CAS-004 Governance, Risk, and Compliance Practice Test 5 — 15 Questions

Question 1

A company is conducting a third-party risk assessment for a SaaS provider. The provider has provided a SOC 2 Type II report, penetration test results, and a completed security questionnaire. Which of these provides the most independent and comprehensive view of the provider's control environment over time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of controls over a period of time (typically 3-12 months). This gives a comprehensive, time-tested view of the provider's control environment, unlike point-in-time assessments.

Answer

Penetration test report

Answer

Security questionnaire

Answer

Vendor's marketing materials

Question 2

A security architect is designing a data lifecycle management program. Which TWO of the following are phases of the data lifecycle? (Select TWO.)

Accepted Answer

Data creation. Option C (Data creation) is correct because the data lifecycle begins when data is generated or acquired, making creation the first recognized phase in lifecycle models such as the one described in ISO/IEC 27001 and NIST guidance. Option D (Data destruction) is correct because the lifecycle concludes with secure disposal or destruction of data once it is no longer needed, ensuring it cannot be recovered and reducing residual risk. Data replication (A) is a storage or availability technique, not a lifecycle phase. Data anonymization (B) is a privacy-enhancing technique applied during processing, not a distinct lifecycle phase. Data monetization (E) is a business objective or use case, not a formal phase of the data lifecycle.

Answer

Data replication

Answer

Data anonymization

Answer

Data monetization

Question 3

A company is implementing continuous compliance monitoring for PCI DSS. Which TWO activities are most appropriate for this approach? (Select TWO.)

Accepted Answer

Automated daily file integrity monitoring on critical systems. Option B is correct because continuous compliance monitoring relies on automated, recurring controls such as daily file integrity monitoring (FIM) on critical systems, which detects unauthorized changes to system files in near real time and supports PCI DSS Requirement 11.5. Option E is correct because real-time monitoring of firewall and IDS logs provides continuous visibility into security events and supports PCI DSS Requirements 10 and 11.4, enabling prompt detection and response rather than point-in-time checks. Option A is not appropriate because monthly manual log review is periodic and labor-intensive, not continuous or automated. Option C is not appropriate because an annual QSA on-site audit is a point-in-time assessment, not continuous monitoring. Option D is not appropriate because quarterly vulnerability scanning, while required by PCI DSS, is periodic rather than continuous monitoring.

Answer

Manual review of access logs every month

Answer

Annual on-site audit by a Qualified Security Assessor (QSA)

Answer

Automated quarterly vulnerability scanning of the cardholder data environment

Question 4

A company processes personal data of EU citizens and wants to implement privacy by design. Which of the following is the BEST first step in this process?

Accepted Answer

Conducting a Privacy Impact Assessment (PIA). A Privacy Impact Assessment (PIA) — also called a Data Protection Impact Assessment (DPIA) under GDPR Article 35 — is the foundational first step in privacy by design because it forces the organization to systematically identify and mitigate privacy risks before processing begins. It maps data flows, identifies personal data elements, assesses legal bases, and evaluates risks to data subjects, which then informs all subsequent controls like encryption, retention, and DPO involvement. Without this assessment, other measures are implemented blindly and may not address the actual risks. GDPR explicitly requires a DPIA for high-risk processing, making it a legal prerequisite in many cases.

Answer

Appointing a Data Protection Officer (DPO)

Answer

Implementing data encryption at rest and in transit

Answer

Developing a data retention policy

Question 5

An organization is evaluating a third-party vendor that will have access to its customer database. The vendor provides a SOC 2 Type II report dated six months ago. Which of the following is the BEST next step?

Accepted Answer

Conduct a vendor risk assessment using a security questionnaire. Even with a recent SOC 2 Type II report, the organization should still perform its own vendor risk assessment using a security questionnaire to evaluate controls specific to the engagement, scope, and data sensitivity. A SOC 2 report covers the vendor's controls but does not address the organization's specific risk tolerance, contractual requirements, or gaps not in the report's scope. This is the best next step because it validates and contextualizes the report.

Answer

Accept the SOC 2 report as sufficient evidence

Answer

Perform an on-site audit of the vendor

Answer

Request a new penetration test report from the vendor

Question 6

An organization's security policy defines that all sensitive data must be encrypted. However, a business unit has a legacy application that cannot support encryption without a major rewrite. The risk owner decides to accept the risk. This is an example of which risk treatment strategy?

Accepted Answer

Risk acceptance. Risk acceptance is the correct answer because the risk owner has decided to acknowledge the risk and continue operating without implementing additional controls. The legacy application cannot support encryption without a major rewrite, so the organization chooses to accept the risk rather than mitigate, transfer, or avoid it. This aligns with the definition of risk acceptance as a risk treatment strategy where no action is taken to reduce the risk, and the organization retains the potential consequences.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 7

Which of the following is a key difference between a security guideline and a security procedure?

Accepted Answer

Guidelines are recommended; procedures are mandatory. A security guideline is a recommended, non-mandatory statement of best practice that advises how to align with policy, while a security procedure is a mandatory, step-by-step instruction that must be followed to accomplish a specific task. This distinction in enforceability and specificity is the defining difference between the two document types. Guidelines offer flexibility; procedures prescribe exact actions.

