CAS-004 Governance, Risk, and Compliance Practice Test 5 — 15 Questions

Question 1

A compliance officer is preparing for an audit and needs to collect evidence. Which TWO of the following are considered acceptable forms of audit evidence? (Select TWO.)

Accepted Answer

Written security policies. Audit evidence includes system logs (factual records) and policy documentation (proof of requirements).

Answer

Screenshots of unofficial reports

Answer

Verbal statements from employees

Answer

Assumptions about system configurations

Question 2

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $50,000 and an exposure factor (EF) of 0.2. The annualized rate of occurrence (ARO) is estimated at 4. What is the ALE?

Accepted Answer

$40,000. ALE = SLE × ARO; SLE = AV × EF = $50,000 × 0.2 = $10,000; ALE = $10,000 × 4 = $40,000.

Answer

$10,000

Answer

$50,000

Answer

$200,000

Question 3

A company is evaluating a new cloud service provider. The provider offers a SOC 2 Type II report, a third-party penetration test summary, and a completed security questionnaire. However, the company's procurement team discovers that the provider uses a subcontractor for data storage. Which of the following is the BEST next step for the security team?

Accepted Answer

Request a right-to-audit clause covering the subcontractor.. The presence of a subcontractor introduces fourth-party risk. The company should assess the subcontractor's security through a right-to-audit clause or request equivalent evidence, as the primary provider's controls may not cover the subcontractor.

Answer

Require the provider to use only in-house resources.

Answer

Accept the risk because the provider has a SOC 2 report.

Answer

Immediately terminate the contract due to subcontractor risk.

Question 4

An organization is implementing a privacy program to comply with GDPR. Which of the following BEST describes the concept of 'privacy by design' as it applies to a new customer relationship management (CRM) system?

Accepted Answer

Incorporating data minimization and access controls into the system architecture from the start.. Privacy by design requires embedding privacy controls into the system's architecture from the outset, not as an afterthought. This includes data minimization, purpose limitation, and security controls integrated during development.

Answer

Assigning a data protection officer to review system logs quarterly.

Answer

Adding a privacy notice to the CRM after deployment.

Answer

Conducting a privacy impact assessment (PIA) after the system is live.

Question 5

A security manager is reviewing the company's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The policy hierarchy typically follows: Policy (high-level, mandatory) -> Standard (specific requirements) -> Guideline (recommendations) -> Procedure (step-by-step instructions).

Answer

Standard, Policy, Procedure, Guideline

Answer

Policy, Guideline, Standard, Procedure

Answer

Procedure, Guideline, Standard, Policy

Question 6

A financial institution must comply with the Sarbanes-Oxley Act (SOX). Which of the following is a primary focus of SOX compliance?

Accepted Answer

Accuracy and reliability of financial reporting. SOX focuses on internal controls over financial reporting (ICFR) and requires management to assess and report on the effectiveness of these controls, which includes IT controls that impact financial data.

Answer

Security of credit card transactions

Answer

Privacy of health information

Answer

Protection of personally identifiable information (PII)

Question 7

A security team is selecting key risk indicators (KRIs) for the organization's cybersecurity program. Which of the following is an example of a KRI that provides a leading indicator of risk?

Accepted Answer

Number of unpatched critical vulnerabilities. KRIs ideally should be leading indicators that predict future risk. Number of unpatched critical vulnerabilities is a leading indicator because it indicates potential for future exploitation. MTTD is lagging (measures past incidents). Patch compliance % is a KPI, not necessarily a risk indicator. Number of incidents is lagging.

Answer

Mean time to detect (MTTD) for security incidents

Answer

Number of security incidents reported last month

Answer

Percentage of systems with antivirus installed

Question 8

After a risk assessment, a company identifies that the residual risk for a critical application is higher than the risk appetite. The risk owner proposes implementing additional controls to reduce the risk further. Which risk treatment option does this represent?

Accepted Answer

Risk mitigation. Implementing additional controls to reduce risk is an example of risk mitigation. Residual risk is the risk remaining after controls are applied; if it still exceeds appetite, further mitigation is needed.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 9

A healthcare organization is required to comply with HIPAA. During an audit, the auditor requests evidence of access controls for electronic protected health information (ePHI). Which of the following would be the BEST evidence to provide?

Accepted Answer

Access review logs showing periodic reviews of user permissions. Access review logs demonstrate ongoing monitoring and management of access rights, which is a key HIPAA requirement for administrative safeguards. A signed policy is insufficient without evidence of enforcement. A network diagram shows architecture, not control. A training completion report addresses workforce training, not access controls.

Answer

A report of employee security training completion

Answer

A signed copy of the access control policy

Answer

A network diagram of the IT infrastructure

Question 10

An organization wants to implement continuous compliance monitoring for PCI DSS. Which of the following tools would be MOST effective for this purpose?

Accepted Answer

SIEM system. A security information and event management (SIEM) system can collect and analyze logs in real-time, enabling continuous monitoring of security controls and compliance with PCI DSS requirements. Vulnerability scanners are periodic, not continuous. Firewalls are control devices, not monitoring tools. Encryption is a protection mechanism.

Answer

Encryption solution

Answer

Network firewall

Answer

Vulnerability scanner

Question 11

A company is adopting the NIST Risk Management Framework (RMF). Which step in the RMF involves selecting security controls based on the risk assessment?

Accepted Answer

Select. In NIST RMF, the 'Select' step involves choosing baseline controls and tailoring them based on the risk assessment results. 'Categorize' determines impact level. 'Implement' executes controls. 'Assess' evaluates effectiveness.

Answer

Categorize

Answer

Assess

Answer

Implement

Question 12

A multinational corporation is implementing a data classification scheme. Which of the following data types should be classified as 'restricted'?

Accepted Answer

Customer PII with legal requirements. Restricted data typically includes information that could cause severe damage if disclosed, such as trade secrets, intellectual property, or personally identifiable information (PII) that is heavily regulated. Public data is for public release. Internal data is for internal use only. Confidential data is sensitive but less critical than restricted.

Answer

Internal meeting minutes

Answer

Employee training materials

Answer

Marketing brochures

Question 13

During a vendor risk assessment, a third-party vendor refuses to provide a SOC 2 report but offers a completed security questionnaire. The vendor handles sensitive customer data. Which of the following is the BEST course of action?

Accepted Answer

Require a right-to-audit clause to conduct an on-site assessment.. If a vendor refuses to provide independent audit evidence, the organization should consider the risk level. For sensitive data, a SOC 2 report is a strong control. The organization should require a right-to-audit clause to perform its own assessment, as the questionnaire alone may be insufficient.

Answer

Immediately terminate the relationship.

Answer

Lower the data classification to reduce risk.

Answer

Accept the questionnaire as sufficient evidence.

Question 14

A security manager is implementing a policy exception management process. Which TWO of the following are essential components of an effective exception management process?

Accepted Answer

A defined expiration date for each exception. An exception management process must include: (1) a formal request and approval workflow to ensure accountability, and (2) a defined expiration date to prevent permanent exceptions. Temporary workarounds without expiration undermine security. Exceptions may be approved if risk is accepted. Policy changes are separate.

Answer

A policy that all exceptions are denied

Answer

Automatic approval for temporary workarounds

Answer

Immediate policy revision to eliminate the need for exceptions

Question 15

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization