CAS-004 Practice Test 18 — 15 Questions

Question 1

A regional healthcare provider with 2,000 employees recently acquired a smaller clinic that uses a legacy electronic health record (EHR) system. The provider's security team performed a risk assessment and identified that the legacy system does not support encryption at rest, lacks role-based access controls (RBAC), and stores administrative credentials in plaintext. The system is scheduled to be decommissioned in 18 months, but it must remain operational to support patient care during the transition. The provider is subject to HIPAA and state breach notification laws. The CEO wants to avoid any disruption to patient services but also minimize regulatory risk. Which of the following is the BEST course of action?

Accepted Answer

Implement compensating controls such as network segmentation, storage-level encryption, and strict access monitoring.. Option D is the best course of action because it allows the legacy EHR system to remain operational for patient care while reducing regulatory risk. Compensating controls like network segmentation isolate the vulnerable system, storage-level encryption (e.g., BitLocker or LUKS) protects data at rest, and strict access monitoring (e.g., SIEM with real-time alerts) mitigates the lack of RBAC and plaintext credentials. This approach balances the CEO's requirement for no disruption with HIPAA's security rule requirements for reasonable safeguards.

Answer

Accelerate the migration timeline to replace the legacy system within 6 months.

Answer

Immediately disconnect the legacy system from the network and use manual processes.

Answer

Accept the residual risk and document it in the risk register.

Question 2

An organization needs to ensure compliance with GDPR regarding data subject access requests. What is the MOST important control to implement?

Accepted Answer

Implement a process to respond to access requests within one month. Option B is correct because GDPR requires responses to access requests within one month. Option A is wrong while encryption is important, it is not the primary control for access requests. Option C is wrong a DPO is required but not specifically for access requests. Option D is wrong data minimization is a principle but does not directly address access requests.

Answer

Encrypt all personal data at rest and in transit

Answer

Minimize the collection of personal data

Answer

Appoint a Data Protection Officer (DPO)

Question 3

Which TWO are required by PCI DSS for all merchants?

Accepted Answer

Maintain a vulnerability management program. Options A and B are correct. PCI DSS requires encryption of cardholder data at rest (requirement 3) and a vulnerability management program (requirement 6). Tokenization is optional, CVV storage is prohibited, and network segmentation is a recommended control but not a requirement for all merchants.

Answer

Implement network segmentation

Answer

Store CVV codes

Answer

Use only tokenization

Question 4

A security architect is designing a data classification scheme. Which of the following is the MOST effective way to ensure consistent labeling across the organization?

Accepted Answer

Automated classification based on data content.. Option D is correct because automated classification minimizes human error and provides uniform application of labels.

Answer

Implementing DLP solutions.

Answer

Manual labeling by data owners.

Answer

User training and awareness.

Question 5

Which TWO are key metrics used in business continuity planning?

Accepted Answer

Recovery Time Objective (RTO). Options A and B are correct. RTO defines acceptable downtime; RPO defines acceptable data loss. MTBF, MTTR, and SLA are not specifically business continuity metrics.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Question 6

Which THREE of the following are required for PCI DSS compliance regarding cardholder data?

Accepted Answer

Maintain a vulnerability management program.. PCI DSS requires encryption of transmissions (Req 4), access restriction (Req 7), and vulnerability management (Req 6/11). MFA for physical access is not required; data storage after authorization is limited.

Answer

Store cardholder data after authorization.

Answer

Implement multifactor authentication for all physical access to data centers.

Question 7

A security team is adopting the NIST risk management framework. Which step should they perform first?

Accepted Answer

Categorize.. Option D is correct because the NIST RMF requires categorization of the system and data as the initial step to guide subsequent risk management decisions.

Answer

Select.

Answer

Implement.

Answer

Assess.

Question 8

A company is implementing a vendor risk management program. Which THREE of the following should be included in the initial vendor assessment?

Accepted Answer

Financial stability. Financial stability, security incident history, and business continuity plan are key to evaluating vendor risk. Employee training is not typically part of initial assessment; marketing collateral is irrelevant.

