TL;DR
SecurityX (exam code CAS-005, version 5, launched December 17 2024 as the renamed CASP+) is a maximum of 90 questions in 165 minutes with pass-fail scoring, aimed at working architects and senior engineers. CompTIA recommends around ten years of general IT experience including five hands-on. This 12-week plan assumes you already hold Security+ level knowledge cold and can read logs, ports, and crypto without thinking. Twelve weeks at 60 to 90 minutes a day, with architecture write-ups every week instead of flashcard volume. Start from the SecurityX cert page.
What changed with the rename
CASP+ became SecurityX with version 5, and search results still mix both names, which confuses study planning. Treat any CAS-004 era material as background only: the current objectives document is CAS-005, and its emphasis moved toward modern enterprise concerns like cloud architecture, zero-trust design, and automation. The format stayed expert-level: long scenario items where several answers look plausible and only one fits the business constraint. The single biggest mindset shift from Security+ is this: Security+ asks what the control does, SecurityX asks which architecture the business should buy given cost, risk appetite, and existing infrastructure. Every week below trains that second question. If you are choosing between this and the CISSP, read the CISSP 12-week plan first; SecurityX tests deeper technical design, CISSP tests broader management judgment.
Weeks 1 to 2: Enterprise security architecture foundations
Rebuild fundamentals at architect altitude. Security models and frameworks as design constraints: SABSA for business-driven architecture, TOGAF for enterprise structure, NIST SP 800-53 controls as a catalog to select from, NIST Cybersecurity Framework functions (govern, identify, protect, detect, respond, recover) as coverage checks. Network architecture decisions: segmentation strategies and micro-segmentation, software-defined perimeters, secure cloud connectivity (VPN versus dedicated interconnects versus private endpoints), data flow mapping before control placement. Cryptographic architecture: designing PKI hierarchies with offline roots and subordinate CAs, certificate lifecycle and revocation (CRL versus OCSP), selecting algorithms and key lengths per data classification, key management and HSM placement, and crypto agility for post-quantum migration planning. Weekly deliverable: a one-page architecture decision record for a fictional company choosing between two designs, with the business reason stated first. Decision records are the exam genre in miniature.
Weeks 3 to 4: Risk, governance, and compliance strategy
Senior exams test governance as decisions, not definitions. Risk management lifecycle: identify, assess, treat (accept, avoid, mitigate, transfer), monitor, with quantitative inputs (asset value, exposure factor, annualized loss expectancy) and qualitative matrices where numbers do not exist. Risk appetite versus risk tolerance: appetite is the amount the business will take, tolerance is the acceptable deviation, and exam scenarios punish answers that exceed either. Third-party risk: vendor assessment questionnaires, SOC 2 report reading (Type I design versus Type II operating effectiveness over time), right-to-audit clauses, and supply chain risk from SaaS dependencies and open-source components. Compliance mapping across PCI DSS, HIPAA, GDPR, and SOX: know which regimes drive encryption, breach notification, access review, and audit evidence, because scenarios name the industry to signal the regime. Policy hierarchy: policy states intent, standards set mandatory rules, baselines set minimum implementations, guidelines advise, procedures instruct. Weekly deliverable: a risk register entry for three realistic risks with owner, treatment, residual risk, and review date.
Weeks 5 to 6: Security engineering and cloud design
This is the technical heart. Identity architecture: federation with SAML and OIDC, single sign-on design, privileged access management with just-in-time elevation and session recording, service accounts and managed identities, directory synchronization and failure modes. Zero-trust architecture: identity-aware proxies, device posture checks, micro-segmentation, continuous verification, and the honest limitations (legacy protocols, encrypted traffic visibility, user friction). Cloud security design: shared responsibility per service model, multi-account strategy with centralized logging, control plane protection, storage access design (private endpoints, signed URLs with short expiry), key management separation from data. Container and virtualization security: image provenance and scanning, runtime protection, orchestration RBAC, hypervisor hardening. Data protection architecture: classification schemes, DLP placement at endpoint, network, and cloud, database encryption choices (transparent versus column-level versus application-level), tokenization for card data. Weekly deliverable: a cloud landing-zone sketch with identity, network, logging, and key management placed and justified in two sentences each.
