Back to certifications
CompTIA certification

CompTIA SecurityX

The advanced cybersecurity certification for security architects and senior security engineers.SecurityX is an advanced cybersecurity certification for security architects and senior security engineers. It proves you have the skills to design, build, and implement secure solutions across complex environments. You'll also show you can support a resilient enterprise while addressing governance, risk, and compliance needs.
CompTIA
Exam version: V5
Target roleSecurity architect

Skills you'll

learn

Build skills with CompTIA learning and validate them with the CompTIA SecurityX certification.
Design, implement, and integrate secure solutions across complex environments to support a resilient enterprise in security architecture and engineering.
Use automation, monitoring, detection, and incident response to proactively support ongoing security operations.
Apply security practices to cloud, on-premises, and hybrid environments to ensure enterprise-wide protection.
Utilize cryptographic technologies and techniques while evaluating the impact of emerging trends, such as artificial intelligence, on information security.
Implement governance, compliance, risk management, and threat modeling strategies across the enterprise.
Validate advanced, hands-on skills in security architecture and senior security engineering within live environments.

Exam

details

Everything you need to know before taking the CompTIA SecurityX exam.
Exam versionV5
Exam series codeCAS-005
Launch dateDecember 17, 2024
Number of questionsMaximum of 90 questions
Types of questionsMultiple-choice and performance-based
DurationMaximum of 165 minutes
Passing scorePass/fail only; no scaled score
LanguagesEnglish and Japanese; other languages to be determined
Recommended experienceMinimum of 10 years of general hands-on IT experience, including 5 years of hands-on security, with Network+, Security+, CySA+, Cloud+, and PenTest+ or equivalent knowledge
RetirementUsually three years after launch (estimated 2027)
DoD 8140 approved work rolesSecurity architect, systems requirements planner, security control assessor, research and development specialist, and more

Exam

objectives

The CompTIA SecurityX (V5) exam covers the following domains, weighted by their share of the exam.
1

Governance, risk, and compliance

20%
  • Security program documentation: policies, procedures, standards, and guidelines.
  • Program management: training (phishing, security, privacy), communication, reporting, and RACI matrix.
  • Frameworks: COBIT, ITIL, etc.
  • Configuration management: asset life cycle, CMDB, and inventory.
  • GRC tools: mapping, automation, and compliance tracking.
  • Data governance: production, development, testing, and QA.
  • Risk management: impact analysis, risk assessment (quantitative vs. qualitative), third-party risk, confidentiality, integrity, and availability.
  • Threat modeling: actor characteristics, attack patterns, and frameworks (ATT&CK, CAPEC, STRIDE).
  • Attack surface: architecture reviews, data flows, and trust boundaries.
  • Compliance strategies: industry-specific standards (PCI DSS, ISO/IEC 27000).
  • Security frameworks: NIST, CSF, CSA, and others.
2

Security architecture

27%
  • Cloud capabilities: CASB (API-based, proxy-based), shadow IT detection, shared responsibility model, CI/CD pipeline, Terraform, Ansible, container security, orchestration, and serverless workloads.
  • Cloud data security: data exposure, leakage, remanence, insecure storage, and encryption keys.
  • Cloud control strategies: proactive, detective, and preventative controls; customer-to-cloud connectivity, service integration, and continuous authorization.
  • Network architecture: segmentation, microsegmentation, VPN, always-on VPN, and API integration.
  • Security boundaries: asset identification, management, attestation, data perimeters, and secure zones.
  • Deperimeterization: SASE, SD-WAN, and software-defined networking.
  • Zero trust concepts: defining subject-object relationships.
3

Security engineering

31%
  • Automation: scripting (PowerShell, Bash, Python), event triggers, IaC, cloud APIs, generative AI, containerization, patching, SOAR, and workflow automation.
  • Vulnerability management: scanning, reporting, and SCAP (OVAL, XCCDF, CPE, CVE, CVSS).
  • Advanced cryptography: PQC, key stretching, homomorphic encryption, forward secrecy, and hardware acceleration.
  • Cryptographic use cases: data at rest, in transit, and in use; secure email, blockchain, privacy, compliance, and certificate-based authentication.
  • Cryptographic techniques: tokenization, code signing, cryptographic erase, digital signatures, hashing, and symmetric/asymmetric cryptography.
4

Security operations

22%
  • Monitoring and data analysis: SIEM (event parsing, retention, false positives/negatives), aggregate analysis (correlation, prioritization, trends), and behavior baselines (network, systems, users).
  • Vulnerabilities and attack surface: injection, XSS, insecure configurations, outdated software, and weak ciphers; mitigations include input validation, patching, encryption, and defense-in-depth.
  • Threat hunting: internal intelligence (honeypots, UBA), external intelligence (OSINT, dark web, ISACs), TIPs, IoC sharing (STIX, TAXII), and rule-based languages (Sigma, YARA, Snort).
  • Incident response: malware analysis (sandboxing, IoC extraction, code stylometry), reverse engineering, metadata analysis, data recovery, and root cause analysis.
Exam information is published by CompTIA and may change. Contact us for the current exam version and available sessions.

Take CompTIA SecurityX at NEXERA Institute

Our advisors help you choose the right preparation, book your exam session and get certified with confidence.
CompTIA SecurityX | Nexera