CAS-004 Governance, Risk, and Compliance Practice Test 3 — 15 Questions

Question 1

An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Right-to-audit clause. A right-to-audit clause contractually grants the organization the ability to inspect, assess, and verify a vendor's security controls, policies, and practices — either directly or via a qualified third party. This is the mechanism that provides ongoing visibility into the vendor's security posture beyond initial due diligence. Without it, the organization has no legal standing to demand evidence of security compliance during the contract term.

Answer

Non-disclosure agreement (NDA)

Answer

Service-level agreement (SLA) for uptime

Answer

Data processing agreement (DPA)

Question 2

A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?

Accepted Answer

System categorization. System categorization is a step unique to the NIST RMF (Step 1: Categorize) that uses FIPS 199 to classify information systems by impact level (Low, Moderate, High). ISO 27005 focuses on risk management processes — risk identification, assessment, and treatment — but does not include a formal system categorization step as part of its framework. This makes system categorization the correct differentiator.

Answer

Risk identification

Answer

Risk treatment

Answer

Risk assessment

Question 3

A security team is measuring the effectiveness of its incident response process. Which of the following metrics would best indicate how quickly the team can contain an incident after it is detected?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time between incident detection and containment/resolution, directly reflecting how quickly the team can act once an incident is identified. It is the standard metric for response and containment speed in incident response frameworks such as NIST SP 800-61. The other options measure detection speed, vulnerability posture, or patch hygiene, not containment speed.

Answer

Vulnerabilities by severity

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 4

A small business is implementing a privacy impact assessment (PIA) for a new application that processes personal data of EU citizens. Which TWO of the following are required under GDPR?

Accepted Answer

Describe the processing operations and purposes. Under GDPR Article 35, a Data Protection Impact Assessment (DPIA) must contain a systematic description of the envisaged processing operations and the purposes of the processing, which is exactly what option D requires, so D is correct. Article 35(7)(b) also mandates an assessment of the necessity and proportionality of the processing operations in relation to their purposes, making option E correct. Option A is wrong because GDPR does not generally require prior DPA approval before processing; prior consultation under Article 36 is only needed when a DPIA indicates high residual risk that cannot be mitigated. Option B is wrong because a DPO is mandatory only under Article 37 conditions (large-scale regular monitoring, large-scale special-category data, or public authority), not for every PIA. Option C is wrong because GDPR does not require publishing the DPIA on a website; the DPIA is documented and made available to the supervisory authority on request.

Answer

Obtain approval from a data protection authority before processing

Answer

Appoint a data protection officer (DPO)

Answer

Publish the PIA on the company website

Question 5

A security manager is selecting key risk indicators (KRIs) for the organization's risk management program. Which THREE of the following are examples of KRIs that can provide early warning of increasing risk?

Accepted Answer

Number of failed login attempts per hour. Option A (number of failed login attempts per hour) is a valid KRI because a rising rate of authentication failures is a leading indicator of brute-force, password-spraying, or credential-stuffing attacks, giving early warning before a breach occurs. Option C (percentage of users with privileged access) is a KRI because excessive or growing privileged accounts expand the attack surface and the potential blast radius of a compromise, signaling creeping access-control risk. Option D (number of unpatched critical vulnerabilities) is a KRI because a growing count of unpatched critical CVEs directly raises the likelihood of exploitation and is a measurable, forward-looking exposure metric. Option B (MTTD) is a key performance indicator of detection efficiency, not an early-warning risk indicator, and Option E (percentage of systems with current backups) is a control-effectiveness or compliance metric rather than a leading indicator of increasing risk.

Answer

Mean time to detect (MTTD) for incidents

Answer

Percentage of systems with current backups

Question 6

An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?

Accepted Answer

Include a right-to-audit clause that covers subcontractors. To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.

Answer

Use only vendors that are SOC 2 certified

Answer

Reduce reliance on vendors by bringing services in-house

Answer

Conduct penetration tests on all fourth parties directly

Question 7

A financial institution is evaluating a cloud service provider for hosting customer data. During the due diligence process, which report would best help the institution assess the provider's control environment and compliance with SOC 2?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the correct choice because it provides an independent auditor's opinion on the design AND operating effectiveness of a service provider's controls over a period of time (typically 3-12 months). This directly addresses the financial institution's need to assess the provider's control environment and SOC 2 compliance. Type II is specifically designed for vendor due diligence where evidence of sustained control operation is required.

