CAS-004 Governance, Risk, and Compliance Practice Test 4 — 15 Questions

Question 1

A company is implementing continuous compliance monitoring for PCI DSS. Which TWO activities are most appropriate for this approach? (Select TWO.)

Accepted Answer

Automated daily file integrity monitoring on critical systems. Continuous compliance monitoring involves automated, ongoing checks that run frequently or in real-time. Automated daily file integrity monitoring (B) detects unauthorized changes to critical systems on a continuous basis, while real-time monitoring of firewall and intrusion detection system logs (E) provides immediate alerting of security events. In contrast, quarterly vulnerability scanning (D) is periodic, not continuous, and annual audits or manual monthly reviews (A, C) are point-in-time assessments that do not meet the continuous monitoring requirement.

Answer

Manual review of access logs every month

Answer

Annual on-site audit by a Qualified Security Assessor (QSA)

Answer

Automated quarterly vulnerability scanning of the cardholder data environment

Question 2

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $100,000, an exposure factor (EF) of 0.5, and an annualized rate of occurrence (ARO) of 2. What is the ALE?

Accepted Answer

$100,000. ALE = SLE × ARO, where SLE = AV × EF = $100,000 × 0.5 = $50,000. Then ALE = $50,000 × 2 = $100,000.

Answer

$150,000

Answer

$50,000

Answer

$200,000

Question 3

A company processes personal data of EU citizens and wants to implement privacy by design. Which of the following is the BEST first step in this process?

Accepted Answer

Conducting a Privacy Impact Assessment (PIA). Privacy by design requires embedding privacy into the design of systems and processes from the outset. Conducting a Privacy Impact Assessment (PIA) early helps identify and mitigate privacy risks before implementation.

Answer

Appointing a Data Protection Officer (DPO)

Answer

Implementing data encryption at rest and in transit

Answer

Developing a data retention policy

Question 4

An organization is evaluating a third-party vendor that will have access to its customer database. The vendor provides a SOC 2 Type II report dated six months ago. Which of the following is the BEST next step?

Accepted Answer

Conduct a vendor risk assessment using a security questionnaire. A SOC 2 Type II report shows the effectiveness of controls over a period, but it is dated. The organization should supplement it with a current security questionnaire to assess changes and current posture.

Answer

Accept the SOC 2 report as sufficient evidence

Answer

Perform an on-site audit of the vendor

Answer

Request a new penetration test report from the vendor

Question 5

An organization's security policy defines that all sensitive data must be encrypted. However, a business unit has a legacy application that cannot support encryption without a major rewrite. The risk owner decides to accept the risk. This is an example of which risk treatment strategy?

Accepted Answer

Risk acceptance. Risk acceptance is acknowledging the risk and deciding to tolerate it without additional controls, often documented in a risk register.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 6

Which of the following is a key difference between a security guideline and a security procedure?

Accepted Answer

Guidelines are recommended; procedures are mandatory. A guideline suggests best practices and is not mandatory, while a procedure provides step-by-step instructions that are mandatory.

Answer

Both are equally enforceable

Answer

Procedures are high-level; guidelines are detailed

Answer

Guidelines are mandatory; procedures are optional

Question 7

A security manager is reviewing Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for the security program. Which of the following is an example of a KRI?

Accepted Answer

Number of critical vulnerabilities exceeding the risk appetite threshold. KRIs measure risk levels, such as the number of critical vulnerabilities that exceed the risk appetite threshold. KPIs measure performance, like patch compliance percentage.

Answer

Mean time to detect (MTTD) security incidents

Answer

Percentage of systems patched within 30 days

Answer

Number of security incidents per month

Question 8

An organization is required to comply with PCI DSS. Which of the following is a mandatory requirement for protecting cardholder data?

Accepted Answer

Encrypting cardholder data at rest. PCI DSS Requirement 3 mandates that stored PAN must be rendered unreadable via encryption, truncation, hashing, or tokenization.

Answer

Conducting annual risk assessments

Answer

Using a dedicated network segment for card processing

Answer

Implementing multi-factor authentication for all users

Question 9

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 10

Which risk management framework is specifically designed for U.S. federal agencies and includes a six-step process: Categorize, Select, Implement, Assess, Authorize, and Monitor?

Accepted Answer

NIST RMF. NIST Risk Management Framework (RMF) includes the six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor.

Answer

ISO 27005

Answer

COBIT

Answer

FAIR

Question 11

A healthcare organization subject to HIPAA must ensure that patients can access their medical records. This requirement is an example of which data subject right under privacy regulations?

Accepted Answer

Right to access. HIPAA gives patients the right to access their protected health information (PHI). This aligns with the data subject right of access.

Answer

Right to be forgotten

Answer

Right to data portability

Answer

Right to rectification

Question 12

An organization is using the FAIR framework to quantify risk. The analyst estimates the probable loss event frequency (LEF) as 4 per year and the probable loss magnitude (LM) as $25,000 per event. What is the annualized loss expectancy (ALE) under FAIR?

Accepted Answer

$100,000. In FAIR, ALE = LEF × LM. Here, LEF=4 and LM=$25,000, so ALE = 4 × $25,000 = $100,000.

Answer

$6,250

Answer

$125,000

Answer

$25,000

Question 13

During a policy gap analysis, it is discovered that the organization has a policy stating that sensitive data must be encrypted, but there are no procedures for implementing encryption on mobile devices. This is an example of a gap between:

Accepted Answer

Policy and procedures. A gap exists when a policy sets a requirement but the supporting procedures to implement it are missing.

Answer

Standards and guidelines

Answer

Policy and standards

Answer

Policy and guidelines

Question 14

A security architect is designing a data classification scheme. Which TWO of the following are commonly used classification levels? (Select TWO.)

Accepted Answer

Confidential. Common data classification levels include Public (no harm if disclosed), Internal (limited internal use), Confidential (sensitive, limited access), and Restricted (highly sensitive).

Answer

Unclassified

Answer

For Official Use Only

Answer

Top Secret

Question 15

An organization is implementing a vendor risk management program and is reviewing a contract that includes a right-to-audit clause. Which THREE of the following are common elements that should be verified during such an audit? (Select THREE.)

Accepted Answer

Access control mechanisms. Right-to-audit allows the customer to verify vendor compliance. Common audit areas include security controls, data handling, incident response, and access controls.

Answer

Employee satisfaction surveys

Answer

Vendor's financial stability