CAS-004 Governance, Risk, and Compliance Practice Test 8 — 15 Questions

Question 1

A multinational retailer is expanding into the European Union and must transfer employee payroll data from its EU subsidiary to its US-based HR platform. Legal counsel recommends relying on the EU-US Data Privacy Framework rather than implementing Standard Contractual Clauses. Which action must the retailer take FIRST to rely on this transfer mechanism?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the US HR platform is listed as an active participant on the Data Privacy Framework List maintained by the US Department of Commerce.. The EU-US Data Privacy Framework permits transfers to US importers that have self-certified and appear on the Department of Commerce's Data Privacy Framework List. Verifying that the HR platform holds active certification is the foundational requirement; without it, the framework cannot be invoked and another transfer tool would be needed.

Answer

Obtain explicit consent from every EU employee before the payroll records are transmitted to the US platform.

Answer

Conduct a Transfer Impact Assessment documenting that US surveillance laws do not undermine the protection of the payroll data.

Answer

Execute a Binding Corporate Rules application with the lead supervisory authority in the EU member state where the subsidiary is established.

Question 2

A financial services company is conducting a risk assessment for a new online banking platform. The risk team must prioritize identified risks. Which TWO of the following factors are most critical in determining the priority for risk treatment? (Choose two.)

Accepted Answer

Potential impact on business objectives. Risk prioritization hinges on assessing the likelihood of a risk event and its potential impact on business objectives. These two factors form the basis of risk scoring (e.g., risk = likelihood × impact) and guide where to focus treatment efforts. Cost, vendor market share, and vulnerability counts are secondary or irrelevant to determining which risks are most urgent for the online banking platform.

Answer

Number of open vulnerabilities

Answer

Vendor's market share

Answer

Cost of the security control

Question 3

A security manager is developing a third-party risk management program. The organization wants to ensure that vendors handling sensitive data are subject to appropriate oversight. Which two of the following are the most effective methods for ongoing monitoring of a vendor's security posture? (Choose two.)

Accepted Answer

Conducting periodic on-site security assessments of the vendor. Effective ongoing vendor monitoring requires objective, independent evidence of security controls. SOC 2 Type II reports provide third-party attestation over time, and periodic on-site assessments allow direct verification. Other options like marketing materials, self-attestation, and stock price monitoring lack the rigor and specificity needed for security oversight.

Answer

Asking the vendor to self-attest to security compliance annually

Answer

Reviewing the vendor's marketing materials for security claims

Answer

Monitoring the vendor's stock price for fluctuations

Question 4

A defense contractor must comply with DFARS clause 252.204-7012 and achieve a passing score in its NIST SP 800-171 self-assessment before a contract award. The security lead discovers that several controls in the CUI environment are only partially implemented. Which action should the security lead take to meet the assessment requirement?

Accepted Answer

Document a plan of action with milestones to remediate the partially implemented controls and complete a System Security Plan describing the current state.. When controls are not fully implemented, the accepted method is to document the current state in a System Security Plan and describe remediation in a Plan of Action with milestones. This preserves an honest score while showing the contracting officer a credible path to full implementation.

Answer

Request a variance from the contracting officer to exclude the unimplemented controls from the assessment scope.

Answer

Submit the self-assessment with a perfect score and remediate the gaps after contract award within the first performance period.

Answer

Implement a compensating control for each partial control and claim full credit in the score to reach the required total.

Question 5

A multinational financial services firm is subject to GDPR and must transfer personal data from its EU offices to a data analytics vendor in the United States. The vendor is not certified under the EU-U.S. Data Privacy Framework. Which mechanism should the firm use to lawfully transfer the data while meeting GDPR Chapter V requirements?

Accepted Answer

Standard Contractual Clauses (SCCs) with a transfer impact assessment. Because the U.S. vendor lacks Data Privacy Framework certification, the firm must rely on an Article 46 safeguard. Standard Contractual Clauses are the European Commission's pre-approved contractual terms for such transfers, and after Schrems II they must be supplemented by a transfer impact assessment evaluating the destination's surveillance laws. This combination lawfully supports routine transfers to the analytics provider.

