CAS-004 Governance, Risk, and Compliance Practice Test 1 — 15 Questions

Question 1

A healthcare organization must comply with HIPAA. Which of the following is a key requirement for protecting electronic protected health information (ePHI)?

Accepted Answer

Encryption of ePHI at rest and in transit. HIPAA's Security Rule explicitly requires covered entities to implement encryption of ePHI both at rest and in transit as an addressable implementation specification, and it is widely considered a key safeguard for protecting ePHI. Encryption ensures that even if data is intercepted or a storage medium is compromised, the information remains unreadable without the decryption keys. This directly addresses the confidentiality and integrity requirements of the HIPAA Security Rule.

Answer

Data masking for all patient data

Answer

Annual penetration testing

Answer

Public key infrastructure for all users

Question 2

A security manager is selecting metrics to present to the board. Which two of the following are key risk indicators (KRIs) that would be most relevant for executive oversight? (Choose two.)

Accepted Answer

Number of security incidents per quarter. Option C is correct because the number of security incidents per quarter is a lagging key risk indicator that directly quantifies realized risk exposure, giving the board a trendable measure of how often the organization's risk is materializing. Option E is correct because the percentage of systems with critical vulnerabilities is a leading key risk indicator that reflects the current exploitable attack surface and residual risk posture, which executives need to judge whether risk is within tolerance. These two metrics combine a backward-looking outcome (incidents) with a forward-looking exposure measure (unpatched critical systems), which is exactly what board-level risk oversight requires. Option A (average time to patch) and Option B (MTTD) are operational performance metrics for the security team rather than strategic risk indicators. Option D (training completions) is a compliance/awareness activity metric and does not by itself express risk magnitude or likelihood.

Answer

Average time to patch critical vulnerabilities

Answer

Mean time to detect (MTTD)

Answer

Number of security awareness training completions

Question 3

A security manager is developing key risk indicators (KRIs) for the organization's cybersecurity program. Which THREE of the following are examples of KRIs? (Select THREE.)

Accepted Answer

Number of failed login attempts per day. Option A is correct because the number of failed login attempts per day is a leading indicator that measures the frequency of a potential attack activity, making it a valid KRI. Option D is correct because the number of unpatched critical vulnerabilities is a measurable exposure metric that indicates the organization's current risk posture and is commonly used as a KRI. Option E is correct because the percentage of users without multifactor authentication quantifies a control gap that directly increases account compromise risk, fitting the definition of a KRI. Option B is not a KRI because the total number of security incidents is a lagging outcome metric (a KPI), reflecting events that already occurred rather than an indicator of future risk. Option C is not a KRI because mean time to detect (MTTD) is a performance/efficiency metric of the detection process, not a direct measure of risk exposure or likelihood.

Answer

Total number of security incidents this quarter

Answer

Mean time to detect (MTTD)

Question 4

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $100,000, an exposure factor (EF) of 0.5, and an annualized rate of occurrence (ARO) of 2. What is the ALE?

Accepted Answer

$100,000. The correct answer is $100,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). First, compute SLE = Asset Value × Exposure Factor = $100,000 × 0.5 = $50,000. Then ALE = SLE × ARO = $50,000 × 2 = $100,000. This matches option A.

Answer

$150,000

Answer

$50,000

Answer

$200,000

Question 5

An organization is required to comply with PCI DSS. Which of the following is a mandatory requirement for protecting cardholder data?

Accepted Answer

Encrypting cardholder data at rest. PCI DSS requires that cardholder data be encrypted when stored (at rest) as a mandatory requirement to protect it from unauthorized access. While other practices like network segmentation and MFA are important, encryption of stored cardholder data is explicitly required by PCI DSS Requirement 3.

Answer

Conducting annual risk assessments

Answer

Using a dedicated network segment for card processing

Answer

Implementing multi-factor authentication for all users

Question 6

A security architect is designing a data classification scheme. Which TWO of the following are commonly used classification levels? (Select TWO.)

Accepted Answer

Confidential. Option B (Confidential) is correct because it is one of the standard classification levels used in both government and commercial data classification schemes, typically denoting information whose unauthorized disclosure could cause damage to an organization. Option D (Public) is correct because it is a widely used classification level indicating information that is approved for release to anyone and requires no special protection. The other options, while related to information handling, are not among the commonly cited baseline classification levels in the typical four-tier model (Public, Internal, Confidential, Restricted); for example, Unclassified, For Official Use Only, and Top Secret are government-specific markings or caveats rather than the general-purpose classification levels referenced in most frameworks.

Answer

Unclassified

Answer

For Official Use Only

Answer

Top Secret

Question 7

A security manager is reviewing the company's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The correct hierarchy from highest to lowest authority is Policy, Standard, Guideline, Procedure. Policies are management's high-level mandatory statements of intent; standards are mandatory specific requirements that support policy; guidelines are non-mandatory recommendations; procedures are step-by-step instructions that implement standards.

Answer

Standard, Policy, Procedure, Guideline

Answer

Policy, Guideline, Standard, Procedure

Answer

Procedure, Guideline, Standard, Policy

Question 8

A security team is selecting key risk indicators (KRIs) for the organization's cybersecurity program. Which of the following is an example of a KRI that provides a leading indicator of risk?

Accepted Answer

Number of unpatched critical vulnerabilities. A leading indicator of risk predicts future risk exposure rather than reporting past events. The number of unpatched critical vulnerabilities is a leading indicator because it represents current exposure that could lead to future incidents. MTTD, incident counts, and antivirus coverage are lagging or current-state metrics.

