POA&M when a control fails streamlines remediation tracking. Triggering a third-party risk assessment when a vendor is added embeds risk management into business processes. These are core GRC automation functions.
Q8 Governance, Risk, and Compliance
A multinational manufacturing firm wants to mandate specific configuration settings such as disabling unnecessary services and enforcing minimum password complexity. Which document type is most appropriate for enforcing these mandatory technical controls?
  1. Guideline
  2. Standard
  3. Policy
  4. Procedure
✓ Correct Answer: B
A standard defines specific, mandatory technical requirements that must be followed. Standards sit between high-level policies (which state objectives) and procedures (which give step-by-step instructions). Standards like server hardening baselines enforce specific configuration settings.
Q9 Governance, Risk, and Compliance
A security officer performs due diligence before implementing a third-party solution. During the assessment, the vendor cannot provide SOC 2 Type II reports and offers self-attestation questionnaires instead. The vendor processes PII covered by GDPR. What risk treatment is most appropriate?
  1. Accept the risk and proceed given business need
  2. Require a compensating controls framework audit within 90 days with right-to-audit clauses and SLA penalties
  3. Terminate the vendor relationship immediately
  4. Perform a manual penetration test as equivalent to SOC 2
✓ Correct Answer: B
When a critical vendor cannot provide independent assurance (SOC 2 Type II), the appropriate response is to contractually require a path to independent validation with right-to-audit provisions and financial penalties. This addresses GDPR Article 28 requirements for appropriate technical and organizational measures while maintaining the business relationship under a defined remediation timeline.
Q10 Governance, Risk, and Compliance
An organization wants to create a threat model to identify vulnerabilities in its infrastructure. Which framework is most appropriate for evaluating threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability?
  1. STRIDE
  2. DREAD
  3. OCTAVE
  4. PASTA
✓ Correct Answer: B
DREAD is a risk assessment model used for classifying and prioritizing threats. The acronym stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. It helps security professionals rank threats by assigning numerical values to each category.
Q11 Governance, Risk, and Compliance
A security officer received complaints from users about excessive MFA push notifications at night. After investigation, the officer determines this is an MFA fatigue attack. What is the most effective mitigation?
  1. Reduce the MFA timeout window
  2. Implement number matching for MFA push notifications
  3. Disable MFA for non-administrative users
  4. Increase password complexity requirements
✓ Correct Answer: B
MFA fatigue attacks bombard users with push notifications until they accept one out of annoyance. Number matching requires users to enter a displayed number into the authenticator app, preventing accidental approvals. This is Microsoft's recommended mitigation for MFA fatigue attacks.
Q12 Governance, Risk, and Compliance
A company wants to implement a platform to better identify which specific assets are affected by a given vulnerability. Which component provides the best foundation?
  1. SASE
  2. CMDB
  3. SBoM
  4. SLM
✓ Correct Answer: B
A Configuration Management Database (CMDB) is a centralized repository that tracks IT assets, their configurations, and relationships. When a new vulnerability is published, the security team can query the CMDB to identify all assets with the affected software, enabling precise impact assessment and targeted remediation.
Q13 Governance, Risk, and Compliance
An organization determines existing business continuity practices are inadequate. Which risk management strategy involves transferring the financial impact of potential losses to a third party?
  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance
  4. Risk transfer
✓ Correct Answer: D
Risk transfer shifts the financial burden of a risk event to another party, typically through insurance or contractual agreements. When the cost of mitigation exceeds the asset value, risk transfer via insurance is an appropriate strategy.
Q14 Governance, Risk, and Compliance
An organization wants to ensure its security program addresses the complete asset management lifecycle from procurement to decommissioning. Which framework is most relevant for this requirement?
  1. COBIT
  2. ITIL
  3. NIST CSF
  4. OWASP
✓ Correct Answer: B
ITIL (Information Technology Infrastructure Library) provides a comprehensive framework for IT service management, including detailed processes for asset management throughout the lifecycle. COBIT focuses on governance, NIST CSF on cybersecurity, and OWASP on application security.

You've viewed 3 of 135 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

CompTIA SecurityX (CAS-005) is an advanced cybersecurity certification designed for security architects and senior security engineers. Launched in December 2024 as V5 (replacing the former CompTIA Advanced Security Practitioner - CASP+), this exam validates your ability to design, build, and implement secure solutions across complex enterprise environments. Unlike intermediate cybersecurity certifications, SecurityX focuses on architectural thinking, risk management, and enterprise-wide security governance, making it ideal for professionals targeting senior roles in security architecture and engineering.

