CAS-004 Governance, Risk, and Compliance Practice Test 10 — 15 Questions

Question 1

A mid-sized retailer wants to demonstrate to customers that its payment card handling meets industry security requirements. The company does not store, process, or transmit cardholder data; it only uses a validated third-party payment page that handles all card data. Which PCI DSS self-assessment questionnaire is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAQ A. PCI DSS self-assessment questionnaire eligibility depends on how cardholder data is handled. A merchant that completely outsources card data functions to a validated third party and never stores, processes, or transmits the data qualifies for SAQ A. The other questionnaires apply to environments with direct card data handling, standalone IP terminals, or validated point-to-point encryption solutions.

Answer

SAQ D for Merchants

Answer

SAQ B-IP

Answer

SAQ P2PE

Question 2

A company's security team is reviewing its risk register. A risk related to an outdated internal application has been assigned an owner, but the owner has taken no action for two quarters. The Chief Information Security Officer wants to ensure the risk is tracked and escalated appropriately. Which action should the security team take first?

Accepted Answer

Escalate the overdue risk to the risk owner's management and the risk committee with the current status. The security team should escalate the overdue risk to the owner's management and the risk committee with current status. Escalation preserves accountability, keeps the risk visible, and forces a timely treatment decision by those with authority. Accepting, deleting, or unilaterally transferring the risk would bypass governance and hide the exposure rather than manage it, which is why escalation is the correct first action.

Answer

Immediately accept the risk on behalf of the business owner to close the item

Answer

Remove the risk from the register because the owner has implicitly accepted it by doing nothing

Answer

Transfer the risk to an insurance carrier and mark the register item as resolved

Question 3

A security architect is designing a new cloud-native application for a healthcare provider. The application will process protected health information (PHI) and must comply with HIPAA. The architect must ensure that all data at rest and in transit is encrypted, and that access is logged and auditable. Which of the following controls BEST meets the requirement for auditing access to PHI?

Accepted Answer

Implement application-level logging that records user identity, timestamp, and the specific PHI records accessed, and store logs securely.. HIPAA's Security Rule requires audit controls that record and examine activity in systems containing ePHI. Application-level logging that captures user identity, timestamp, and the specific PHI accessed provides the necessary audit trail. Other controls like CloudTrail, AWS Config, or WAFs address different aspects of security but do not provide the granular access auditing required for PHI.

Answer

Use AWS Config to monitor resource configurations and alert on changes to security groups.

Answer

Deploy a web application firewall (WAF) to log all incoming HTTP requests and block malicious traffic.

Answer

Enable AWS CloudTrail to log all API activity and store logs in an immutable S3 bucket.

Question 4

A global pharmaceutical company must comply with the EU GDPR for clinical trial data. The Data Protection Officer is reviewing the data protection impact assessment (DPIA) process. Which of the following situations requires a DPIA under GDPR?

Accepted Answer

Conducting a clinical trial that involves large-scale processing of genetic data and health data.. A DPIA is mandatory under GDPR when processing is likely to result in a high risk to data subjects, particularly when it involves large-scale processing of special categories of data such as genetic and health data. Clinical trials often involve such data and are conducted on a large scale, making a DPIA a legal requirement. Other scenarios described are routine and low risk, so they do not trigger the mandatory DPIA.

Answer

Collecting employee emergency contact information for HR records.

Answer

Processing personal data for routine patient billing using a standard software platform.

Answer

Using CCTV cameras in a single office lobby for physical security.

Question 5

A multinational retailer must transfer employee personal data from its European Union subsidiary to a processing center in a country without an adequacy decision. Legal counsel wants a transfer mechanism that imposes enforceable data protection obligations on the importer and includes a documented transfer impact assessment. Which mechanism best matches these requirements?

Accepted Answer

Standard Contractual Clauses supplemented by a transfer impact assessment and additional safeguards. Cross-border transfers outside an adequacy decision require a valid Chapter V mechanism. Standard Contractual Clauses impose enforceable obligations on the importer, and following Schrems II they must be accompanied by a transfer impact assessment and supplementary measures where destination laws undermine protection. Consent, codes of conduct, and improperly approved Binding Corporate Rules do not meet the combined contractual and assessment requirements described.

