SecurityX study guide · 2026

The 4 SecurityX domains, explained

4 domains and 23 official objectives. Security Engineering carries the most weight at 31%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
Maximum of 90
Time
165 minutes
Passing score
Pass/fail only (no scaled score)
Outline
CAS-005 (V5) exam objectives version 3.0, launched 17 December 2024 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 20%
  2. 2 27%
  3. 3 31%
  4. 4 22%
  1. 1 Governance, Risk, and Compliance
  2. 2 Security Architecture
  3. 3 Security Engineering
  4. 4 Security Operations

All 4 domains

23 official objectives 170–225 hrs suggested study

  1. Domain 01 20%

    Governance, Risk, and Compliance

    Domain 1 asks you to act as the senior practitioner who turns business requirements, regulations and threat models into a defensible security program, including the new risks that AI adoption brings.

    Inside this domain

    • Given a set of organizational security requirements, implement the appropriate governance components.
    • Given a set of organizational security requirements, perform risk management activities.
    • Explain how compliance affects information security strategies.
    • Given a scenario, perform threat-modeling activities.
    • and 1 more objectives

    Watch for Mitigating a risk already within tolerance

    Objectives
    5
    Questions est.
    ~18
    Study time est.
    35–45 hrs
  2. Domain 02 27%

    Security Architecture

    Domain 2 tests whether you can design an enterprise that stays secure and available by default: where components sit, how identity decides access, how cloud services are governed and how Zero Trust replaces the perimeter.

    Inside this domain

    • Given a scenario, analyze requirements to design resilient systems.
    • Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages.
    • Given a scenario, integrate appropriate controls in the design of a secure architecture.
    • Given a scenario, apply security concepts to the design of access, authentication, and authorization systems.
    • and 2 more objectives

    Watch for Vertical scaling for an availability requirement

    Objectives
    6
    Questions est.
    ~24
    Study time est.
    45–60 hrs
  3. Domain 03 31%

    Security Engineering

    The heaviest SecurityX domain asks you to configure, troubleshoot and harden the components an enterprise runs on, from federation and 802.1X to TPM attestation, SCAP automation and post-quantum cryptography.

    Inside this domain

    • Given a scenario, troubleshoot common issues with identity and access management (IAM) components in an enterprise environment.
    • Given a scenario, analyze requirements to enhance the security of endpoints and servers.
    • Given a scenario, troubleshoot complex network infrastructure security issues.
    • Given a scenario, implement hardware security technologies and techniques.
    • and 4 more objectives

    Watch for Credentials blamed for a time problem

    Objectives
    8
    Questions est.
    ~28
    Study time est.
    55–70 hrs
  4. Domain 04 22%

    Security Operations

    Domain 4 puts you in the senior analyst's seat: tune what the SIEM tells you, recommend fixes that shrink the attack surface, hunt with intelligence and reconstruct what happened from artifacts.

    Inside this domain

    • Given a scenario, analyze data to enable monitoring and response activities.
    • Given a scenario, analyze vulnerabilities and attacks, and recommend solutions to reduce the attack surface.
    • Given a scenario, apply threat-hunting and threat intelligence concepts.
    • Given a scenario, analyze data and artifacts in support of incident response activities.

    Watch for Quiet means safe

    Objectives
    4
    Questions est.
    ~20
    Study time est.
    35–50 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 170–225 hrs of study.

  1. 3 Security Engineering 31% · 55–70 hrs
  2. 2 Security Architecture 27% · 45–60 hrs
  3. 4 Security Operations 22% · 35–50 hrs
  4. 1 Governance, Risk, and Compliance 20% · 35–45 hrs

Try one

Practice questionDomain 3: Security Engineering

A defense contractor exchanges design files that must remain confidential for at least 25 years. Its threat model assumes a nation-state is recording encrypted traffic today. Which change BEST addresses this risk for data in transit?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Mitigating a risk already within tolerance

    Clue Phrases such as 'within the approved tolerance' or 'leadership has accepted' signal formal acceptance, not more spending.

  • Domain 2

    Vertical scaling for an availability requirement

    Clue The scenario mentions uptime targets, maintenance without downtime, or tolerance of an instance failure.

  • Domain 3

    Credentials blamed for a time problem

    Clue Errors mention validity, expiry or 'not yet valid', or failures are limited to one host or site.

  • Domain 4

    Quiet means safe

    Clue A recent change such as an agent update, migration or firewall rule, together with an unusual drop to zero events.

Other Cybersecurity certifications

Study guides for exams that overlap with SecurityX.

Practise what you read

SecurityX domains: common questions

How many domains are in the SecurityX exam?

SecurityX has 4 domains with 23 official objectives between them: Governance, Risk, and Compliance, Security Architecture, Security Engineering and Security Operations.

Which SecurityX domain carries the most weight?

Security Engineering is the heaviest at 31%, followed by Security Architecture (27%). The lightest is Governance, Risk, and Compliance (20%). Weights come from CompTIA's official outline.

What is the SecurityX exam format?

Questions: Maximum of 90. Time allowed: 165 minutes. Passing score: Pass/fail only (no scaled score).

How long should I study for SecurityX?

Our planning estimate is 170–225 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Security Engineering, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CAS-005 (V5) exam objectives version 3.0, launched 17 December 2024 (current), published by CompTIA. It was last reviewed in October 2026.

Domain names, weights and objectives come from CompTIA's official outline (CAS-005 (V5) exam objectives version 3.0, launched 17 December 2024 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.