Answer

ISO 27001 certificate

Answer

Penetration test report

Answer

Vulnerability scan results

Question 8

An organization is implementing a data classification scheme. Which data type should be given the highest protection and is typically restricted to a very small number of individuals?

Accepted Answer

Restricted. Restricted data is the highest classification tier in most data classification schemes, reserved for the most sensitive information whose unauthorized disclosure would cause severe harm. Access is typically limited to a very small number of named individuals with explicit need-to-know and often additional controls like encryption, logging, and physical security. Examples include trade secrets, M&A plans, and certain regulated personal data.

Answer

Confidential

Answer

Internal

Answer

Public

Question 9

A security analyst calculates the annualized loss expectancy (ALE) for a server. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the ALE?

Accepted Answer

$10,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, SLE = $50,000 and ARO = 0.2, so ALE = $50,000 * 0.2 = $10,000. This represents the expected monetary loss per year from the risk.

Answer

$50,200

Answer

$2,500

Answer

$250,000

Question 10

Which risk treatment option involves reducing the likelihood or impact of a risk through controls?

Accepted Answer

Mitigate. Mitigation involves implementing controls to reduce the likelihood or impact of a risk. This is the definition of risk mitigation in risk management frameworks like NIST and ISO 31000. It is distinct from avoidance (eliminating the activity), acceptance (retaining the risk), and transfer (shifting to a third party).

Answer

Avoid

Answer

Accept

Answer

Transfer

Question 11

Which key performance indicator (KPI) is most useful for measuring the effectiveness of an incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to respond to and contain a security incident from detection. It directly reflects the efficiency and effectiveness of the incident response process, as lower MTTR indicates faster containment and reduced impact. Other metrics like patch compliance or vulnerabilities by severity are related to vulnerability management, not incident response effectiveness.

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity

Answer

Number of security awareness training sessions

Question 12

When conducting a vendor risk assessment, which contractual clause is most important for ensuring ongoing visibility into the vendor's security posture?

Accepted Answer

Right-to-audit clause. A right-to-audit clause contractually grants the customer the ability to inspect the vendor's security controls, processes, and records — either directly or via third-party reports like SOC 2. This is the mechanism that provides ongoing visibility into the vendor's security posture over the life of the relationship, not just at onboarding. Without it, the customer has no enforceable means to verify that controls remain effective.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 13

An organization is implementing a privacy program based on privacy by design. Which principle requires that privacy controls be integrated into the system's default settings?

Accepted Answer

Privacy as the default setting. Privacy as the default setting is the privacy-by-design principle requiring that privacy protections be built into the system's default configuration, so users do not have to take action to protect their data. It means the most privacy-protective settings are on by default, and users must opt in to share more. This directly matches the question's wording about default settings.

Answer

Full functionality – positive-sum, not zero-sum

Answer

Privacy embedded into design

Answer

Proactive not reactive; preventative not remedial

Question 14

A company is required to comply with PCI DSS. What is the primary purpose of conducting quarterly network vulnerability scans?

Accepted Answer

To detect and remediate vulnerabilities in a timely manner. The primary purpose of quarterly network vulnerability scans under PCI DSS is to detect and remediate vulnerabilities in a timely manner. PCI DSS Requirement 11.2 mandates quarterly internal and external vulnerability scans to identify security weaknesses and address them before they can be exploited. This proactive approach helps maintain a secure network environment.

Answer

To ensure firewall rules are correctly configured

Answer

To verify encryption strength

Answer

To monitor user access logs

Question 15

Which document in a security policy hierarchy provides specific step-by-step instructions for performing a task?

Accepted Answer

Procedure. A procedure is the only document in a security policy hierarchy that provides detailed, step-by-step instructions for performing a specific task. It translates high-level policies and standards into actionable steps that employees can follow to ensure consistency and compliance. Procedures are operational in nature and answer 'how' to implement the requirements.

Answer

Guideline

Answer

Standard

Answer

Policy