Answer

An explicit consent obtained from each employee once at the time of hire for all future transfers

Answer

A certification under an approved code of conduct registered with the subsidiary's data protection authority

Answer

Binding Corporate Rules approved only by the subsidiary's local supervisory authority without any further analysis

Question 6

A security analyst is reviewing the organization's third-party risk management program. The organization recently onboarded a new SaaS provider that will process sensitive customer data. The provider has provided a SOC 2 Type II report, but the analyst notices that the report is over 18 months old and covers a different service than the one being used. Which of the following should the analyst recommend?

Accepted Answer

Request a current SOC 2 Type II report that specifically covers the service being used, or conduct an on-site assessment if one is not available.. Third-party risk management requires current and relevant assurance. A SOC 2 Type II report must be recent and cover the specific service in use. Requesting an updated report or conducting an on-site assessment ensures the organization has accurate information to assess the provider's controls. Other options rely on outdated, unverified, or inappropriate methods.

Answer

Accept the existing SOC 2 Type II report since it demonstrates the provider's overall security posture.

Answer

Perform a penetration test against the provider's service to validate its security controls.

Answer

Rely on the provider's self-attestation of compliance with industry best practices.

Question 7

A hospital's security manager is aligning internal documents after a policy refresh. The board approved a statement that defines the organization's overall security intent and assigns responsibility to executive leadership, but it deliberately avoids naming specific products or technical settings. Which document type has the board approved?

Accepted Answer

A security policy. A policy is the management-approved, high-level statement that expresses security intent and assigns accountability without dictating products or settings. Standards enforce specific mandatory requirements, procedures describe operational steps, and guidelines offer optional advice. Because the board's document sets direction and delegates responsibility at an enterprise level while avoiding technical specificity, it is a policy sitting at the top of the governance hierarchy.

Answer

A security standard

Answer

A security procedure

Answer

A security guideline

Question 8

A security governance team is defining the scope of its enterprise risk management (ERM) program. Which TWO of the following activities are core components of ERM as described in frameworks such as ISO 31000 and COSO ERM? (Choose two.)

Accepted Answer

Integrating risk considerations into strategic planning and objective setting. ERM frameworks such as ISO 31000 and COSO ERM center on governance, strategy integration, and risk appetite. Defining risk appetite and tolerance gives leadership a benchmark for decisions, while integrating risk into strategic planning ensures objectives are set with awareness of uncertainty. Technical controls and asset inventories support risk management but are not core ERM components themselves.

Answer

Performing technical vulnerability scans on all production servers weekly

Answer

Maintaining an inventory of all hardware assets with purchase dates

Answer

Encrypting all databases containing personally identifiable information

Question 9

A multinational retailer must demonstrate compliance with the EU General Data Protection Regulation while also honoring local data-residency laws in a country where it operates. Legal counsel advises that a single global retention schedule cannot satisfy both regimes. Which governance artifact should the security manager produce to reconcile these competing obligations?

Accepted Answer

A records retention and residency matrix mapping each data category to jurisdictional requirements. Where global retention rules collide with local residency mandates, the organization needs a structured mapping of each data category to the retention period and permitted location required by every jurisdiction involved. A retention and residency matrix makes the conflicts visible and provides auditable, differentiated handling, whereas privacy assessments, use policies, and continuity plans address risk, behavior, and availability rather than reconciling legal obligations.

Answer

An updated acceptable use policy signed by all employees who handle customer data

Answer

A business continuity plan that documents failover of the retailer's EU data centers

Answer

A data protection impact assessment covering the retailer's cross-border transfers

Question 10

A hospital is preparing for a compliance audit and must demonstrate that it has implemented administrative safeguards required by the HIPAA Security Rule. Which activity best provides this evidence?

Accepted Answer

Maintaining a current inventory of all electronic protected health information systems and the results of periodic risk analyses. Administrative safeguards under the HIPAA Security Rule include risk analysis, risk management, workforce security, and access management. A documented inventory of ePHI systems and periodic risk analysis results directly demonstrate that the hospital has assessed risks and identified where ePHI is stored and processed. The other choices are physical, technical, or Privacy Rule activities that do not provide the specific administrative evidence the auditor seeks.

Answer

Publishing a notice of privacy practices on the hospital website

Answer

Installing biometric access readers at the data center entrance

Answer

Enabling full-disk encryption on all clinical workstations

Question 11

A defense contractor is required to comply with NIST SP 800-171 for protecting controlled unclassified information (CUI). The security team is implementing the required security requirements. Which of the following best describes the purpose of the System Security Plan (SSP) in this context?

