CAS-004 Governance, Risk, and Compliance Practice Test 3 — 15 Questions

Question 1

A security analyst is prioritizing remediation of vulnerabilities. Which three of the following factors should be considered when determining the risk level of a vulnerability? (Choose three.)

Accepted Answer

Availability of a public exploit. Risk is a function of impact and likelihood. CVSS score provides severity; asset value indicates impact; exploit availability indicates likelihood of attack.

Answer

Vendor patch availability

Answer

Number of days since the vulnerability was discovered

Question 2

A security analyst is performing a quantitative risk assessment for a server that processes payment card data. The server has an asset value of $50,000. Based on historical data, the exposure factor (EF) for a ransomware attack is 80%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$20,000. ALE = SLE × ARO, where SLE = AV × EF = $50,000 × 0.8 = $40,000, and ARO = 0.5, so ALE = $40,000 × 0.5 = $20,000.

Answer

$40,000

Answer

$50,000

Answer

$25,000

Question 3

A multinational corporation that processes personal data of EU residents is required to appoint a Data Protection Officer (DPO) and implement data protection impact assessments. Which regulation primarily drives these requirements?

Accepted Answer

GDPR. The GDPR mandates DPO appointment for certain organizations and requires Data Protection Impact Assessments (DPIAs) for high-risk processing activities.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 4

An organization is adopting the NIST Risk Management Framework (RMF). During which step would the security team select and implement security controls, and how does this map to the organization's governance structure?

Accepted Answer

Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.. In NIST RMF, Step 2 (Select) and Step 3 (Implement) involve selecting controls from NIST SP 800-53 and implementing them. This aligns with governance through the risk executive function.

Answer

Step 4: Assess — controls are evaluated for effectiveness.

Answer

Step 1: Prepare — the organization establishes risk management roles and responsibilities.

Answer

Step 5: Authorize — a senior official accepts the risk.

Question 5

A company's security policy requires all sensitive data to be encrypted at rest. However, a business unit requests an exception to store certain data unencrypted due to performance constraints. Which document should govern the exception process?

Accepted Answer

Security policy. An exception management process is typically defined within the security policy or a related standard, outlining how to request, approve, and track exceptions.

Answer

Risk treatment plan

Answer

Acceptable use policy

Answer

Data classification standard

Question 6

During a vendor risk assessment, a security analyst reviews a SOC 2 Type II report from a cloud provider. What is the primary value of this report?

Accepted Answer

It provides assurance over the design and operating effectiveness of controls over a period.. A SOC 2 Type II report provides an independent assessment of controls over a period, confirming the vendor's control effectiveness.

Answer

It offers a snapshot of the vendor's security posture at a single point in time.

Answer

It provides a real-time vulnerability scan of the vendor's network.

Answer

It verifies the vendor's compliance with PCI DSS.

Question 7

A financial institution is implementing a privacy program based on GDPR principles. Which of the following best describes the concept of 'privacy by design'?

Accepted Answer

Embedding privacy controls into the design and architecture of systems and processes. Privacy by design is a proactive approach that integrates privacy into the system development lifecycle, not just a one-time assessment.

Answer

Ensuring that data subjects can exercise their rights upon request

Answer

Appointing a Data Protection Officer to oversee all privacy matters

Answer

Conducting a privacy impact assessment after a data breach

Question 8

Which security metric measures the average time it takes to detect a security incident after it has occurred?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is a key metric for incident detection efficiency.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Respond (MTTR)

Answer

Mean Time to Recover (MTTR)

Question 9

A security manager is reviewing a set of documents: an organizational security policy, a standard for encryption, a guideline for remote access, and a procedure for incident response. Which document is at the highest level in the policy hierarchy?

Accepted Answer

Organizational security policy. In the policy hierarchy, policy is the highest-level document, setting overarching direction. Standards, guidelines, and procedures are subordinate.

Answer

Remote access guideline

Answer

Encryption standard

Answer

Incident response procedure

Question 10

An organization has implemented a risk treatment plan that includes purchasing cyber insurance for potential data breach costs. Which risk treatment option does this represent?

Accepted Answer

Risk transfer. Cyber insurance transfers the financial risk to an insurance company, which is risk transfer.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 11

Under the GDPR, which of the following is a data subject right?

Accepted Answer

Right to erasure (right to be forgotten). The GDPR grants data subjects the right to request deletion of their personal data under certain conditions.

Answer

Right to transfer data across borders without restriction

Answer

Right to unlimited processing

Answer

Right to sell data

Question 12

A security team is evaluating the effectiveness of their patching program. Which metric would best indicate how quickly the organization applies critical patches?

Accepted Answer

Mean time to patch. Mean time to patch measures the average time from patch release to deployment, indicating responsiveness.

Answer

Number of unpatched systems

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity

Question 13

A company is conducting a third-party risk assessment for a SaaS provider. The provider has provided a SOC 2 Type II report, penetration test results, and a completed security questionnaire. Which of these provides the most independent and comprehensive view of the provider's control environment over time?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is an independent auditor's opinion on controls over a period, making it the most comprehensive.

Answer

Penetration test report

Answer

Security questionnaire

Answer

Vendor's marketing materials

Question 14

A security architect is designing a data lifecycle management program. Which TWO of the following are phases of the data lifecycle? (Select TWO.)

Accepted Answer

Data creation. The data lifecycle typically includes creation, storage, use, sharing, archiving, and destruction. Creation and destruction are standard phases.

Answer

Data replication

Answer

Data anonymization

Answer

Data monetization

Question 15

A security manager is developing key risk indicators (KRIs) for the organization's cybersecurity program. Which THREE of the following are examples of KRIs? (Select THREE.)

Accepted Answer

Number of failed login attempts per day. KRIs are leading indicators that signal increasing risk. Number of unpatched critical vulnerabilities, percentage of users without MFA, and number of failed login attempts are KRIs. MTTD is a KPI, not a KRI.

Answer

Total number of security incidents this quarter

Answer

Mean time to detect (MTTD)