CAS-004 Governance, Risk, and Compliance — 40 Questions

Question 1

An organization is implementing a privacy program in accordance with GDPR. Which TWO of the following are data subject rights under GDPR? (Select TWO.)

Accepted Answer

Right to data portability. GDPR grants data subjects rights including the right to data portability (to receive personal data in a structured, commonly used format) and the right to rectification (to correct inaccurate personal data). While other rights like the right to be forgotten and right to be informed exist, only two correct options are required. Right to transfer is not a formal GDPR right.

Answer

Right to transfer

Answer

Right to be informed

Answer

Right to be forgotten

Question 2

A security analyst is calculating the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $5,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$1,000. ALE = SLE × ARO = $5,000 × 0.2 = $1,000.

Answer

$0

Answer

$5,200

Answer

$25,000

Question 3

A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?

Accepted Answer

Incorporating privacy controls during the initial system architecture. Privacy by design integrates privacy into the system design from the start, not as an afterthought.

Answer

Encrypting data at rest only

Answer

Performing an annual privacy audit

Answer

Providing privacy training to employees

Question 4

A financial institution is required to comply with SOX. Which of the following is a primary focus of this regulation?

Accepted Answer

Accuracy of financial reporting and internal controls. SOX focuses on financial reporting accuracy and internal controls over financial reporting.

Answer

Privacy of personal data for EU citizens

Answer

Security of health information

Answer

Protection of cardholder data

Question 5

An organization has identified a vulnerability in a legacy system that cannot be patched. The system is critical for operations, and the cost of mitigating the vulnerability exceeds the potential loss. Which risk treatment option is most appropriate?

Accepted Answer

Risk acceptance. Risk acceptance is chosen when the cost of mitigation exceeds the potential loss and the risk is within risk appetite.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 6

A security manager is evaluating two risk quantification approaches: Factor Analysis of Information Risk (FAIR) and a qualitative heat map. Which of the following is a key advantage of using FAIR over the qualitative heat map?

Accepted Answer

FAIR provides a monetary value for risk, enabling ROI calculations. FAIR provides a more rigorous, quantitative analysis that enables cost-benefit analysis, unlike qualitative methods.

Answer

FAIR is the only framework recognized by NIST

Answer

FAIR is easier to communicate to non-technical stakeholders

Answer

FAIR requires less data and expertise to implement

Question 7

During a vendor risk assessment, a company receives a SOC 2 Type II report from a cloud service provider. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period of time. SOC 2 Type II reports on the effectiveness of controls over a period of time.

Answer

The vendor's financial stability

Answer

The vendor's compliance with privacy laws

Answer

The vendor's penetration test results

Question 8

An organization is implementing continuous compliance monitoring. Which of the following metrics would best indicate whether the organization is maintaining compliance with PCI DSS Requirement 10 (log management)?

Accepted Answer

Percentage of systems with centralized logging enabled. PCI DSS Requirement 10 requires tracking and monitoring access to network resources and cardholder data. Log coverage percentage directly measures whether all necessary systems are logging.

Answer

Number of failed login attempts per day

Answer

Mean time to detect (MTTD) for security incidents

Answer

Vulnerability scan pass rate

Question 9

Which of the following is the correct order of the security policy hierarchy from highest to lowest?

Accepted Answer

Policy → Standard → Guideline → Procedure. The typical hierarchy is Policy (high-level), Standard (mandatory controls), Guideline (recommended), Procedure (step-by-step).

Answer

Standard → Policy → Guideline → Procedure

Answer

Policy → Guideline → Standard → Procedure

Answer

Procedure → Guideline → Standard → Policy

Question 10

A security architect is designing a data classification scheme. Which of the following is the highest level of sensitivity that would typically require the most stringent controls?

Accepted Answer

Restricted. Restricted data is the most sensitive and requires the highest level of protection.

Answer

Public

Answer

Internal

Answer

Confidential

Question 11

An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to audit the vendor's controls and verify compliance.

Answer

Non-disclosure agreement (NDA)

Answer

Service-level agreement (SLA) for uptime

Answer

Data processing agreement (DPA)

Question 12

A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?

Accepted Answer

System categorization. NIST RMF includes a formal step to categorize the information system and information based on impact, which is not explicitly part of ISO 27005's risk assessment process.

Answer

Risk identification

Answer

Risk treatment

Answer

Risk assessment

Question 13

A security team is measuring the effectiveness of its incident response process. Which of the following metrics would best indicate how quickly the team can contain an incident after it is detected?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the time from detection to containment, which is directly relevant to incident response effectiveness.

Answer

Vulnerabilities by severity

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 14

A small business is implementing a privacy impact assessment (PIA) for a new application that processes personal data of EU citizens. Which TWO of the following are required under GDPR?

Accepted Answer

Describe the processing operations and purposes. GDPR requires a PIA when processing is likely to result in high risk to individuals, and the PIA must describe the processing and assess necessity and proportionality.

Answer

Obtain approval from a data protection authority before processing

Answer

Appoint a data protection officer (DPO)

Answer

Publish the PIA on the company website

Question 15

A security manager is selecting key risk indicators (KRIs) for the organization's risk management program. Which THREE of the following are examples of KRIs that can provide early warning of increasing risk?

Accepted Answer

Number of failed login attempts per hour. KRIs measure risk levels and can indicate changes. Unpatched critical vulnerabilities, number of failed login attempts, and percentage of users with privileged access are direct indicators of risk.

Answer

Mean time to detect (MTTD) for incidents

Answer

Percentage of systems with current backups

Question 16

An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?

Accepted Answer

Include a right-to-audit clause that covers subcontractors. To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

Answer

Use only vendors that are SOC 2 certified

Answer

Reduce reliance on vendors by bringing services in-house

Answer

Conduct penetration tests on all fourth parties directly

Question 17

A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an auditor's opinion on the effectiveness of controls over a period, directly addressing the service provider's control environment and compliance with Trust Services Criteria.

Answer

ISO 27001 certificate

Answer

Penetration test report

Answer

Vulnerability scan results

Question 18

An organization is implementing a data classification scheme. Which data type should be given the highest protection and is typically restricted to a very small number of individuals?

Accepted Answer

Restricted. Restricted data is the highest classification, reserved for data that could cause severe damage if disclosed, such as trade secrets or PII, and access is tightly controlled.

Answer

Confidential

Answer

Internal

Answer

Public

Question 19

A security analyst calculates the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$10,000. ALE = SLE × ARO = $50,000 × 0.2 = $10,000.

Answer

$50,200

Answer

$2,500

Answer

$250,000

Question 20

Which risk treatment option involves reducing the likelihood or impact of a risk through controls?

Accepted Answer

Mitigate. Mitigate (or reduce) involves implementing controls to lower risk to an acceptable level.

Answer

Avoid

Answer

Accept

Answer

Transfer