• 105 questions

CASP Practice Test

Questions for CAS-005, the exam CompTIA now calls SecurityX, each with its public source.

NIST SP 800-39 manages risk at three tiers. Which tier is the mission and business process level?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 90 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 90 questions, 165 minutes.

More options

Unofficial practice questions, not affiliated with CompTIA. Bank checked October 6, 2026.

Next step Review the basics: Security+ questionsAnother IT certification? Pick it

All 105 questions

Governance, risk and compliance 22

  • A business application gets its physical security and its power protection from the data center that hosts it, and the application team implements none of it. What are those controls to the application? NIST SP 800-53 Rev. 5, section 2.3
  • A buyer asks a software vendor for a formal record of the components used to build a product and their supply chain relationships. What is the buyer asking for? NIST glossary, "software bill of materials" (SP 800-161r1, from E.O. 14028)
  • A community that runs many similar industrial systems publishes a ready-made set of control refinements to apply during tailoring. What is that specification called? NIST glossary, "overlay"
  • A company plans large-scale processing with a new technology that is likely to result in a high risk to individuals' rights. What does GDPR Article 35 require before the processing starts? Regulation (EU) 2016/679 (GDPR), Article 35(1)
  • A senior official reviews the assessment results and formally decides that the risk of running a new system is acceptable. Which RMF step is this? NIST SP 800-37 Rev. 2, section 2.2
Show all 105 questions (100 more)

Governance, risk and compliance, continued

  • A threat model for a payment service uses STRIDE. A customer denies sending a transfer and the service has no evidence either way. Which STRIDE category is this threat? OWASP, Threat Modeling Process, STRIDE Threat List
  • After choosing the moderate baseline, a team removes controls that do not apply, sets the organization-defined parameters and adds two controls for a special threat. What is this process called? NIST glossary, "tailoring"
  • An architect wants a public catalog of common attack patterns that explains how adversaries exploit weaknesses in applications. Which resource is that? MITRE, About CAPEC
  • An assessment finds three weaknesses that cannot be fixed before go-live. Which document lists the tasks, the resources needed, the milestones and the scheduled completion dates for correcting them? NIST glossary, "plan of action and milestones" (CNSSI 4009-2022)
  • An enterprise directory enforces password length for every system, but each system owner must still configure account lockout locally. What kind of control is the overall identification and authentication control for one of those systems? NIST glossary, "hybrid control" (CNSSI 4009-2022)
  • In supply chain risk management, what is the provenance of a component? NIST glossary, "provenance" (SP 800-161r1)
  • In the NIST Cybersecurity Framework 2.0, under which Function are the organization's cybersecurity risk management strategy, expectations and policy established, communicated and monitored? NIST Cybersecurity Framework 2.0 (CSWP 29), section 2
  • In the NIST Risk Management Framework, which step comes directly after controls have been selected? NIST SP 800-37 Rev. 2, section 2.2
  • In the SP 800-53 control families, each family opens with a "policy and procedures" control. What are the procedures for? NIST SP 800-53 Rev. 5, control AC-1
  • The NIST AI Risk Management Framework organizes its core into four functions. Which list names them? NIST AI 100-1 (AI RMF 1.0), section 5
  • NIST SP 800-39 manages risk at three tiers. Which tier is the mission and business process level? NIST SP 800-39, section 1.4 (outline of chapter 2)
  • No single employee may both create a vendor record and approve payments to that vendor. Which principle does this enforce? NIST SP 800-53 Rev. 5, control AC-5
  • Under GDPR Article 33, how soon must a controller notify the supervisory authority of a personal data breach, where feasible? Regulation (EU) 2016/679 (GDPR), Article 33(1)
  • What is information security continuous monitoring (ISCM)? NIST SP 800-137, Executive Summary
  • Which globally accessible knowledge base records adversary tactics and techniques seen in real-world observations? MITRE ATT&CK, home page
  • Which official has the authority to formally assume responsibility for operating a system at an acceptable level of risk? NIST glossary, "authorizing official" (FIPS 200)
  • Which threat modeling aid is a branching, hierarchical structure that shows the possible approaches to achieving one specific compromise? NIST glossary, "attack tree" (CNSSI 4009-2022)