Answer

Obtaining explicit consent from every data subject for each transfer

Answer

Relying on the vendor's ISO/IEC 27001 certification as an adequacy mechanism

Answer

Binding Corporate Rules (BCRs) approved by the lead supervisory authority

Question 6

A multinational financial services firm is expanding operations into the European Union. The legal team asks the security architect to ensure the new customer onboarding portal complies with the General Data Protection Regulation (GDPR). Which of the following should the security architect implement FIRST to align with GDPR's data protection principles?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) for the portal's processing activities.. GDPR emphasizes a risk-based approach, requiring organizations to assess privacy risks before processing personal data. A Data Protection Impact Assessment (DPIA) is specifically mandated for high-risk processing and helps identify and mitigate risks, ensuring compliance by design. Other controls like encryption or WAFs are supportive but not the initial compliance step.

Answer

Implement encryption for all data at rest and in transit.

Answer

Deploy a web application firewall (WAF) to block SQL injection attacks.

Answer

Appoint a Data Protection Officer (DPO) to oversee the portal.

Question 7

A security analyst is reviewing the organization's risk register and notices a risk that has been assigned a risk score of 15 on a scale of 1 to 25. The risk owner has decided to purchase cyber insurance to transfer the financial impact of the risk. Which risk treatment strategy is being applied?

Accepted Answer

Risk transfer. Purchasing cyber insurance shifts the financial consequences of a risk to an insurer, which is the definition of risk transfer. Risk avoidance would eliminate the activity, mitigation would reduce likelihood or impact, and acceptance would involve bearing the risk without transfer. The scenario clearly describes transfer.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk avoidance

Question 8

A multinational financial services firm is expanding operations into a new jurisdiction. The legal team has identified that the new country requires all personal data of its citizens to be stored on servers physically located within its borders. The security architect must recommend an approach that satisfies this requirement while maintaining the firm's global security standards. Which of the following should the architect recommend?

Accepted Answer

Implement data localization by deploying dedicated infrastructure in the new jurisdiction and applying the firm's global security baselines to those systems.. Data localization laws require that personal data of a jurisdiction's citizens be stored on physical servers within that jurisdiction. Deploying dedicated in-country infrastructure and applying the organization's global security baselines directly satisfies this legal requirement while ensuring consistent security controls. Other options either store data outside the jurisdiction or fail to guarantee in-country residency.

Answer

Implement tokenization so that only non-sensitive tokens are stored in the new jurisdiction while actual data remains in the central repository.

Answer

Use a content delivery network (CDN) to cache personal data at edge locations closest to the new jurisdiction's users.

Answer

Encrypt all personal data with customer-managed keys and store it in the firm's existing central data center.

Question 9

A multinational financial services firm is aligning its enterprise risk management program with the NIST Risk Management Framework (RMF). The Chief Risk Officer wants to ensure that risk response decisions are formally authorized before changes are made to production systems. Which RMF step is responsible for providing that authorization?

Accepted Answer

Authorize the system. Authorization is the RMF step where an authorizing official formally accepts residual risk and permits the system to operate. It follows categorization, control selection, implementation, and assessment, and it is the point at which risk decisions become official. Continuous monitoring then sustains that authorization over time. Because the CRO requires formal risk acceptance before production changes, the Authorize step is the correct fit.

Answer

Assess security controls

Answer

Categorize the system

Answer

Monitor security controls

Question 10

A financial services firm operates in several countries and must demonstrate that its security controls are effective and independently validated for regulators and enterprise customers. Executives want a report that auditors can rely on regarding the design and operating effectiveness of controls over a period of time. Which document should the security team provide?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the appropriate artifact because it attests to both the design and operating effectiveness of controls across a defined period. Type I reports only cover design at a point in time, and the other documents do not provide period-wide control testing evidence.

