CAS-004 Governance, Risk, and Compliance Practice Test 7 — 15 Questions

Question 1

An organization is implementing a privacy by design approach for a new customer-facing application. Which of the following actions best exemplifies this principle?

Accepted Answer

Minimizing data collection to only what is necessary for the application's function. Privacy by design, codified in GDPR Article 25 as 'data protection by design and by default,' requires privacy to be embedded into systems from the outset. Data minimization — collecting only what is strictly necessary for the stated purpose — is a foundational PbD principle because it reduces the attack surface, limits breach impact, and satisfies the 'by default' requirement. It is a design-time decision, not a post-hoc control.

Answer

Adding a privacy notice to the application post-launch

Answer

Conducting a privacy impact assessment after the application is deployed

Answer

Encrypting data at rest and in transit

Question 2

Under GDPR, which of the following is a data subject right that allows an individual to request that their personal data be erased?

Accepted Answer

Right to erasure. The right to erasure (also known as the 'right to be forgotten') is explicitly defined in GDPR Article 17, allowing data subjects to request deletion of their personal data under certain conditions. This is a core data subject right alongside access, rectification, and portability. Option C directly names this right.

Answer

Right to portability

Answer

Right to access

Answer

Right to rectification

Question 3

A security analyst is reviewing metrics for the security program. Which metric best measures the effectiveness of incident response processes?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) measures the average time taken to respond to and resolve incidents, directly reflecting the efficiency of incident response processes. A lower MTTR indicates a more effective and timely response, making it the best metric to assess incident response effectiveness.

Answer

Mean time to detect (MTTD)

Answer

Patch compliance percentage

Answer

Number of vulnerabilities by severity

Question 4

Which of the following is a key difference between compliance and security?

Accepted Answer

Compliance typically represents a minimum bar, while security seeks best practice. Compliance frameworks (PCI DSS, HIPAA, ISO 27001) define a baseline set of controls an organization must satisfy to meet regulatory or contractual obligations — they establish a floor, not a ceiling. Security, by contrast, is an ongoing risk-management discipline that aims to reduce risk to an acceptable level using best practices, defense in depth, and continuous improvement. An organization can be fully compliant yet still be insecure because compliance scopes are narrow and point-in-time, whereas security must address the full threat landscape.

Answer

Compliance is voluntary, security is mandatory

Answer

Compliance is proactive, security is reactive

Answer

Security only applies to technical controls, compliance to administrative

Question 5

A company wants to ensure that a third-party vendor allows them to perform an audit of the vendor's security controls. Which clause should be included in the contract?

Accepted Answer

Right-to-audit clause. A right-to-audit clause explicitly grants the contracting organization the contractual authority to inspect, audit, and verify the vendor's security controls, policies, and practices. Without this clause, the vendor has no legal obligation to permit audits, regardless of what security assurances they claim. This is a foundational third-party risk management control required by frameworks like SOC 2, ISO 27001, and PCI DSS.

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Answer

Service level agreement (SLA)

Question 6

An organization is using the FAIR model to quantify risk. Which of the following is a primary component of the FAIR taxonomy?

Accepted Answer

Loss event frequency and loss magnitude. The FAIR (Factor Analysis of Information Risk) taxonomy decomposes risk into two primary factors: Loss Event Frequency (LEF) — how often a loss event is expected to occur — and Loss Magnitude (LM) — how much loss each event would cause. These two top-level factors are then further decomposed (e.g., LEF into threat event frequency and vulnerability; LM into primary and secondary loss). LEF and LM are the canonical first-level components of the FAIR ontology.

Answer

Inherent risk and residual risk

Answer

Annualized loss expectancy and single loss expectancy

Answer

Threat event frequency and vulnerability

Question 7

A security officer is reviewing continuous compliance monitoring tools. Which TWO of the following are primary benefits of implementing such tools? (Select TWO.)

Accepted Answer

Provides real-time visibility into compliance posture. Option B is correct because continuous compliance monitoring tools continuously collect and analyze telemetry from systems, configurations, and controls, giving organizations real-time (or near-real-time) visibility into their current compliance posture rather than a point-in-time snapshot. Option C is correct because this ongoing tracking allows deviations and drift to be detected as they occur, reducing reliance on infrequent periodic audits and enabling faster remediation. Option A is incorrect because no tool can guarantee 100% compliance with all regulations; compliance depends on people, processes, and legal interpretation, and monitoring only provides evidence and alerts. Option D is incorrect because a risk management framework (such as NIST RMF or ISO 31000) is a governance and process structure that tools support but cannot replace. Option E is incorrect because no tool can eliminate all security risks; monitoring reduces and manages risk but residual risk always remains.

Answer

Guarantees 100% compliance with all regulations

Answer

Replaces the need for a risk management framework

Answer

Eliminates all security risks

Question 8

A security analyst calculates the annual loss expectancy (ALE) for a critical asset. The single loss expectancy (SLE) is $50,000, and the annualized rate of occurrence (ARO) is 0.2. What is the annual loss expectancy?

Accepted Answer

$10,000. Annualized Loss Expectancy is calculated as ALE = SLE × ARO. With SLE = $50,000 and ARO = 0.2 (meaning the loss event is expected 0.2 times per year, i.e., once every five years), ALE = 50,000 × 0.2 = $10,000. This represents the expected yearly financial loss from the risk and is used to justify whether a control costing less than $10,000 per year is worth implementing.