Security architecture 27

  • A microservices application exposes many fine-grained endpoints. Which component gives all clients a single entry point to its component services? NIST SP 800-204, section 2.7.1
  • A mobile app using the OAuth authorization code grant adds a one-time code verifier and its hashed challenge to the flow. Which attack does this extension (PKCE) mitigate? RFC 7636, Abstract
  • A plant must send process data to the corporate network, but nothing may ever flow back into the control network. Which device enforces that in hardware? NIST glossary, "data diode" (SP 800-82r3)
  • A platform team wants servers to obtain and renew their TLS certificates with no human in the loop, including proof of control over each domain name. Which protocol automates this? RFC 8555, Abstract
  • A running container is found to have a vulnerable library. How does NIST SP 800-190 say the fix should be delivered? NIST SP 800-190, section 2.1
  • A site wants browsers to refuse plain HTTP to it and to connect only over secure connections from now on. Which mechanism declares that policy? RFC 6797, Abstract
  • A tenant leaves a cloud service. Which term names the residual information that could remain on the provider's storage media after it has been cleared? NIST glossary, "remanence" (CNSSI 4009-2022)
  • A web server includes a recent, signed OCSP response for its own certificate in the TLS handshake, so the browser need not contact the CA. Which TLS extension requests this? RFC 6066, section 8, and RFC 6961
  • A zero trust design places individual resources, or small groups of them, on their own network segments, each protected by a gateway security component. Which approach in NIST SP 800-207 is this? NIST SP 800-207, section 3.1.2
  • An API issues access tokens that work only when presented over a TLS connection made with the same client certificate that requested them. What does RFC 8705 call these? RFC 8705, Abstract
  • An architect deliberately runs two different operating systems and two firewall vendors on critical paths so that one flaw cannot take out both. Which cyber resiliency technique is this? NIST SP 800-160 Vol. 2 Rev. 1, section 2.1.3
  • In a container platform, which service lets developers store images as they are created, tag and catalog them, and download images others have made? NIST glossary, "registry" (SP 800-190)
  • In attribute-based access control, which component retrieves the attributes or other data that the decision point needs? NIST SP 800-162, section 2.4.3
  • In NIST SP 800-207, which component is responsible for enabling, monitoring and eventually terminating connections between a subject and an enterprise resource? NIST SP 800-207, section 3
  • In the NIST zero trust model, which component establishes or shuts down the communication path between a subject and a resource by sending commands to the enforcement points? NIST SP 800-207, section 3
  • NIST defines cyber resiliency as the ability to do four things in the face of adverse conditions, attacks or compromises. Which list is correct? NIST glossary, "cyber resiliency" (SP 800-172r3)
  • Remote laptops must not reach the internet directly while they are connected to the corporate VPN. Which practice does NIST SP 800-53 enhancement SC-7(7) tell organizations to prevent? NIST SP 800-53 Rev. 5, control SC-7(7)
  • Two companies merge and want each PKI to trust certificates from the other without rebuilding either hierarchy. What does one CA issue to the other? NIST glossary, "cross-certificate" (CNSSI 4009-2022)
  • Virtual desktops are destroyed at logoff and rebuilt from a clean image at the next logon, so an implant cannot survive. Which cyber resiliency technique is this? NIST SP 800-160 Vol. 2 Rev. 1, section 2.1.3
  • What does authentication at NIST authentication assurance level 3 (AAL3) require? NIST SP 800-63B-4, section 1
  • What does NIST SP 800-207 call the process the policy engine uses to ultimately grant or deny access to a resource? NIST SP 800-207, section 3.3
  • What is a JSON Web Token (JWT)? RFC 7519, Abstract
  • Which container platform component pulls images from registries, deploys them into containers and manages the running containers? NIST glossary, "orchestrator" (SP 800-190)
  • Which controlled interface provides the ability to access and transfer information between different security domains, manually or automatically? NIST glossary, "cross-domain solution" (CNSSI 4009-2022)
  • Which hardware-enabled capability isolates and processes encrypted data in memory, protecting data in use from other workloads and from the underlying platform? NIST glossary, "confidential computing" (NISTIR 8320)
  • Which NIST SP 800-53 control calls for subnetworks for publicly accessible system components that are separated from internal organizational networks? NIST SP 800-53 Rev. 5, control SC-7
  • Which system publicly logs TLS certificates when they are issued or observed, so that anyone can audit certificate authority activity and notice suspect certificates? RFC 6962, Abstract