Answer

SOC 2 Type I report

Answer

SOC 3 general use report

Answer

ISO/IEC 27001 certificate

Question 11

A CISO is presenting a risk register to the board. The register shows a ransomware risk with a single loss expectancy of $2,000,000 and an annualized rate of occurrence of 0.25. The board asks for the expected annual financial exposure. What is the annualized loss expectancy (ALE) for this risk?

Accepted Answer

$500,000. Quantitative risk analysis uses ALE = SLE × ARO. With a single loss expectancy of $2,000,000 and an annualized rate of occurrence of 0.25, the expected annual loss is $500,000. This metric lets the board compare the cost of controls against the financial exposure and decide whether to mitigate, transfer, or accept the ransomware risk.

Answer

$8,000,000

Answer

$2,000,000

Answer

$250,000

Question 12

A security manager at a defense contractor is reviewing the organization's risk register. A critical vulnerability in a widely used open-source library has been identified. The vendor has not released a patch, and the library is embedded in a custom application that cannot be easily replaced. The manager decides to implement a virtual patching solution at the network perimeter. Which risk treatment strategy does this represent?

Accepted Answer

Risk mitigation. Virtual patching is a compensating control that reduces the likelihood of exploitation by filtering malicious traffic. Since the underlying vulnerability remains but its risk is lowered, this is risk mitigation. Transfer, acceptance, and avoidance do not involve actively reducing the risk through controls, making mitigation the correct classification.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk acceptance

Question 13

A security manager is reviewing the organization's risk register and notes that a critical vulnerability in a legacy application has been accepted for two years. The business owner argues that the cost of remediation exceeds the potential loss. The security manager must present an alternative that aligns with the organization's risk appetite while addressing the residual risk. Which of the following is the BEST recommendation?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring to reduce the likelihood and impact of exploitation.. Compensating controls reduce residual risk when remediation is not feasible, aligning with the organization's risk appetite by lowering likelihood and impact without the full cost of replacing the legacy system. Risk transfer, acceptance without action, and avoidance all fail to address the residual risk appropriately in this context.

Answer

Transfer the risk by purchasing cyber insurance that covers losses from exploitation of the legacy application.

Answer

Avoid the risk by decommissioning the legacy application immediately, regardless of business impact.

Answer

Accept the risk permanently and document the business owner's decision in the risk register without further action.

Question 14

A security architect is designing a new system that will process personal data of European Union citizens. The architect must ensure that data protection principles are embedded into the design. Which of the following best exemplifies the principle of data minimization under the General Data Protection Regulation (GDPR)?

Accepted Answer

Collecting only the personal data that is necessary for the specified purpose. Data minimization under GDPR means collecting and processing only the personal data that is necessary for the intended purpose. This principle is about limiting the scope of data collection, not about security measures, legal bases, or retention periods. The other options represent different GDPR principles or requirements.

Answer

Encrypting all personal data at rest and in transit

Answer

Obtaining explicit consent before processing personal data

Answer

Implementing a retention schedule to delete data after a set period

Question 15

A software company is preparing to release a new payment feature that processes cardholder data. The security architect must ensure the feature design meets PCI DSS requirements for protecting stored data and for securing transmission over open, public networks. Which two design choices satisfy these requirements? (Choose two.)

Accepted Answer

Enable TLS 1.2 or higher with strong cipher suites for all payment traffic traversing the internet. The two correct design choices are tokenization with a hardened token vault and strong TLS for data in transit. Tokenization reduces the value of stored data and can shrink the cardholder data environment, while TLS 1.2 or higher with strong ciphers protects data moving across open, public networks. Together they address both the storage and transmission requirements in the scenario without relying on a third party's compliance to cover the organization's own obligations.

Answer

Disable audit logging for the payment feature to reduce storage of sensitive data

Answer

Store the full primary account number encrypted with a documented key management process

Answer

Rely on the payment processor's PCI DSS compliance certificate and transmit card data without additional encryption