CAS-004 Governance, Risk, and Compliance Practice Test 4 — 15 Questions

Question 1

An organization discovers that a third-party vendor has a subcontractor that processes its data. The organization did not have a contract with the subcontractor. This is an example of which type of risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fourth-party risk. Fourth-party risk refers to the risk introduced by a vendor's subcontractors or sub-processors — parties with whom the organization has no direct contractual relationship. Since the organization has no contract with the subcontractor, this is a classic fourth-party risk scenario.

Answer

Residual risk

Answer

Third-party risk

Answer

Supply chain risk

Question 2

Using the FAIR model, which of the following best describes the factor that represents the probable frequency of a threat acting on a vulnerability?

Accepted Answer

Threat event frequency (TEF). Threat event frequency (TEF) is the FAIR factor that quantifies how often a threat agent is expected to act against an asset within a given timeframe. It directly measures the probable frequency of a threat acting on a vulnerability, independent of whether the action succeeds. TEF is a primary input to calculating loss event frequency (LEF).

Answer

Vulnerability

Answer

Loss event frequency (LEF)

Answer

Control effectiveness

Question 3

An organization is developing a policy exception management process. Which three of the following are essential components of an effective exception process? (Choose three.)

Accepted Answer

Documented business justification for the exception. Option A is correct because every exception must be supported by a documented business justification that explains why the policy cannot be met and what compensating value the exception provides, giving approvers the rationale needed to make an informed decision. Option B is correct because exceptions must have an expiration date (or defined review period) so they are temporary and time-bound, preventing them from becoming permanent de facto policy and forcing periodic re-evaluation. Option D is correct because a risk assessment quantifies the residual risk introduced by the exception, allowing management to accept that risk knowingly and to define compensating controls. Option C is not essential to the exception process itself; automatic enforcement is a policy implementation mechanism, and an exception by definition suspends or modifies enforcement rather than applying it. Option E is not essential because attaching the entire policy hierarchy is unnecessary documentation; the exception only needs to reference the specific policy clause being excepted, not reproduce the whole hierarchy.

Answer

Automatic enforcement of policy via technical controls

Answer

A copy of the entire policy hierarchy

Question 4

A security analyst is prioritizing remediation of vulnerabilities. Which three of the following factors should be considered when determining the risk level of a vulnerability? (Choose three.)

Accepted Answer

Availability of a public exploit. Option A (Availability of a public exploit) is correct because a publicly available exploit, especially one weaponized in frameworks like Metasploit or CISA's KEV catalog, dramatically increases the likelihood of active exploitation and thus raises the risk level. Option C (Asset value or criticality) is correct because the same vulnerability poses far greater risk on a high-value asset such as a domain controller or PII database than on an isolated test machine, directly affecting impact. Option D (CVSS base score) is correct because it provides a standardized, vendor-agnostic metric of intrinsic severity based on exploitability and impact, forming a foundational input to risk prioritization. Option B (Vendor patch availability) is not one of the three because a patch being available reduces exposure but does not itself define the inherent risk level of the vulnerability. Option E (Number of days since discovery) is not selected because age alone is a weak indicator; a long-unpatched critical flaw may be high risk, but time since discovery is not a standard risk-scoring factor like exploit availability, asset criticality, or CVSS.

Answer

Vendor patch availability

Answer

Number of days since the vulnerability was discovered

Question 5

A security analyst is performing a quantitative risk assessment for a server that processes payment card data. The server has an asset value of $50,000. Based on historical data, the exposure factor (EF) for a ransomware attack is 80%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$20,000. The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE is Asset Value (AV) times Exposure Factor (EF). Here, AV = $50,000, EF = 0.8, so SLE = $40,000. ARO = 0.5, so ALE = $40,000 * 0.5 = $20,000.

Answer

$40,000

Answer

$50,000

Answer

$25,000

Question 6

A multinational corporation that processes personal data of EU residents is required to appoint a Data Protection Officer (DPO) and implement data protection impact assessments. Which regulation primarily drives these requirements?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) is the EU regulation that mandates appointing a Data Protection Officer (DPO) in certain cases and requires Data Protection Impact Assessments (DPIAs) for high-risk processing. It applies to any organization processing personal data of EU residents, regardless of the organization's location, making it the primary driver of these requirements.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 7

An organization is adopting the NIST Risk Management Framework (RMF). During which step would the security team select and implement security controls, and how does this map to the organization's governance structure?

Accepted Answer

Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.. In the NIST RMF, Step 2 (Select) is where controls are chosen based on the risk assessment and organizational risk tolerance, and Step 3 (Implement) is where those controls are deployed and integrated into the system and its environment of operation. Together they represent the control selection and implementation phase, which maps to governance through the policies, roles, and risk decisions established in Step 1 (Prepare).