Answer

Employee training records

Answer

Marketing collateral

Question 9

During a compliance audit, the auditor finds that several systems are missing security patches. The CISO needs to decide on a risk treatment. Which TWO of the following actions are appropriate?

Accepted Answer

Mitigate with compensating controls. Transferring risk via cyber insurance and mitigating with compensating controls are valid risk treatments. Ignoring findings is not acceptable; immediate patching may not be feasible; decommissioning is extreme.

Answer

Immediately patch all systems

Answer

Ignore the findings until next audit

Answer

Accept the risk formally

Question 10

You are the security architect for a global manufacturing company that has recently experienced a ransomware attack. The attack originated from a third-party vendor's compromised VPN account, which had been granted privileged access to the corporate network for remote maintenance. The vendor is a critical supplier of industrial control system (ICS) components. The incident severely disrupted production for three days. Post-incident analysis reveals that the vendor's security posture was not assessed prior to granting access, and the contract did not include specific security requirements or audit rights. The company now wants to implement a vendor risk management program to prevent future incidents. Which of the following is the MOST comprehensive and effective course of action to address the root cause?

Accepted Answer

Develop a vendor risk management policy that includes security assessments, contractual clauses, and periodic audits. Option C is correct because establishing a formal vendor risk management program with contractual security requirements and periodic audits directly addresses the lack of assessment and oversight. Option A is wrong because network segmentation alone does not enforce vendor compliance. Option B is wrong because MFA is a single control; it does not replace a program. Option D is wrong because instituting background checks does not ensure technical security controls.

Answer

Implement network segmentation to isolate vendor access to specific systems

Answer

Conduct background checks on all vendor personnel before granting access

Answer

Require all vendors to use multi-factor authentication (MFA) for remote access

Question 11

A risk assessment report is being prepared for senior management. Which TWO of the following should be included to effectively communicate risk?

Accepted Answer

Risk register with scores. An executive summary provides high-level findings, and a risk register details identified risks. Other options are operational details not suitable for senior management.

Answer

Remediation deadlines

Answer

Names of employees responsible

Answer

Detailed control configurations

Question 12

Which TWO of the following are essential elements of an effective data governance framework?

Accepted Answer

Data classification policies and procedures. Options B and D are correct. Data classification policies define how data is categorized, and data stewardship assigns ownership. Option A is wrong because encryption is a technical control, not governance. Option C is wrong because data localization is a compliance requirement, not a governance element. Option E is wrong because breach response is operational.

Answer

Mandatory data localization requirements

Answer

Automated breach notification system

Answer

Implementation of full-disk encryption on all endpoints

Question 13

Which THREE of the following are required by the NIST Cybersecurity Framework (CSF) for the 'Protect' function?

Accepted Answer

Performing regular maintenance of systems. Options A, C, and E are correct. Access control (PR.AC), data security (PR.DS), and maintenance (PR.MA) are part of the Protect function. Option B is wrong because 'Respond' is a separate function. Option D is wrong because risk assessment is under 'Identify'.

Answer

Conducting a risk assessment for critical assets

Answer

Developing an incident response plan

Question 14

A company is developing a new mobile app that will process users' biometric data for authentication. The legal team is concerned about compliance with the GDPR's data protection by design. Which of the following is the MOST appropriate control to implement?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) before development.. D is correct. A DPIA is required by GDPR for high-risk processing like biometrics. Consent is important but does not replace the DPIA. Encryption is a technical control but the DPIA is foundational for 'by design'.

Answer

Obtain explicit consent from users before data collection.

Answer

Store biometric data in hashed form on the device.

Answer

Implement strong encryption for data in transit and at rest.

Question 15

Refer to the exhibit. The security team has been asked to remediate the vulnerability before the next PCI DSS audit. Which of the following is the MOST appropriate action?

Accepted Answer

Disable TLS 1.0 and enable TLS 1.2 only. Disabling TLS 1.0 and enabling TLS 1.2 directly addresses the vulnerability and PCI DSS requirement. Compensating controls may not satisfy the audit; accepting risk is not allowed for high severity; moving the host does not fix the issue.

Answer

Move the host to a separate VLAN

Answer

Apply a compensating control such as an API gateway

Answer

Accept the risk because the CVSS score is below 8.0