CAS-004 Governance, Risk, and Compliance Practice Test 2 — 15 Questions

Question 1

An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?

Accepted Answer

Include a right-to-audit clause that covers subcontractors. To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

Answer

Use only vendors that are SOC 2 certified

Answer

Reduce reliance on vendors by bringing services in-house

Answer

Conduct penetration tests on all fourth parties directly

Question 2

A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an auditor's opinion on the effectiveness of controls over a period, directly addressing the service provider's control environment and compliance with Trust Services Criteria.

Answer

ISO 27001 certificate

Answer

Penetration test report

Answer

Vulnerability scan results

Question 3

An organization is implementing a data classification scheme. Which data type should be given the highest protection and is typically restricted to a very small number of individuals?

Accepted Answer

Restricted. Restricted data is the highest classification, reserved for data that could cause severe damage if disclosed, such as trade secrets or PII, and access is tightly controlled.

Answer

Confidential

Answer

Internal

Answer

Public

Question 4

A security analyst calculates the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$10,000. ALE = SLE × ARO = $50,000 × 0.2 = $10,000.

Answer

$50,200

Answer

$2,500

Answer

$250,000

Question 5

Which risk treatment option involves reducing the likelihood or impact of a risk through controls?

Accepted Answer

Mitigate. Mitigate (or reduce) involves implementing controls to lower risk to an acceptable level.

Answer

Avoid

Answer

Accept

Answer

Transfer

Question 6

A healthcare organization must comply with HIPAA. Which of the following is a key requirement for protecting electronic protected health information (ePHI)?

Accepted Answer

Encryption of ePHI at rest and in transit. HIPAA requires encryption of ePHI both at rest and in transit as an addressable implementation specification to ensure confidentiality.

Answer

Data masking for all patient data

Answer

Annual penetration testing

Answer

Public key infrastructure for all users

Question 7

Which key performance indicator (KPI) is most useful for measuring the effectiveness of an incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated, reflecting process efficiency.

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity

Answer

Number of security awareness training sessions

Question 8

When conducting a vendor risk assessment, which contractual clause is most important for ensuring ongoing visibility into the vendor's security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to perform or request audits of the vendor's controls, providing ongoing assurance.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 9

An organization is implementing a privacy program based on privacy by design. Which principle requires that privacy controls be integrated into the system's default settings?

Accepted Answer

Privacy as the default setting. Privacy by design includes the principle that privacy settings should be maximized by default, so users do not need to take action to protect their data.

Answer

Full functionality – positive-sum, not zero-sum

Answer

Privacy embedded into design

Answer

Proactive not reactive; preventative not remedial

Question 10

A company is required to comply with PCI DSS. What is the primary purpose of conducting quarterly network vulnerability scans?

Accepted Answer

To detect and remediate vulnerabilities in a timely manner. PCI DSS Requirement 11.2 mandates quarterly external and internal vulnerability scans to identify and address vulnerabilities.

Answer

To ensure firewall rules are correctly configured

Answer

To verify encryption strength

Answer

To monitor user access logs

Question 11

Which document in a security policy hierarchy provides specific step-by-step instructions for performing a task?

Accepted Answer

Procedure. A procedure details the exact steps to implement a policy, standard, or guideline.

Answer

Guideline

Answer

Standard

Answer

Policy

Question 12

An organization discovers that a third-party vendor has a subcontractor that processes its data. The organization did not have a contract with the subcontractor. This is an example of which type of risk?

Accepted Answer

Fourth-party risk. Fourth-party risk is the risk that arises from a vendor's use of subcontractors, which may not be directly managed by the organization.

Answer

Residual risk

Answer

Third-party risk

Answer

Supply chain risk

Question 13

Using the FAIR model, which of the following best describes the factor that represents the probable frequency of a threat acting on a vulnerability?

Accepted Answer

Threat event frequency (TEF). In FAIR, threat event frequency (TEF) is the probable number of times a threat agent will act on a vulnerability in a given timeframe.

Answer

Vulnerability

Answer

Loss event frequency (LEF)

Answer

Control effectiveness

Question 14

A security manager is selecting metrics to present to the board. Which two of the following are key risk indicators (KRIs) that would be most relevant for executive oversight? (Choose two.)

Accepted Answer

Number of security incidents per quarter. KRIs provide early warning of increasing risk. Percentage of systems with critical vulnerabilities indicates exposure; number of security incidents indicates threat activity.

Answer

Average time to patch critical vulnerabilities

Answer

Mean time to detect (MTTD)

Answer

Number of security awareness training completions

Question 15

An organization is developing a policy exception management process. Which three of the following are essential components of an effective exception process? (Choose three.)

Accepted Answer

Documented business justification for the exception. An exception process should include documented justification, expiration date, and formal approval by management. Policy hierarchy documentation is separate; automated enforcement may not be required.

Answer

Automatic enforcement of policy via technical controls

Answer

A copy of the entire policy hierarchy