Answer

$0

Answer

$50,200

Answer

$250,000

Question 9

A security architect is designing a data classification scheme aligned with a new privacy regulation. Which THREE of the following are common data classification levels used in enterprise environments? (Select THREE.)

Accepted Answer

Public. Common classification levels include public (no impact), internal (moderate impact), confidential (high impact), and restricted (very high impact). Secret is typically a government classification, not enterprise. Critical is not a standard classification level.

Answer

Critical

Answer

Secret

Question 10

An organization's security team is reviewing security metrics to present to the board. Which THREE of the following are commonly used Key Performance Indicators (KPIs) for a security program? (Select THREE.)

Accepted Answer

Patch compliance percentage. Patch compliance percentage (A) is a valid KPI because it measures the proportion of systems that have current security patches applied within a defined SLA, directly reflecting vulnerability exposure reduction and the effectiveness of patch management. Mean time to respond (B) is a KPI that quantifies the average elapsed time from alert or incident identification to containment/remediation action, showing the operational efficiency of the incident response process. Mean time to detect (E) is a KPI measuring the average time between an actual compromise or event occurring and its detection, which gauges monitoring and detection capability maturity. Number of firewalls deployed (C) is a raw inventory count, not a performance measure, so it is a metric rather than a KPI. Vulnerabilities by severity (D) is a point-in-time risk/volume metric describing the current state, not a performance indicator of the security program's effectiveness over time.

Answer

Number of firewalls deployed

Answer

Vulnerabilities by severity

Question 11

During a compliance audit for PCI DSS, the auditor identifies that cardholder data is stored beyond the required retention period. The organization wants to implement proper data lifecycle management. Which THREE of the following should the organization include in its data retention policy? (Select THREE.)

Accepted Answer

Retention schedules for each data classification level. Option B is correct because a data retention policy must define explicit retention schedules for each data classification level, ensuring cardholder data is not stored beyond the PCI DSS-required period and is deleted when no longer needed. Option C is correct because a legal hold process is essential to suspend scheduled deletion when data is subject to litigation, regulatory investigation, or e-discovery obligations, preventing spoliation while still enforcing lifecycle management. Option E is correct because secure disposal methods (such as NIST SP 800-88 media sanitization, cryptographic erasure, or physical destruction) must be specified for data at end of life to ensure cardholder data cannot be recovered after retention expires. Option A does not belong because encryption for data in transit is a transmission-security control, not a retention lifecycle element. Option D does not belong because the data classification scheme itself is a prerequisite input to the policy, not a retention-specific requirement being asked for here.

Answer

Encryption requirements for data in transit

Answer

Data classification scheme definitions

Question 12

A risk manager is applying the FAIR model to quantify a risk. Which TWO of the following are primary components used in FAIR analysis? (Select TWO.)

Accepted Answer

Loss Magnitude (LM). FAIR model decomposes risk into Loss Event Frequency (LEF) and Loss Magnitude (LM). Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO) are used in quantitative risk analysis (e.g., ALE), but not primary FAIR components. Exposure Factor (EF) is part of SLE calculation. Annual Loss Expectancy (ALE) is a result, not a component.

Answer

Single Loss Expectancy (SLE)

Answer

Annual Loss Expectancy (ALE)

Answer

Annualized Rate of Occurrence (ARO)

Question 13

A multinational financial services firm is preparing to adopt a new enterprise risk management approach. The CISO wants a quantitative method that expresses risk in monetary terms to prioritize investments. Which of the following should the CISO implement?

Accepted Answer

Factor Analysis of Information Risk (FAIR). The CISO needs a quantitative risk analysis method that expresses risk in monetary terms. FAIR is specifically designed to quantify risk in financial terms, enabling prioritization of investments based on potential monetary loss. Other options are either qualitative or framework-oriented without inherent financial quantification.

Answer

NIST Risk Management Framework (RMF)

Answer

OCTAVE Allegro

Answer

ISO/IEC 27005

Question 14

A healthcare organization is implementing a new telehealth platform that stores electronic protected health information (ePHI). The security team must ensure compliance with the HIPAA Security Rule. Which of the following is a required implementation specification for access control under the HIPAA Security Rule?

Accepted Answer

Unique user identification. The HIPAA Security Rule distinguishes between required and addressable implementation specifications. Unique user identification is explicitly required for access control, ensuring accountability and traceability. Addressable specifications like emergency access, automatic logoff, and encryption require a risk-based decision but are not mandatory in all cases.

Answer

Emergency access procedure

Answer

Automatic logoff

Answer

Encryption and decryption

Question 15

A multinational manufacturing firm is expanding into the European Union and must demonstrate accountability for personal data processing under GDPR. The Chief Privacy Officer asks the security team to implement a mechanism that proves the organization's compliance posture to supervisory authorities without requiring prior authorization from them. Which of the following should the team implement?

Accepted Answer

Binding Corporate Rules (BCRs). Binding Corporate Rules are a GDPR-approved mechanism for multinational corporations to establish a comprehensive, legally binding framework for intra-group data transfers and accountability. They are approved by supervisory authorities and eliminate the need for separate authorizations, directly addressing the need to demonstrate compliance posture. SCCs are transfer-specific, Privacy Shield is invalid, and consent is a processing basis, not an accountability mechanism.

Answer

Consent from data subjects

Answer

Standard Contractual Clauses (SCCs)

Answer

Privacy Shield certification