Free CompTIA SecurityX (Formerly CASP+) CAS-005 Practice Test

CompTIA SecurityX is the current name for the advanced cybersecurity certification formerly known as CASP+. Start with free CAS-005 sample questions drawn from a 450-question practice bank covering all four official SecurityX V5 domains. Try the free 10-question mixed test, then drill weaker domains.

CAS-005 exam facts

CompTIA lists a maximum of 90 multiple-choice and performance-based questions and a maximum time of 165 minutes. The official result is pass/fail only; CompTIA does not publish a scaled passing score.

FlashGenius practice questions are independent preparation material, not official CompTIA exam questions. Confirm current policies at CompTIA's SecurityX page.

SecurityX exam domains

Domain 1: Governance, Risk, and Compliance (20%)

Covers governance frameworks, enterprise risk, compliance strategy, third-party risk, policy, privacy, and security program oversight. Practice this domain.

Domain 2: Security Architecture (27%)

Covers enterprise architecture, zero trust, cloud and hybrid design, trust boundaries, data flows, resilience, and secure integration. Practice this domain.

Domain 3: Security Engineering (31%)

Covers secure engineering, cryptography, automation, infrastructure controls, application security, emerging technology, and control integration. Practice this domain.

Domain 4: Security Operations (22%)

Covers threat management, monitoring, incident response, forensics, vulnerability management, operational resilience, and recovery. Practice this domain.

Free SecurityX sample questions with answers

Sample Question 1 — Governance, Risk, and Compliance

Developers at a software company keep asking the security team whether new internal services may use TLS 1.1, which cipher suites are permitted, and what minimum key lengths are required. The CISO wants these answers to be mandatory and consistent across all teams. Which of the following documents should the security team create?

  1. A. A cryptographic guideline that recommends preferred protocols and key lengths
  2. B. A cryptographic standard that mandates protocol versions and key lengths (Correct answer)
  3. C. A step-by-step procedure for requesting a certificate from the internal CA
  4. D. An acceptable use policy that describes how employees may use company systems

Correct answer: B

Explanation: B is correct because standards define mandatory, specific, measurable requirements, such as minimum protocol versions and key lengths, that support a higher-level policy. A is incorrect because guidelines are recommendations that allow discretion, but the CISO wants the requirements to be mandatory. C is incorrect because a procedure describes how to perform a task; it does not define which cryptographic settings are required. D is incorrect because an acceptable use policy governs user behavior and is too high level to specify protocol versions or cipher suites.

Sample Question 2 — Security Architecture

A water utility wants to detect malicious commands on the network link between its SCADA servers and field controllers. Engineers insist that no security device may drop, delay, or alter traffic on this link, because a false positive could disrupt water treatment. Which of the following designs best meets these requirements?

  1. A. A next-generation firewall placed between servers and controllers
  2. B. A passive IDS that receives a copy of traffic from a network tap (Correct answer)
  3. C. A web application firewall in front of the SCADA servers
  4. D. An inline IPS configured to block known malicious commands

Correct answer: B

Explanation: B is correct because a network tap copies traffic to a passive IDS out of band, so threats are detected without any device sitting inline where it could block or delay control traffic. A is incorrect because an inline firewall can block or delay traffic and does not satisfy the requirement. C is incorrect because a WAF inspects HTTP traffic to web applications and sits inline, so it fits neither the protocol nor the requirement. D is incorrect because an inline IPS can drop legitimate traffic after a false positive, which the engineers have ruled out.

Sample Question 3 — Security Engineering

After a web application's service account is migrated to a new server, users receive authentication errors when accessing the application with Kerberos. A domain controller logs the following: Event: KRB_AP_ERR_MODIFIED Service principal name: HTTP/intranet.corp.example.com Accounts with this SPN: svc_web_old, svc_web_new Which of the following should an engineer do to resolve the issue?

  1. A. Switch the application to NTLM authentication permanently
  2. B. Increase the Kerberos maximum ticket lifetime in the domain policy
  3. C. Remove the duplicate SPN so it is registered only on the account running the service (Correct answer)
  4. D. Reset the passwords of all users who reported errors

Correct answer: C

Explanation: C is correct because Kerberos service tickets are encrypted with the key of the account that holds the SPN; when the same SPN is registered on two accounts, tickets may be encrypted for the wrong account and fail to decrypt. A is incorrect because falling back to NTLM weakens authentication and does not fix the SPN misconfiguration. B is incorrect because ticket lifetime does not affect which account's key is used to encrypt the service ticket. D is incorrect because user passwords are not involved in decrypting the service ticket; the problem is the service account SPN.

Sample Question 4 — Security Operations

A SOC analyst reviews the following correlated SIEM events for a single user account within a two-minute window: 08:14:02 VPN login success, user jmalik, source 203.0.113.44 (country: Brazil) 08:14:20 Badge access granted, user jmalik, building HQ-2 (country: United States) 08:15:33 Mailbox rule created: forward all mail to external address Which of the following best describes what the SIEM correlation has revealed?

  1. A. Impossible travel followed by a suspicious mailbox forwarding rule, indicating account compromise (Correct answer)
  2. B. A user legitimately working remotely while a colleague badges in for them
  3. C. Normal behavior that requires no further investigation
  4. D. A time synchronization problem between the VPN and badge systems

Correct answer: A

Explanation: A is correct because the account authenticated from Brazil and badged into a U.S. building within two minutes, which is physically impossible, and the new external forwarding rule is a common post-compromise action. B is incorrect because badge sharing does not explain a simultaneous VPN login from another country or the external forwarding rule. C is incorrect because impossible travel combined with external forwarding is a strong indicator of compromise. D is incorrect because a clock offset would not create a foreign VPN login or an external mail forwarding rule.