Security engineering 34

  • A build pipeline scans source code for common flaws without running the program. Which testing method is this? NIST SP 800-53 Rev. 5, control SA-11(1)
  • A code review tool tags a finding "CWE-89". What does the Common Weakness Enumeration identify? NIST glossary, "Common Weakness Enumeration" (NISTIR 8011 Vol. 4)
  • A data-encryption key is itself encrypted under a key-encryption key before it is stored, in a way that protects both its secrecy and its integrity. What is this called? NIST glossary, "key wrapping" (SP 800-57 Part 1 Rev. 5)
  • A key management policy states how long each data-encryption key may be used before it must be replaced. What is that time span called? NIST glossary, "cryptoperiod" (SP 800-57 Part 1 Rev. 5)
  • A login protocol lets a user convince the server that she knows a secret without revealing anything else about it. Which cryptographic technique is this? NIST glossary, "zero-knowledge proof" (NISTIR 8301)
  • A passkey can be copied by its provider to the user's other devices. What does NIST SP 800-63B-4 call an authenticator whose key can be cloned this way? NIST SP 800-63B-4, section 3.1.7.4
  • A password-based key derivation function repeats its underlying function many times to slow down guessing. What minimum iteration count does NIST SP 800-132 recommend? NIST SP 800-132, section 5.2
  • A product is designed so that its cryptographic algorithms can be replaced, for example by post-quantum ones, while operations continue. Which capability is this? NIST glossary, "crypto agility" (NIST CSWP 39)
  • A root signing key is divided into several shares, held by different officers, and no single share reveals anything about the key. What is this protection called? NIST glossary, "split knowledge"
  • A scanner reports the product name "cpe:2.3:o:..." for an operating system. What is the Common Platform Enumeration for? NIST glossary, "Common Platform Enumeration" (SP 800-128)
  • A server image is configured to provide only mission-essential capabilities, with unneeded functions, ports, protocols and services prohibited. Which principle is being applied? NIST SP 800-53 Rev. 5, control CM-7
  • A server signs a set of boot measurements held in hardware, and a remote verifier checks the signature and the measurements before trusting the server. What is this process called? NIST glossary, "attestation" (SP 1800-19B)
  • A team wants to enable TLS 1.3 zero round-trip (0-RTT) early data for speed. Which weakness of early data must the application design account for? RFC 8446, section 2.3
  • A web application delegates sign-in to an identity provider and receives an ID token about the user. Which standard is described as a simple identity layer on top of OAuth 2.0? OpenID Connect Core 1.0, Abstract
  • AES in Galois/Counter Mode is chosen for a storage service. Which two protections does GCM give in one operation? NIST SP 800-38D, section 3
  • An architect needs a NIST-standardized post-quantum algorithm for two parties to establish a shared secret key over a public channel. Which one is it? FIPS 203, Abstract
  • Before any firmware update is installed, the device verifies a digital signature on it. Which NIST SP 800-53 enhancement describes this? NIST SP 800-53 Rev. 5, control SI-7(15)
  • CVSS version 3.1 is made up of three metric groups. Which are they? FIRST, CVSS v3.1 Specification Document, Abstract
  • CVSS version 4.0 changed the metric groups. Which list is correct for v4.0? FIRST, CVSS v4.0 Specification Document, Abstract
  • FIPS 205 standardizes SLH-DSA. What kind of signature scheme is it? FIPS 205, Abstract
  • In a CVSS v3.1 vector, Attack Vector is rated "A" (Adjacent). What does that mean about how the flaw can be exploited? FIRST, CVSS v3.1 Specification Document, section 2.1.1
  • In Kerberos, which credential does a client obtain first and then present to get tickets for individual services? RFC 4120, section 1.1
  • In SCAP, which language is used to specify security checklists and to report the results of evaluating them? NIST glossary, "Extensible Configuration Checklist Description Format" (SP 800-128)
  • In which key-establishment procedure is the resulting key a function of information contributed by both parties, so that neither can decide its value alone? NIST glossary, "key agreement" (SP 800-152)
  • The NIST Secure Software Development Framework groups its practices in four sets. Which set covers finding residual vulnerabilities in released software and responding to them? NIST SP 800-218, section 2
  • NIST SP 800-193 builds platform firmware resiliency on three principles. Which are they? NIST SP 800-193, Executive Summary
  • What does NIST call an inherently trusted combination of hardware and firmware that maintains the integrity of information? NIST glossary, "hardware root of trust" (SP 1800-19B)
  • What does NIST SP 800-147 require of a BIOS update before it is written to the system flash? NIST SP 800-147, section 3.1.1
  • Which kind of key is generated for each execution of a key-establishment process, so that it is unique to one session? NIST glossary, "ephemeral key" (SP 800-57 Part 2 Rev. 1)
  • Which NIST standard specifies ML-DSA, the module-lattice-based digital signature algorithm meant to stay secure against quantum computers? FIPS 204, Abstract
  • Which SCAP language specifies the low-level testing procedures that checklists use to examine a system's state? NIST glossary, "Open Vulnerability and Assessment Language" (SP 800-128)
  • Which SCAP specification gives unique, common identifiers to configuration settings, such as a minimum password length setting? NIST glossary, "Common Configuration Enumeration" (SP 800-128)
  • Why do all public-key key exchanges in TLS 1.3 provide forward secrecy? RFC 8446, section 1.2
  • Workstations in a control room run only software on an approved list; anything else is blocked from executing. Which policy does NIST SP 800-53 enhancement CM-7(5) describe? NIST SP 800-53 Rev. 5, control CM-7(5)