Answer

Both are equally enforceable

Answer

Procedures are high-level; guidelines are detailed

Answer

Guidelines are mandatory; procedures are optional

Question 8

A security manager is reviewing Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for the security program. Which of the following is an example of a KRI?

Accepted Answer

Number of critical vulnerabilities exceeding the risk appetite threshold. A Key Risk Indicator (KRI) measures risk exposure and whether it is approaching or exceeding the organization's risk appetite — the number of critical vulnerabilities exceeding the risk appetite threshold is a direct measure of unacceptable risk exposure. KRIs are forward-looking indicators that signal when risk levels are becoming dangerous.

Answer

Mean time to detect (MTTD) security incidents

Answer

Percentage of systems patched within 30 days

Answer

Number of security incidents per month

Question 9

A company wants to implement continuous compliance monitoring. Which of the following approaches BEST supports this goal?

Accepted Answer

Implementing automated compliance auditing tools. Continuous compliance monitoring requires automated, real-time checks against policies and regulations. Automated auditing tools can continuously assess controls and generate alerts.

Answer

Manual review of compliance reports quarterly

Answer

Deploying a Security Information and Event Management (SIEM) system

Answer

Annual external audits

Question 10

Which risk management framework is specifically designed for U.S. federal agencies and includes a six-step process: Categorize, Select, Implement, Assess, Authorize, and Monitor?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) is the framework specifically designed for U.S. federal agencies and is defined by NIST SP 800-37. It prescribes exactly the six-step process named in the question: Categorize, Select, Implement, Assess, Authorize, and Monitor. This lifecycle aligns with FISMA requirements for federal information systems.

Answer

ISO 27005

Answer

COBIT

Answer

FAIR

Question 11

A healthcare organization subject to HIPAA must ensure that patients can access their medical records. This requirement is an example of which data subject right under privacy regulations?

Accepted Answer

Right to access. The right to access under privacy regulations (including HIPAA's patient rights and GDPR Article 15) gives individuals the ability to obtain a copy of their personal data and confirm what is being processed. HIPAA's Privacy Rule specifically grants patients the right to inspect and obtain a copy of their protected health information. This maps directly to the right to access.

Answer

Right to be forgotten

Answer

Right to data portability

Answer

Right to rectification

Question 12

An organization is using the FAIR framework to quantify risk. The analyst estimates the probable loss event frequency (LEF) as 4 per year and the probable loss magnitude (LM) as $25,000 per event. What is the annualized loss expectancy (ALE) under FAIR?

Accepted Answer

$100,000. Under the FAIR (Factor Analysis of Information Risk) framework, Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 4 events per year and LM = $25,000 per event, so ALE = 4 × $25,000 = $100,000. This represents the expected annual financial loss from the risk scenario.

Answer

$6,250

Answer

$125,000

Answer

$25,000

Question 13

During a policy gap analysis, it is discovered that the organization has a policy stating that sensitive data must be encrypted, but there are no procedures for implementing encryption on mobile devices. This is an example of a gap between:

Accepted Answer

Policy and procedures. A policy states the mandatory 'what' (sensitive data must be encrypted), while procedures describe the step-by-step 'how' (how to enable encryption on mobile devices, which tools, who does it). The gap described is the absence of implementation procedures supporting an existing policy, so it is a policy-to-procedures gap.

Answer

Standards and guidelines

Answer

Policy and standards

Answer

Policy and guidelines

Question 14

An organization is implementing a vendor risk management program and is reviewing a contract that includes a right-to-audit clause. Which THREE of the following are common elements that should be verified during such an audit? (Select THREE.)

Accepted Answer

Access control mechanisms. Option C (Access control mechanisms) is correct because a right-to-audit review must verify that the vendor enforces least privilege, authentication, and authorization controls to protect the organization's data from unauthorized access. Option D (Incident response procedures) is correct because the audit should confirm the vendor has documented detection, containment, eradication, and notification processes, including breach notification timelines, to meet contractual and regulatory obligations. Option E (Data encryption practices) is correct because auditors must verify encryption in transit and at rest, key management, and algorithm standards to ensure data confidentiality and integrity. Option A (Employee satisfaction surveys) is not a security or compliance control relevant to vendor risk, and Option B (Vendor's financial stability) is a business viability concern typically assessed during due diligence rather than a right-to-audit control review.

Answer

Employee satisfaction surveys

Answer

Vendor's financial stability

Question 15

A compliance officer is preparing for an audit and needs to collect evidence. Which TWO of the following are considered acceptable forms of audit evidence? (Select TWO.)

Accepted Answer

Written security policies. Written security policies (C) are acceptable audit evidence because they are documented, approved artifacts that demonstrate the organization's formal security requirements and controls, providing verifiable proof of governance intent. System access logs (E) are acceptable because they are system-generated, tamper-evident records that objectively show actual activity such as authentication events, timestamps, and user actions, which auditors can trace and corroborate. In contrast, screenshots of unofficial reports (A) lack authenticity and provenance since they can be altered and are not from controlled sources, verbal statements from employees (B) are testimonial and unverifiable without documentation, and assumptions about system configurations (D) are unsubstantiated beliefs rather than evidence, so none of these qualify as acceptable audit evidence.

Answer

Screenshots of unofficial reports

Answer

Verbal statements from employees

Answer

Assumptions about system configurations