CAS-004 Governance, Risk, and Compliance Practice Test 6 — 15 Questions

Question 1

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $50,000 and an exposure factor (EF) of 0.2. The annualized rate of occurrence (ARO) is estimated at 4. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$40,000. The ALE is calculated as SLE × ARO, where SLE (Single Loss Expectancy) = Asset Value × Exposure Factor. Here, SLE = $50,000 × 0.2 = $10,000, and ARO = 4, so ALE = $10,000 × 4 = $40,000. This represents the expected annual monetary loss from the risk.

Answer

$10,000

Answer

$50,000

Answer

$200,000

Question 2

A company is evaluating a new cloud service provider. The provider offers a SOC 2 Type II report, a third-party penetration test summary, and a completed security questionnaire. However, the company's procurement team discovers that the provider uses a subcontractor for data storage. Which of the following is the BEST next step for the security team?

Accepted Answer

Request a right-to-audit clause covering the subcontractor.. When a cloud provider uses a subcontractor for data storage, the security team should ensure they have the right to audit the subcontractor's controls, typically through a right-to-audit clause in the contract. This allows the company to verify that the subcontractor meets the required security standards. The other options are either too extreme or insufficient.

Answer

Require the provider to use only in-house resources.

Answer

Accept the risk because the provider has a SOC 2 report.

Answer

Immediately terminate the contract due to subcontractor risk.

Question 3

An organization is implementing a privacy program to comply with GDPR. Which of the following BEST describes the concept of 'privacy by design' as it applies to a new customer relationship management (CRM) system?

Accepted Answer

Incorporating data minimization and access controls into the system architecture from the start.. Privacy by design is a foundational GDPR principle (Article 25) requiring data protection to be embedded into systems and processes from the outset, not bolted on afterward. Option A captures this by integrating data minimization and access controls into the CRM's architecture during design, which is exactly what 'by design' means. This proactive approach reduces compliance risk and prevents costly retrofits.

Answer

Assigning a data protection officer to review system logs quarterly.

Answer

Adding a privacy notice to the CRM after deployment.

Answer

Conducting a privacy impact assessment (PIA) after the system is live.

Question 4

A financial institution must comply with the Sarbanes-Oxley Act (SOX). Which of the following is a primary focus of SOX compliance?

Accepted Answer

Accuracy and reliability of financial reporting. SOX is a U.S. federal law enacted in 2002 to protect investors by improving the accuracy and reliability of corporate financial disclosures. Its primary focus is ensuring that financial reporting is accurate, reliable, and subject to internal controls and independent audits. This directly aligns with option D.

Answer

Security of credit card transactions

Answer

Privacy of health information

Answer

Protection of personally identifiable information (PII)

Question 5

After a risk assessment, a company identifies that the residual risk for a critical application is higher than the risk appetite. The risk owner proposes implementing additional controls to reduce the risk further. Which risk treatment option does this represent?

Accepted Answer

Risk mitigation. Risk mitigation involves implementing additional controls to reduce the likelihood or impact of a risk. Since the residual risk exceeds the risk appetite, the risk owner proposes further controls to lower it, which is the definition of risk mitigation. This aligns with the goal of bringing risk within acceptable limits.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 6

A healthcare organization is required to comply with HIPAA. During an audit, the auditor requests evidence of access controls for electronic protected health information (ePHI). Which of the following would be the BEST evidence to provide?

Accepted Answer

Access review logs showing periodic reviews of user permissions. Access review logs showing periodic reviews of user permissions provide direct evidence that access controls are being enforced and monitored over time. HIPAA requires covered entities to implement policies and procedures to authorize and supervise access to ePHI, and periodic reviews demonstrate ongoing compliance. A policy alone does not prove implementation, and training or network diagrams do not show actual access control effectiveness.

Answer

A report of employee security training completion

Answer

A signed copy of the access control policy

Answer

A network diagram of the IT infrastructure

Question 7

An organization wants to implement continuous compliance monitoring for PCI DSS. Which of the following tools would be MOST effective for this purpose?

Accepted Answer

SIEM system. A SIEM (Security Information and Event Management) system is the most effective tool for continuous compliance monitoring because it aggregates and correlates log data from across the environment in real time, providing ongoing visibility into security events and control effectiveness. For PCI DSS, this directly supports requirements like 10.x (logging and monitoring), 11.5 (change detection), and 12.10 (incident response), enabling automated alerts and evidence collection. Unlike point-in-time tools, a SIEM continuously ingests data, making it ideal for demonstrating sustained compliance rather than periodic snapshots.

Answer

Encryption solution

Answer

Network firewall

Answer

Vulnerability scanner

Question 8

A multinational corporation is implementing a data classification scheme. Which of the following data types should be classified as 'restricted'?