Answer

Mean time to detect (MTTD) for security incidents

Answer

Number of security incidents reported last month

Answer

Percentage of systems with antivirus installed

Question 9

A company is adopting the NIST Risk Management Framework (RMF). Which step in the RMF involves selecting security controls based on the risk assessment?

Accepted Answer

Select. The NIST RMF step 'Select' (Step 2) is where security controls are chosen based on the risk assessment from the Categorize step. After categorizing the system (low, moderate, high impact), the organization selects an initial set of controls from NIST SP 800-53, tailors them, and documents them in the system security plan. This directly addresses the question's requirement of selecting controls based on risk.

Answer

Categorize

Answer

Assess

Answer

Implement

Question 10

A security analyst is evaluating security metrics for the security program. Which TWO of the following are considered key performance indicators (KPIs) for measuring the effectiveness of a security program?

Accepted Answer

Patch compliance percentage. Option C (Patch compliance percentage) is a KPI because it directly measures how effectively the security program enforces remediation of known vulnerabilities across the environment, expressed as the proportion of systems meeting patching requirements within defined timeframes. Option E (Mean time to respond (MTTR) to incidents) is a KPI because it quantifies the operational effectiveness of the incident response process, showing how quickly the security team detects and reacts to incidents, which reflects program maturity and resilience. In contrast, option A (Employee satisfaction score) is a human-resources or morale metric, not a direct measure of security program performance. Option B (Number of critical vulnerabilities identified) is a raw volume or activity metric rather than a performance indicator of effectiveness, since a high count could reflect better detection rather than weaker security. Option D (Total budget spent on security) is a cost or resource input metric, not an outcome-based KPI of security effectiveness.

Answer

Employee satisfaction score

Answer

Number of critical vulnerabilities identified

Answer

Total budget spent on security

Question 11

A security manager is reviewing the organization's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest level of authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The correct hierarchy of security documentation, from highest to lowest authority, is Policy, Standard, Guideline, Procedure. Policies are high-level management directives that mandate what must be done. Standards are mandatory requirements that support policies by specifying uniform technical or operational rules. Guidelines are non-mandatory recommendations that provide best practices. Procedures are detailed step-by-step instructions for performing specific tasks, derived from policies and standards. This order reflects the typical governance structure where policies set direction, standards enforce specifics, guidelines offer flexibility, and procedures provide operational detail.

Answer

Guideline, Policy, Procedure, Standard

Answer

Standard, Policy, Procedure, Guideline

Answer

Procedure, Guideline, Standard, Policy

Question 12

A security architect is designing a data classification scheme. Which classification level should be used for data that, if disclosed, could cause serious damage to the organization's reputation or financial standing?

Accepted Answer

Restricted. 'Restricted' is the classification level reserved for the organization's most sensitive data — typically regulated data (PII, PHI, PCI), trade secrets, or intellectual property whose disclosure would cause severe reputational, financial, or legal damage. Serious damage to reputation or financial standing is the classic definition of the Restricted tier in most data classification schemes.

Answer

Confidential

Answer

Public

Answer

Internal

Question 13

A healthcare organization is implementing a vendor risk management program. Which THREE of the following should be included in the vendor risk assessment process? (Select THREE.)

Accepted Answer

Reviewing the vendor's SOC 2 Type II report. Option C is correct because a SOC 2 Type II report provides independent attestation that the vendor's controls operated effectively over a period of time (typically 3-12 months), which is essential evidence for assessing a healthcare vendor's security posture. Option D is correct because conducting a penetration test of the vendor's environment actively validates the effectiveness of their technical controls by simulating real-world attacks, going beyond documentation-based assurances. Option E is correct because a security questionnaire (such as a SIG or CAIQ) gathers detailed information about the vendor's security practices, policies, and compliance posture, forming a foundational part of any vendor risk assessment. Option A is not included because requiring cyber insurance is a risk transfer mechanism, not an assessment activity, and does not evaluate the vendor's actual security controls. Option B is not included because reviewing financial statements addresses the vendor's financial stability and business continuity risk, not the security-focused risk assessment process described.

Answer

Requiring the vendor to purchase cyber insurance

Answer

Reviewing the vendor's financial statements

Question 14

A security analyst is defining key risk indicators (KRIs) for the security program. Which TWO of the following are examples of KRIs? (Select TWO.)

Accepted Answer

Number of unpatched critical vulnerabilities. Option D is correct because the number of unpatched critical vulnerabilities is a measurable, outcome-based metric that directly reflects the current level of exploitable risk exposure in the environment, making it a valid KRI. Option E is correct because the number of security incidents reported in the last quarter is a lagging indicator of realized risk and is commonly used as a KRI to track incident frequency and program effectiveness over time. Option A is not a KRI but rather a compliance or training completion metric (a key performance indicator of the awareness program), not a direct measure of risk. Option B, time to patch critical systems, is a process efficiency or performance metric (KPI) describing remediation speed rather than a risk indicator itself. Option C, budget spent on security tools, is a financial/resource utilization metric and does not measure risk exposure or security posture.

Answer

Percentage of employees who completed security awareness training

Answer

Time to patch critical systems

Answer

Budget spent on security tools

Question 15

An organization is implementing a privacy program in accordance with GDPR. Which TWO of the following are data subject rights under GDPR? (Select TWO.)

Accepted Answer

Right to data portability. GDPR grants data subjects rights including the right to data portability (to receive personal data in a structured, commonly used format) and the right to rectification (to correct inaccurate personal data). While other rights like the right to be forgotten and right to be informed exist, only two correct options are required. Right to transfer is not a formal GDPR right.

Answer

Right to transfer

Answer

Right to be informed

Answer

Right to be forgotten