Security operations 22

  • A chatbot follows hidden instructions that an attacker planted in a web page it was asked to summarize. Which attack on AI systems does NIST describe this way? NIST glossary, "prompt injection" (NIST AI 100-2e2025)
  • A malware analyst writes rules made of strings and a boolean condition to identify and classify samples of one malware family. Which tool uses such rules? YARA documentation, introduction
  • A port scan produces ten thousand near-identical firewall log entries. Which technique consolidates them into a single entry with a count of occurrences? NIST SP 800-92, section 3.2
  • A program checks a file's permissions and then opens the file, and an attacker swaps the file in between. Which weakness is this? MITRE CWE-367, Time-of-check Time-of-use (TOCTOU) Race Condition
  • A scan shows that a government web server still accepts SSL 3.0 connections. What does NIST SP 800-52 Rev. 2 say about SSL 2.0 and SSL 3.0? NIST SP 800-52 Rev. 2, section 3.1
  • A SIEM links a firewall deny, a VPN login and a file server alert into one incident because they share an address and a time window. What is this function called? NIST SP 800-92, section 3.2
  • A threat report arrives marked TLP:RED. Under the FIRST Traffic Light Protocol, who may the recipient share it with? FIRST, Traffic Light Protocol (TLP) version 2.0
  • A utility wants to exchange threat indicators with other companies in its sector. Which of these does NIST SP 800-150 name as a potential sharing partner? NIST SP 800-150, section 3.5
  • A web application fetches any URL that a user supplies, and an attacker uses it to reach an internal metadata service that the attacker cannot reach directly. Which weakness is this? MITRE CWE-918, Server-Side Request Forgery (SSRF)
  • After an outage is fixed, a team uses a principle-based, systems approach to identify the underlying causes behind it, not just the symptom. What is this called? NIST glossary, "root cause analysis" (SP 800-30 Rev. 1)
  • An adversary slips mislabeled samples into the data set that a detection model will be trained on. Which attack is this? NIST glossary, "data poisoning" (NIST AI 100-2e2025)
  • An endpoint tool designed to detect a known malware family scans an infected host and reports it clean. What is this outcome called? NIST glossary, "false negative" (SP 800-83 Rev. 1)
  • An IDPS compares each observed protocol exchange with vendor-developed profiles of how the protocol should behave in each state, and flags deviations. Which detection method is this? NIST SP 800-94, section 2.3.3
  • Before analysis, an examiner makes a bit-for-bit reproduction of a suspect drive and verifies it with a hash. What is the reproduction called? NIST glossary, "forensic copy" (SP 800-72)
  • By sending many queries to a hosted model and studying the answers, a competitor reconstructs details of its architecture and parameters. Which attack is this? NIST glossary, "model extraction" (NIST AI 100-2e2025)
  • In the phrase tactics, techniques and procedures (TTPs), which term is the highest-level description of an actor's behavior? NIST glossary, "tactics, techniques, and procedures" (SP 800-150)
  • Logs arrive from many products, each with its own date and field formats. Which processing step converts each field to one consistent representation and category? NIST SP 800-92, section 3.2
  • NIST SP 800-61 Rev. 3 maps incident response to the Cybersecurity Framework. Which three CSF Functions cover discovering, managing and recovering from incidents? NIST SP 800-61r3, Executive Summary
  • NIST SP 800-86 describes the forensic process in four phases. Which phase comes first? NIST SP 800-86, Executive Summary
  • Two security teams want to exchange threat intelligence in a common machine-readable form. Which standard is a language and format of serialization for that? OASIS CTI TC, Introduction to STIX
  • What does NIST call a technical artifact or observable that suggests an attack is imminent or under way, or that a compromise may already have occurred? NIST glossary, "indicator" (SP 800-150)
  • Which standard is an application protocol for exchanging cyber threat intelligence over HTTPS, defining collections and channels as its services? OASIS CTI TC, Introduction to TAXII

