CAS-004 Governance, Risk, and Compliance — 10 Questions

Question 1

A healthcare organization must comply with HIPAA. Which of the following is a key requirement for protecting electronic protected health information (ePHI)?

Accepted Answer

Encryption of ePHI at rest and in transit. HIPAA's Security Rule explicitly requires covered entities to implement encryption of ePHI both at rest and in transit as an addressable implementation specification, and it is widely considered a key safeguard for protecting ePHI. Encryption ensures that even if data is intercepted or a storage medium is compromised, the information remains unreadable without the decryption keys. This directly addresses the confidentiality and integrity requirements of the HIPAA Security Rule.

Answer

Data masking for all patient data

Answer

Annual penetration testing

Answer

Public key infrastructure for all users

Question 2

A security manager is selecting metrics to present to the board. Which two of the following are key risk indicators (KRIs) that would be most relevant for executive oversight? (Choose two.)

Accepted Answer

Number of security incidents per quarter. Option C is correct because the number of security incidents per quarter is a lagging key risk indicator that directly quantifies realized risk exposure, giving the board a trendable measure of how often the organization's risk is materializing. Option E is correct because the percentage of systems with critical vulnerabilities is a leading key risk indicator that reflects the current exploitable attack surface and residual risk posture, which executives need to judge whether risk is within tolerance. These two metrics combine a backward-looking outcome (incidents) with a forward-looking exposure measure (unpatched critical systems), which is exactly what board-level risk oversight requires. Option A (average time to patch) and Option B (MTTD) are operational performance metrics for the security team rather than strategic risk indicators. Option D (training completions) is a compliance/awareness activity metric and does not by itself express risk magnitude or likelihood.

Answer

Average time to patch critical vulnerabilities

Answer

Mean time to detect (MTTD)

Answer

Number of security awareness training completions

Question 3

A security manager is developing key risk indicators (KRIs) for the organization's cybersecurity program. Which THREE of the following are examples of KRIs? (Select THREE.)

Accepted Answer

Number of failed login attempts per day. Option A is correct because the number of failed login attempts per day is a leading indicator that measures the frequency of a potential attack activity, making it a valid KRI. Option D is correct because the number of unpatched critical vulnerabilities is a measurable exposure metric that indicates the organization's current risk posture and is commonly used as a KRI. Option E is correct because the percentage of users without multifactor authentication quantifies a control gap that directly increases account compromise risk, fitting the definition of a KRI. Option B is not a KRI because the total number of security incidents is a lagging outcome metric (a KPI), reflecting events that already occurred rather than an indicator of future risk. Option C is not a KRI because mean time to detect (MTTD) is a performance/efficiency metric of the detection process, not a direct measure of risk exposure or likelihood.

Answer

Total number of security incidents this quarter

Answer

Mean time to detect (MTTD)

Question 4

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $100,000, an exposure factor (EF) of 0.5, and an annualized rate of occurrence (ARO) of 2. What is the ALE?

Accepted Answer

$100,000. The correct answer is $100,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). First, compute SLE = Asset Value × Exposure Factor = $100,000 × 0.5 = $50,000. Then ALE = SLE × ARO = $50,000 × 2 = $100,000. This matches option A.

Answer

$150,000

Answer

$50,000

Answer

$200,000

Question 5

An organization is required to comply with PCI DSS. Which of the following is a mandatory requirement for protecting cardholder data?

Accepted Answer

Encrypting cardholder data at rest. PCI DSS requires that cardholder data be encrypted when stored (at rest) as a mandatory requirement to protect it from unauthorized access. While other practices like network segmentation and MFA are important, encryption of stored cardholder data is explicitly required by PCI DSS Requirement 3.

Answer

Conducting annual risk assessments

Answer

Using a dedicated network segment for card processing

Answer

Implementing multi-factor authentication for all users

Question 6

A security architect is designing a data classification scheme. Which TWO of the following are commonly used classification levels? (Select TWO.)

Accepted Answer

Confidential. Option B (Confidential) is correct because it is one of the standard classification levels used in both government and commercial data classification schemes, typically denoting information whose unauthorized disclosure could cause damage to an organization. Option D (Public) is correct because it is a widely used classification level indicating information that is approved for release to anyone and requires no special protection. The other options, while related to information handling, are not among the commonly cited baseline classification levels in the typical four-tier model (Public, Internal, Confidential, Restricted); for example, Unclassified, For Official Use Only, and Top Secret are government-specific markings or caveats rather than the general-purpose classification levels referenced in most frameworks.

Answer

Unclassified

Answer

For Official Use Only

Answer

Top Secret

Question 7

A security manager is reviewing the company's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The correct hierarchy from highest to lowest authority is Policy, Standard, Guideline, Procedure. Policies are management's high-level mandatory statements of intent; standards are mandatory specific requirements that support policy; guidelines are non-mandatory recommendations; procedures are step-by-step instructions that implement standards.

Answer

Standard, Policy, Procedure, Guideline

Answer

Policy, Guideline, Standard, Procedure

Answer

Procedure, Guideline, Standard, Policy

Question 8

A security team is selecting key risk indicators (KRIs) for the organization's cybersecurity program. Which of the following is an example of a KRI that provides a leading indicator of risk?

Accepted Answer

Number of unpatched critical vulnerabilities. A leading indicator of risk predicts future risk exposure rather than reporting past events. The number of unpatched critical vulnerabilities is a leading indicator because it represents current exposure that could lead to future incidents. MTTD, incident counts, and antivirus coverage are lagging or current-state metrics.

Answer

Mean time to detect (MTTD) for security incidents

Answer

Number of security incidents reported last month

Answer

Percentage of systems with antivirus installed

Question 9

A company is adopting the NIST Risk Management Framework (RMF). Which step in the RMF involves selecting security controls based on the risk assessment?

Accepted Answer

Select. The NIST RMF step 'Select' (Step 2) is where security controls are chosen based on the risk assessment from the Categorize step. After categorizing the system (low, moderate, high impact), the organization selects an initial set of controls from NIST SP 800-53, tailors them, and documents them in the system security plan. This directly addresses the question's requirement of selecting controls based on risk.

Answer

Categorize

Answer

Assess

Answer

Implement

Question 10

A security analyst is evaluating security metrics for the security program. Which TWO of the following are considered key performance indicators (KPIs) for measuring the effectiveness of a security program?

Accepted Answer

Patch compliance percentage. Option C (Patch compliance percentage) is a KPI because it directly measures how effectively the security program enforces remediation of known vulnerabilities across the environment, expressed as the proportion of systems meeting patching requirements within defined timeframes. Option E (Mean time to respond (MTTR) to incidents) is a KPI because it quantifies the operational effectiveness of the incident response process, showing how quickly the security team detects and reacts to incidents, which reflects program maturity and resilience. In contrast, option A (Employee satisfaction score) is a human-resources or morale metric, not a direct measure of security program performance. Option B (Number of critical vulnerabilities identified) is a raw volume or activity metric rather than a performance indicator of effectiveness, since a high count could reflect better detection rather than weaker security. Option D (Total budget spent on security) is a cost or resource input metric, not an outcome-based KPI of security effectiveness.

Answer

Employee satisfaction score

Answer

Number of critical vulnerabilities identified

Answer

Total budget spent on security