Accepted Answer

Customer PII with legal requirements. Customer PII with legal requirements should be classified as 'restricted' because it involves personal data protected by laws and regulations (e.g., GDPR, CCPA), and unauthorized disclosure could lead to legal penalties, financial loss, and reputational damage. Restricted data typically requires the highest level of protection.

Answer

Internal meeting minutes

Answer

Employee training materials

Answer

Marketing brochures

Question 9

During a vendor risk assessment, a third-party vendor refuses to provide a SOC 2 report but offers a completed security questionnaire. The vendor handles sensitive customer data. Which of the following is the BEST course of action?

Accepted Answer

Require a right-to-audit clause to conduct an on-site assessment.. When a vendor handling sensitive customer data refuses to provide a SOC 2 report, the best course is to require a right-to-audit clause in the contract and conduct an on-site assessment. This gives the organization direct assurance over the vendor's controls without relying solely on self-attested questionnaires, which are not independent evidence.

Answer

Immediately terminate the relationship.

Answer

Lower the data classification to reduce risk.

Answer

Accept the questionnaire as sufficient evidence.

Question 10

A security manager is implementing a policy exception management process. Which TWO of the following are essential components of an effective exception management process?

Accepted Answer

A defined expiration date for each exception. An effective exception management process requires a formal request and approval workflow (C) so that each exception is documented, justified, risk-assessed, and authorized by the appropriate authority rather than granted informally. It also requires a defined expiration date for each exception (B), ensuring exceptions are temporary, time-bound, and reviewed or renewed before they become permanent policy gaps. Together, these components provide accountability and limit risk exposure. Option A is wrong because blanket denial of all exceptions is impractical and prevents legitimate business needs from being addressed. Option D is wrong because automatic approval of temporary workarounds bypasses risk review and oversight. Option E is wrong because immediately revising policy to eliminate every exception is not always feasible and does not constitute an exception management process.

Answer

A policy that all exceptions are denied

Answer

Automatic approval for temporary workarounds

Answer

Immediate policy revision to eliminate the need for exceptions

Question 11

A compliance officer is preparing for a GDPR audit. Which THREE of the following are key data subject rights under GDPR that the organization must be able to demonstrate?

Accepted Answer

Right to object to processing. GDPR grants data subjects several rights, including the right to erasure (right to be forgotten), right to data portability, and right to object to processing. The right to rectification is also a right but is not listed as an option. The right to data monetization and right to unlimited storage are not GDPR rights.

Answer

Right to unlimited data storage

Answer

Right to data monetization

Question 12

A security analyst is calculating the annualized loss expectancy (ALE) for a server that has an asset value of $50,000 and an exposure factor (EF) of 0.2. The annualized rate of occurrence (ARO) is estimated at 4. What is the ALE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$80,000. ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE = Asset Value × Exposure Factor = $100,000 × 0.4 = $40,000. ARO = 2 occurrences per year. Therefore ALE = $40,000 × 2 = $80,000.

Answer

$100,000

Answer

$40,000

Answer

$200,000

Question 13

An organization is implementing a risk management framework and wants to align with a standard that emphasizes a continuous, iterative process for identifying, assessing, and responding to risk. Which framework is most appropriate?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) is explicitly designed as a continuous, iterative process for identifying, assessing, and responding to risk. It consists of six steps: Categorize, Select, Implement, Assess, Authorize, and Monitor, which are repeated throughout the system lifecycle. This aligns perfectly with the requirement for a continuous, iterative approach. ISO 27005 provides guidelines for risk management but is not as prescriptive about the continuous process as NIST RMF. FAIR is a quantitative risk analysis methodology, and COBIT is a governance framework for IT management, not specifically a risk management framework with a continuous iterative process.

Answer

FAIR

Answer

ISO 27005

Answer

COBIT

Question 14

A company is conducting a vendor risk assessment and receives a SOC 2 Type II report from a cloud service provider. The report covers a 12-month period and includes an opinion on the effectiveness of controls. Which of the following is the primary benefit of using this report?

Accepted Answer

It offers an independent assessment of control effectiveness over time. A SOC 2 Type II report provides an independent auditor's opinion on the effectiveness of a service organization's controls over a period of time (here, 12 months). This temporal coverage is the key benefit: it demonstrates that controls operated effectively throughout the period, not just on a single date. For vendor risk assessment, this gives assurance about sustained control performance rather than a point-in-time snapshot.

Answer

It guarantees the vendor is compliant with all regulations

Answer

It eliminates the need for a right-to-audit clause

Answer

It provides real-time monitoring data from the vendor

Question 15

Which of the following risk treatment options involves transferring the financial impact of a risk to a third party, such as through insurance?

Accepted Answer

Transfer. Risk transfer shifts the financial consequence of a risk to a third party, most commonly through insurance, contractual indemnification, or outsourcing. The organization retains the risk event's possibility but offloads the monetary impact to another party. This is distinct from avoiding, accepting, or mitigating the risk.

Answer

Avoid

Answer

Accept

Answer

Mitigate