How this list was compiled: Own questions, written to the four domains and weights of CompTIA's SecurityX exam CAS-005 (version 5; CompTIA's page says SecurityX was formerly known as CASP+) as CompTIA publishes them at https://www.comptia.org/en-us/certifications/securityx/ (read 2026-10-06). Facts were read on 2026-10-06 in public texts: NIST FIPS and Special Publications, the Cybersecurity Framework 2.0, the AI Risk Management Framework and the NIST glossary at csrc.nist.gov, IETF RFCs on rfc-editor.org, the CVSS v3.1 and v4.0 specifications and the Traffic Light Protocol on first.org, MITRE's ATT&CK, CAPEC and CWE sites, the OASIS introductions to STIX and TAXII, the YARA documentation, OpenID Connect Core 1.0, OWASP's Threat Modeling Process page and Regulation (EU) 2016/679 on EUR-Lex. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a CompTIA exam, a released or sample question, or another practice product.

How it works

This unofficial CASP practice test has 105 of our own questions on the four domains of exam CAS-005. It is not affiliated with CompTIA, and nothing here is taken from the real exam.

Read the full guide

What the SecurityX exam asks

CompTIA's SecurityX page, read on October 6, 2026, lists exam CAS-005 (version 5) with four domains: governance, risk and compliance 20%, security architecture 27%, security engineering 31% and security operations 22%.

How this bank differs from Security+

CompTIA describes SecurityX as an advanced certification meant for senior security engineers and security architects. So the questions lean on NIST's Risk Management Framework, zero trust architecture, the post-quantum standards FIPS 203 to 205, SCAP, CVSS and threat intelligence formats. Performance-based tasks are not in the bank.

  • ML-KEM (FIPS 203) establishes keys; ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) sign.
  • CVSS v3.1 has Base, Temporal and Environmental metric groups; v4.0 has Base, Threat, Environmental and Supplemental.
  • The RMF steps in order: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor (NIST SP 800-37 Rev. 2).

Questions and answers

Is CASP+ the same as SecurityX?

CompTIA's page says SecurityX was formerly known as CASP+. The exam it lists is CAS-005, version 5, launched December 17, 2024, and this bank follows that exam's objectives.

What is the passing score for CASP+?

CompTIA's page says SecurityX is pass or fail only, with no scaled score. Exam mode here reports your percent right in each domain and makes no pass or fail call.

How many questions are on the CASP+ exam?

CompTIA gives a maximum of 90, multiple-choice and performance-based, in up to 165 minutes. Exam mode here draws 90 multiple-choice questions on a 165-minute clock.

More tests

Show 7 more

Browse Safety and Trades