Answer

Step 4: Assess — controls are evaluated for effectiveness.

Answer

Step 1: Prepare — the organization establishes risk management roles and responsibilities.

Answer

Step 5: Authorize — a senior official accepts the risk.

Question 8

A company's security policy requires all sensitive data to be encrypted at rest. However, a business unit requests an exception to store certain data unencrypted due to performance constraints. Which document should govern the exception process?

Accepted Answer

Security policy. The security policy is the overarching document that defines the organization's security requirements and typically includes provisions for exceptions, including the process for requesting, reviewing, and approving exceptions to policy. Since the requirement to encrypt sensitive data at rest originates from the security policy, any exception to that requirement must be governed by the same policy's exception process. The security policy should specify who can approve exceptions, under what conditions, and for how long.

Answer

Risk treatment plan

Answer

Acceptable use policy

Answer

Data classification standard

Question 9

During a vendor risk assessment, a security analyst reviews a SOC 2 Type II report from a cloud provider. What is the primary value of this report?

Accepted Answer

It provides assurance over the design and operating effectiveness of controls over a period.. A SOC 2 Type II report provides assurance over the design and operating effectiveness of a service organization's controls over a specified period, typically 3–12 months. This period-based testing distinguishes it from Type I, which only assesses design at a point in time. For vendor risk management, Type II gives the analyst evidence that controls actually operated effectively throughout the audit window.

Answer

It offers a snapshot of the vendor's security posture at a single point in time.

Answer

It provides a real-time vulnerability scan of the vendor's network.

Answer

It verifies the vendor's compliance with PCI DSS.

Question 10

A financial institution is implementing a privacy program based on GDPR principles. Which of the following best describes the concept of 'privacy by design'?

Accepted Answer

Embedding privacy controls into the design and architecture of systems and processes. Privacy by design is a foundational GDPR principle (Article 25) that requires data protection measures to be integrated into the design and architecture of systems and business processes from the outset, rather than added as an afterthought. This means embedding privacy controls such as data minimization, pseudonymization, and access controls into the very structure of applications and workflows. Option C accurately captures this proactive, architecture-level approach.

Answer

Ensuring that data subjects can exercise their rights upon request

Answer

Appointing a Data Protection Officer to oversee all privacy matters

Answer

Conducting a privacy impact assessment after a data breach

Question 11

Which security metric measures the average time it takes to detect a security incident after it has occurred?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the metric that specifically measures the average elapsed time between when a security incident actually occurs and when it is detected by monitoring, alerting, or analyst investigation. It is a core SOC efficiency metric used to evaluate detection capabilities.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Respond (MTTR)

Answer

Mean Time to Recover (MTTR)

Question 12

A security manager is reviewing a set of documents: an organizational security policy, a standard for encryption, a guideline for remote access, and a procedure for incident response. Which document is at the highest level in the policy hierarchy?

Accepted Answer

Organizational security policy. The organizational security policy is the top-level governance document — it states management's intent, scope, and high-level requirements. Standards, guidelines, and procedures all derive from and must align with the policy, making it the highest document in the hierarchy.

Answer

Remote access guideline

Answer

Encryption standard

Answer

Incident response procedure

Question 13

An organization has implemented a risk treatment plan that includes purchasing cyber insurance for potential data breach costs. Which risk treatment option does this represent?

Accepted Answer

Risk transfer. Purchasing cyber insurance transfers the financial consequences of a data breach to a third-party insurer, which is the definition of risk transfer. The organization does not eliminate the risk or reduce its likelihood — it shifts the monetary impact to another party. This is a classic example of risk transfer in risk treatment planning.

Answer

Risk mitigation

Answer

Risk avoidance

Answer

Risk acceptance

Question 14

Under the GDPR, which of the following is a data subject right?

Accepted Answer

Right to erasure (right to be forgotten). The right to erasure (right to be forgotten) is explicitly listed in Article 17 of the GDPR. It allows data subjects to request deletion of their personal data under certain conditions, such as when the data is no longer necessary for the purpose it was collected. This is one of the core data subject rights alongside access, rectification, and portability.

Answer

Right to transfer data across borders without restriction

Answer

Right to unlimited processing

Answer

Right to sell data

Question 15

A security team is evaluating the effectiveness of their patching program. Which metric would best indicate how quickly the organization applies critical patches?

Accepted Answer

Mean time to patch. Mean time to patch measures the average time taken from the release of a patch to its application on systems. It directly indicates how quickly the organization applies critical patches, as a lower mean time to patch signifies a faster patching process. Other metrics like patch compliance percentage show the proportion of systems patched but not the speed.

Answer

Number of unpatched systems

Answer

Patch compliance percentage

Answer

Vulnerabilities by severity