Accepted Answer

It documents how the organization implements each security requirement and describes any planned remediation.. The System Security Plan (SSP) documents how the organization implements each of the NIST SP 800-171 security requirements and identifies any gaps with remediation plans. It is the primary artifact used to demonstrate compliance with DFARS 252.204-7012. It is not a data inventory, contract, or test report, although it may reference those. The SSP provides a structured narrative of the security posture for the CUI environment.

Answer

It provides a detailed inventory of all CUI data elements and their locations.

Answer

It contains the results of penetration testing and vulnerability scans for the CUI environment.

Answer

It serves as a legal contract between the contractor and the Department of Defense.

Question 12

A software company is acquiring a smaller competitor that maintains its own identity provider, endpoint management platform, and network infrastructure. The integration team must fold the acquired company's users and devices into the parent's environment without disrupting business operations. Which activity should occur first to establish governance over the combined environment?

Accepted Answer

Perform a security assessment of the acquired company's identity, endpoint, and network controls to identify gaps before integration. Merger and acquisition security governance starts with assessment. Before identities, endpoints, or workloads are merged, the acquiring organization must understand the inherited risk posture so it can prioritize remediation, set integration sequencing, and make informed acceptance decisions. Federating identities, deploying agents, or migrating workloads first can import vulnerabilities and weaken the parent's controls rather than extend them.

Answer

Migrate the acquired company's production workloads into the parent's cloud tenancy to consolidate billing

Answer

Immediately federate the acquired company's identity provider with the parent's directory to unify single sign-on

Answer

Deploy the parent's endpoint detection agents to all acquired devices during the first maintenance window

Question 13

A financial services firm operates a trading platform in which a 15-minute outage causes direct contractual penalties. The CISO must present a recommendation to the board on how to treat the residual risk of a ransomware event that could halt trading. The firm already has immutable offline backups and a tested recovery runbook. Which risk treatment action is MOST appropriate to recommend?

Accepted Answer

Mitigate the risk further by engineering automated failover and rehearsing recovery to meet the 15-minute recovery time objective.. The scenario isolates recovery speed as the binding constraint, since backups and runbooks already exist. Further mitigation through automated failover and rehearsed recovery directly attacks the 15-minute recovery time objective, whereas insurance only offsets financial loss, acceptance contradicts the evident risk appetite, and avoidance would destroy the business line. Treatment should map to the specific residual risk driver rather than to generic control categories.

Answer

Transfer the risk by purchasing a cyber insurance policy that covers business interruption.

Answer

Avoid the risk by shutting down the trading platform until ransomware can be fully eliminated.

Answer

Accept the residual risk because immutable backups and a tested runbook already exist.

Question 14

A software company suffers a breach exposing customer records. Legal counsel determines the incident meets the regulatory threshold for notification. The incident response lead must decide which external parties receive notice and within what timeframe, balancing regulatory duties against contractual obligations. Which action best satisfies the organization's notification obligations?

Accepted Answer

Notify regulators and affected data subjects within the applicable legal timeframes, and notify contractual partners per their agreements. Breach notification obligations run in parallel and on different clocks. Regulators and affected individuals must be notified within statutory windows measured from awareness, while contractual partners may have their own deadlines triggered by the same event. Notifying all required parties within their respective timeframes is the only approach that satisfies both legal and contractual duties, whereas waiting for investigation closure or substituting public notices fails those deadlines.

Answer

Notify law enforcement and defer all other notifications until the criminal case concludes

Answer

Notify only the affected customers once the forensic investigation is fully complete

Answer

Publish a general notice on the corporate website in place of direct notification

Question 15

A newly hired CISO is reviewing the organization's risk register and finds that a legacy payment application carries a high inherent risk rating, but after accounting for the web application firewall, tokenization, and quarterly penetration testing already in place, the rating drops substantially. Which risk concept explains the difference between these two ratings?

Accepted Answer

Residual risk. The high rating represents inherent risk, the exposure before safeguards are considered. Once the firewall, tokenization, and recurring penetration tests are factored in, the remaining exposure is residual risk. Risk appetite is a tolerance threshold, inherent risk is the pre-control baseline, and control risk concerns control failure rather than the net exposure level.

Answer

Inherent risk

Answer

Control risk

Answer

Risk appetite