Sample Question 5 — Governance, Risk, and Compliance

An internal audit finds that system administrators perform the quarterly privileged access review required by the access control policy in very different ways. Some export user lists from the directory, others review only group names, and several skip service accounts. Which of the following would best address this finding?

  1. A. Rewriting the access control policy to state that reviews are mandatory
  2. B. Writing a step-by-step procedure for performing the access review (Correct answer)
  3. C. Publishing a guideline that suggests possible approaches to reviewing access
  4. D. Increasing the review frequency from quarterly to monthly

Correct answer: B

Explanation: B is correct because the policy already requires the review; a procedure provides the detailed, repeatable steps that make the review consistent and complete. A is incorrect because the policy already mandates the review; restating it does not tell administrators how to perform it consistently. C is incorrect because guidelines are optional recommendations, so they would not eliminate the inconsistency the audit found. D is incorrect because reviewing more often does not fix the fact that each administrator reviews access differently and incompletely.

Sample Question 6 — Security Architecture

A company's perimeter firewall allows HTTPS to web servers in its screened subnet. Attackers continue to exploit known vulnerabilities in the servers' software through these allowed connections. The company wants to automatically block such exploit attempts in real time. Where should an IPS be placed?

  1. A. Inline between the perimeter firewall and the screened subnet (Correct answer)
  2. B. Outside the perimeter firewall, before any traffic filtering occurs
  3. C. On a SPAN port of the core switch in the internal network
  4. D. On each employee workstation as a host-based agent

Correct answer: A

Explanation: A is correct because placing an IPS inline on the path to the web servers lets it inspect permitted traffic and block exploit attempts before they reach the servers. B is incorrect because outside the firewall, the IPS would spend resources on traffic the firewall would drop anyway, and the placement is not required to protect the servers. C is incorrect because a device on a SPAN port receives only copies of traffic and cannot block attacks, and the core switch is not on the path to the screened subnet. D is incorrect because workstation agents do not inspect traffic headed to servers in the screened subnet.

Sample Question 7 — Security Engineering

A warehouse installs fingerprint readers at its entrances. Workers in cold conditions frequently fail to authenticate, and a manager asks the vendor to lower the matching threshold. Which of the following best describes the current problem and the risk of the manager's request?

  1. A. A high false rejection rate; lowering the threshold decreases the false acceptance rate
  2. B. A low crossover error rate; lowering the threshold has no effect on accuracy
  3. C. A high false acceptance rate; lowering the threshold decreases the false rejection rate
  4. D. A high false rejection rate; lowering the threshold increases the false acceptance rate (Correct answer)

Correct answer: D

Explanation: D is correct because rejecting legitimate users indicates a high false rejection rate, and loosening the matching threshold reduces rejections at the cost of accepting more unauthorized users. A is incorrect because lowering the threshold makes matching more permissive, which increases false acceptances. B is incorrect because threshold changes always trade off false acceptance and false rejection rates. C is incorrect because the problem is legitimate users being rejected, which is false rejection, not false acceptance.

Sample Question 8 — Security Operations

A SIEM engineer finds that firewall logs are being stored but no rules match them, because the firewall was upgraded and now sends events in a new format. Which of the following SIEM functions must be corrected?

  1. A. Event parsing (Correct answer)
  2. B. Log retention
  3. C. Role-based access to the SIEM console
  4. D. Alert prioritization

Correct answer: A

Explanation: A is correct because parsing normalizes raw log data into fields the SIEM can use; when a log format changes, the parser must be updated or the events will not be searchable or matched by rules. B is incorrect because retention controls how long events are stored, not whether they are parsed into fields. C is incorrect because access control governs who can use the SIEM, not how logs are parsed. D is incorrect because prioritization ranks alerts that already exist and does not extract fields from raw logs.

SecurityX practice test FAQ

What is the CompTIA SecurityX CAS-005 exam?

CompTIA SecurityX is CompTIA's advanced cybersecurity certification for experienced technical professionals. CAS-005 is the V5 exam and emphasizes enterprise security architecture, engineering, governance, risk, compliance, and operations.

How many questions are on the SecurityX CAS-005 exam?

CompTIA lists a maximum of 90 questions, including multiple-choice and performance-based questions.

How long is the SecurityX exam?

The CAS-005 exam has a maximum duration of 165 minutes.

What score is required to pass CAS-005?

CompTIA reports SecurityX as pass/fail only and does not publish a scaled passing score. FlashGenius percentages are practice accuracy, not an official predicted result.

What are the four SecurityX exam domains?

The V5 domains are Governance, Risk, and Compliance (20%), Security Architecture (27%), Security Engineering (31%), and Security Operations (22%).

Is SecurityX the replacement for CASP+?

Yes. CompTIA renamed its advanced cybersecurity certification from CASP+ to SecurityX. CAS-005 is the current V5 exam series code, so people searching for a CASP+ practice test may now need SecurityX CAS-005 preparation.

Are these CAS-005 practice questions free?

Yes. The quick-start and domain sample tests are free. Registered users can continue practicing, while Premium provides broader access and study features.

Do the questions include explanations?

Yes. Each sample question includes an answer explanation so you can review the technical reasoning and identify weak areas.

How should I use SecurityX practice tests?

Begin with the mixed 10-question diagnostic, then drill the domains where your accuracy is lowest. Review why each distractor is weaker before moving to timed mixed practice.

Are these official CompTIA exam questions?

No. FlashGenius creates independent practice material aligned to the published CAS-005 objectives. It is not affiliated with or endorsed by CompTIA.