CAS-004 Governance, Risk, and Compliance Practice Test 6 — 15 Questions

Question 1

A security analyst is evaluating security metrics for the security program. Which TWO of the following are considered key performance indicators (KPIs) for measuring the effectiveness of a security program?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patch compliance percentage. KPIs measure the effectiveness of security controls and processes. Mean time to respond (MTTR) measures incident response effectiveness. Patch compliance percentage measures the effectiveness of patch management. Number of vulnerabilities is a KRI, not a KPI per se. Budget spent is a financial metric. Employee satisfaction is HR-related.

Answer

Employee satisfaction score

Answer

Number of critical vulnerabilities identified

Answer

Total budget spent on security

Question 2

A security analyst is calculating the annualized loss expectancy (ALE) for a server that processes credit card data. The server has a $100,000 asset value, and the exposure factor for a security breach is 0.4. Historical data shows that such breaches occur twice per year. What is the ALE?

Accepted Answer

$80,000. ALE = SLE × ARO, where SLE = AV × EF = $100,000 × 0.4 = $40,000, and ARO = 2. So ALE = $40,000 × 2 = $80,000.

Answer

$100,000

Answer

$40,000

Answer

$200,000

Question 3

An organization is implementing a risk management framework and wants to align with a standard that emphasizes a continuous, iterative process for identifying, assessing, and responding to risk. Which framework is most appropriate?

Accepted Answer

NIST RMF. The NIST Risk Management Framework (RMF) describes a continuous process that includes steps like categorize, select, implement, assess, authorize, and monitor.

Answer

FAIR

Answer

ISO 27005

Answer

COBIT

Question 4

A company is conducting a vendor risk assessment and receives a SOC 2 Type II report from a cloud service provider. The report covers a 12-month period and includes an opinion on the effectiveness of controls. Which of the following is the primary benefit of using this report?

Accepted Answer

It offers an independent assessment of control effectiveness over time. SOC 2 Type II reports provide an independent auditor's opinion on the effectiveness of controls over a period, which helps the company assess the vendor's security posture without conducting its own audit.

Answer

It guarantees the vendor is compliant with all regulations

Answer

It eliminates the need for a right-to-audit clause

Answer

It provides real-time monitoring data from the vendor

Question 5

Which of the following risk treatment options involves transferring the financial impact of a risk to a third party, such as through insurance?

Accepted Answer

Transfer. Risk transfer shifts the financial burden to another party, e.g., purchasing cyber insurance.

Answer

Avoid

Answer

Accept

Answer

Mitigate

Question 6

A security manager is reviewing the organization's security policy hierarchy. Which of the following correctly orders these documents from highest to lowest level of authority?

Accepted Answer

Policy, Standard, Guideline, Procedure. The typical hierarchy is: policy (high-level, mandatory), standard (specific requirements), guideline (recommendations), procedure (step-by-step instructions).

Answer

Guideline, Policy, Procedure, Standard

Answer

Standard, Policy, Procedure, Guideline

Answer

Procedure, Guideline, Standard, Policy

Question 7

An organization is implementing a privacy by design approach for a new customer-facing application. Which of the following actions best exemplifies this principle?

Accepted Answer

Minimizing data collection to only what is necessary for the application's function. Privacy by design means embedding privacy into the design and architecture of systems, not as an afterthought. Data minimization (collecting only what is necessary) is a key principle.

Answer

Adding a privacy notice to the application post-launch

Answer

Conducting a privacy impact assessment after the application is deployed

Answer

Encrypting data at rest and in transit

Question 8

Under GDPR, which of the following is a data subject right that allows an individual to request that their personal data be erased?

Accepted Answer

Right to erasure. GDPR Article 17 gives individuals the right to erasure ('right to be forgotten').

Answer

Right to portability

Answer

Right to access

Answer

Right to rectification

Question 9

A security analyst is reviewing metrics for the security program. Which metric best measures the effectiveness of incident response processes?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to remediate an incident, indicating response efficiency.

Answer

Mean time to detect (MTTD)

Answer

Patch compliance percentage

Answer

Number of vulnerabilities by severity

Question 10

Which of the following is a key difference between compliance and security?

Accepted Answer

Compliance typically represents a minimum bar, while security seeks best practice. Compliance focuses on meeting minimum legal or regulatory requirements, while security aims for best practices to protect assets beyond what is required.

Answer

Compliance is voluntary, security is mandatory

Answer

Compliance is proactive, security is reactive

Answer

Security only applies to technical controls, compliance to administrative

Question 11

A company wants to ensure that a third-party vendor allows them to perform an audit of the vendor's security controls. Which clause should be included in the contract?

Accepted Answer

Right-to-audit clause. A right-to-audit clause grants the customer the ability to audit the vendor's security controls.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 12

A security architect is designing a data classification scheme. Which classification level should be used for data that, if disclosed, could cause serious damage to the organization's reputation or financial standing?

Accepted Answer

Restricted. Restricted data is typically the highest level, where unauthorized disclosure could cause severe harm. Confidential is often a lower level.

Answer

Confidential

Answer

Public

Answer

Internal

Question 13

An organization is using the FAIR model to quantify risk. Which of the following is a primary component of the FAIR taxonomy?

Accepted Answer

Loss event frequency and loss magnitude. FAIR decomposes risk into loss event frequency and loss magnitude. These are core components used to calculate risk.

Answer

Inherent risk and residual risk

Answer

Annualized loss expectancy and single loss expectancy

Answer

Threat event frequency and vulnerability

Question 14

A security officer is reviewing continuous compliance monitoring tools. Which TWO of the following are primary benefits of implementing such tools? (Select TWO.)

Accepted Answer

Provides real-time visibility into compliance posture. Continuous monitoring provides real-time visibility and allows for ongoing tracking of controls, enabling quicker detection of non-compliance.

Answer

Guarantees 100% compliance with all regulations

Answer

Replaces the need for a risk management framework

Answer

Eliminates all security risks

Question 15

A healthcare organization is implementing a vendor risk management program. Which THREE of the following should be included in the vendor risk assessment process? (Select THREE.)

Accepted Answer

Reviewing the vendor's SOC 2 Type II report. Effective vendor risk assessment includes reviewing audit reports, performing security questionnaires, and conducting penetration tests to evaluate controls.

Answer

Requiring the vendor to purchase cyber insurance

Answer

Reviewing the vendor's financial statements