Our CAS-005 practice test platform offers advanced-level practice questions that mirror the latest V5 exam objectives. Each question includes detailed explanations, scenario-based contexts, and architectural decision-making practice to help you master the material. The practice tests cover all 4 domains with weighted accuracy, ensuring you can design secure solutions, implement automation and monitoring, apply cryptographic techniques, and manage governance, risk, and compliance across the enterprise. With our PBQ simulator, you'll practice designing zero-trust architectures, implementing security controls in hybrid environments, conducting threat hunting, and performing incident response—exactly what you'll face on exam day.

Whether you're a seasoned security professional preparing for the next level of certification or an enterprise architect designing resilient security solutions, our practice tests adapt to your expertise level. The intelligent feedback system identifies your weak areas in security architecture, engineering, and operations, then generates targeted practice sessions to close knowledge gaps. Combined with our enterprise-focused study materials, you can study complex security scenarios anytime, anywhere. Join thousands of senior security professionals who've earned their SecurityX certification with our proven practice test system. Start your free trial today and advance your cybersecurity career to the architect level.

Official Exam Domains & Weighting

To successfully pass the CAS-005 exam, candidates must demonstrate advanced security skills across the following four core domains:
  • Domain 1: Governance, Risk, and Compliance (20%) – Security program documentation, frameworks (NIST, COBIT), risk management, threat modeling (STRIDE, ATT&CK), compliance strategies.
  • Domain 2: Security Architecture (27%) – Cloud capabilities (CASB, shadow IT), network architecture (segmentation, microsegmentation, SASE, SD-WAN), zero trust concepts, deperimeterization.
  • Domain 3: Security Engineering (31%) – Automation (scripting, IaC, SOAR), vulnerability management (SCAP, CVE, CVSS), advanced cryptography (PQC, homomorphic encryption, forward secrecy), cryptographic use cases.
  • Domain 4: Security Operations (22%) – Monitoring and data analysis (SIEM, behavior baselines), threat hunting (OSINT, dark web, IoC sharing), incident response (malware analysis, reverse engineering, root cause analysis).

What Our Customers Say 124 verified reviews

4.9 ★★★★★★ Based on 124 reviews
★★★★★
I passed CAS-005 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.
— Nicole K.
★★★★★★
The CAS-005 question bank is very comprehensive. I went through all 120+ questions and felt completely ready for exam day.
— Sebastian M.
★★★★★★
The domain-based breakdown in the CAS-005 questions really helped me identify which areas needed more work.
— Elena R.
★★★★★★
Recommended this to my entire study group for CAS-005. Four out of four passed. That says something.
— Audrey K.
★★★★★★
I liked that the CAS-005 questions update regularly. Felt current and aligned with what I actually saw on the test.
— Dylan P.
★★★★★
Passed CAS-005 with 912/1000. The practice questions cover the exam objectives thoroughly and the explanations are clear.
— Ella M.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Security+ is an intermediate certification for cybersecurity analysts, while SecurityX (CAS-005) is an advanced certification for security architects and senior engineers. SecurityX requires 10 years of IT experience (including 5 years of security), while Security+ requires 2 years.

CompTIA renamed CASP+ to SecurityX in V5 (CAS-005) to better reflect the exam's focus on security architecture and engineering at the enterprise level. The "X" symbolizes the intersection of security domains and the advanced, cross-functional nature of the certification.

Yes! Our PBQ simulator mirrors the real exam experience. You'll practice designing zero-trust architectures, implementing security controls in multi-cloud environments, conducting threat hunting, and performing incident response in a simulated environment.

The CAS-005 exam uses a Pass/Fail grading system with no scaled score. Our practice tests use the same grading criteria, so you'll know exactly when you're ready.

Due to the advanced nature of the exam, most candidates study for 8-12 weeks. CompTIA recommends 10 years of general IT experience (including 5 years of hands-on security) before attempting this exam.

SecurityX prepares you for senior roles like Security Architect, Senior Security Engineer, Systems Requirements Planner, Security Control Assessor, and Research & Development Specialist. It's also recognized under DoD 8140 for various advanced security work roles.

Yes! Our practice questions cover the latest V5 exam objectives, including AI use in security operations, AI governance, and AI risks—ensuring you're prepared for cutting-edge security challenges.