Weeks 7 to 8: Security operations leadership and automation
Operations at design level means building the machine, not working the queue. SOC architecture: SIEM selection and tuning strategy, log source prioritization (identity and authentication first, then endpoints, then network), detection engineering with use cases mapped to adversary techniques, alert triage tiers, and metrics that matter (mean time to detect and respond, true positive rate, coverage of critical assets). Incident response at program level: preparation through lessons learned, with negotiation and notification phases for ransomware-era scenarios, evidence handling and chain of custody, tabletop exercise design. Automation: read Python, Bash, and PowerShell fluently since scripts appear as evidence to interpret (what does this script collect, what would it change), and design SOAR playbooks for phishing triage and account compromise containment. Threat intelligence: STIX and TAXII for sharing formats, intelligence lifecycle from requirements to feedback, atomic versus behavioral indicators, and matching intelligence to detection coverage. Weekly deliverable: a detection use case written fully (hypothesis, data sources, logic, tuning plan, response action) plus the playbook that fires when it alerts.
Weeks 9 to 10: Assessment, testing strategy, and emerging technology
Assessment design from the buyer side: when to commission vulnerability assessments versus penetration tests versus red team exercises, how to scope each, how to read the deliverable critically (was the finding validated, is the severity tied to business impact, is remediation specific). Application security program design: SAST and DAST and SCA placement in CI/CD pipelines, threat modeling methodologies (STRIDE for enumeration, PASTA for risk-centric analysis, attack trees for path reasoning), secure defaults and guardrails over developer training alone. Emerging technology judgment: AI system risks (training data poisoning, prompt injection, model inversion, data leakage through inference) with controls (input validation, output filtering, access scoping, evaluation harnesses). A note on quantum: no quantum content is worth deep study yet, but crypto agility as a design principle appears. Add blockchain analysis capabilities and limitations, and OT and IoT segmentation where IT meets physical process. Weekly deliverable: a test scope document for a red team exercise with objectives, boundaries, and success criteria.
Weeks 11 to 12: Scenario simulation and exam craft
SecurityX scenarios reward elimination discipline. Read the business constraint first (budget cap, uptime requirement, regulatory regime, existing stack), then eliminate answers that violate it before comparing technical merits. Two sittings under the 165-minute clock with unseen scenario sets, three to four days apart, then patch-only study on missed themes. Pass-fail scoring means there is no partial-credit strategy to game and no score to optimize; the only target is above the line with margin, so breadth of coverage beats depth in any single specialty. Common failure modes from our own data: answering as a technician (best tool) instead of an architect (best fit for the constraint), ignoring the industry named in the stem, and spending scenario budget on early questions. The final 48 hours: no new material, one architecture decision record rewritten from memory, sleep treated as study. Confirm logistics on the exam-day checklist for CompTIA tests rather than improvising on the day.
Practise with labs and PBQs
SecurityX is a judgment exam, and judgment is trainable in artefacts. The CAS-005 pack holds 20 performance-based questions and 39 labs, built around the documents senior engineers actually produce: risk registers, control selections, architecture decisions and governance responses (counts from the live catalogue).
Use one lab as the closing act of each two-week block. Weeks 1 and 2 get the architecture and control-selection tasks. Weeks 3 and 4 get risk and compliance, where the answer is a defensible position rather than a definition. Weeks 5 and 6 get engineering and cloud design. Weeks 7 and 8 get operations and automation. Weeks 9 and 10 get assessment and emerging technology, including the AI risk material the blueprint now expects. Weeks 11 and 12 are simulations only.
The CAS-005 lab catalogue lists each task with the objective it checks, and the labs hub shows the technical labs if you want to keep your hands in a console while you study architecture.
Who wrote this
SecLern Editorial. Exam facts were read from the CompTIA SecurityX certification page on 2026-10-18. Architecture emphasis reflects the CAS-005 objectives document and our own scenario-simulation results: students who practice decision records weekly outperform flashcard studiers on scenario items by a wide margin.