CAS-004 Governance, Risk, and Compliance Practice Test 9 — 15 Questions

Question 1

A security governance committee is reviewing the organization's risk register after a merger. The committee wants to apply risk treatment strategies that transfer or share risk with another party rather than reducing it internally. Which two actions represent risk transference? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outsourcing the payment card processing function to a PCI DSS validated third-party service provider under contract.. Risk transference shifts the financial or operational consequence to another party. Cyber insurance and outsourcing card processing to a validated provider both move risk to external entities through contracts or policies, whereas detection controls, acceptance, and diversification change or retain the risk internally.

Answer

Deploying endpoint detection and response agents across all workstations to catch malicious activity earlier.

Answer

Diversifying the cloud provider portfolio so no single vendor outage halts all critical services.

Answer

Accepting the risk of a legacy application because remediation cost exceeds the potential loss.

Question 2

A multinational retailer must comply with PCI DSS v4.0 for its cardholder data environment. The security manager is asked to define the scope of the CDE. Which of the following best describes the first step in scoping the CDE according to PCI DSS?

Accepted Answer

Identify all system components that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD).. The correct answer is to identify all system components that store, process, or transmit CHD or SAD. PCI DSS scoping requires a thorough inventory of people, processes, and technologies that handle cardholder data or could impact its security. This inventory forms the basis for defining the CDE and determining which requirements apply. Without it, segmentation and validation efforts are misdirected.

Answer

Conduct a penetration test on all internet-facing systems to determine which ones are in scope.

Answer

Review the PCI DSS Self-Assessment Questionnaire (SAQ) to determine which requirements apply.

Answer

Segment the network by placing all cardholder data systems behind a firewall and then document the segmentation.

Question 3

A security architect is designing a new system that processes sensitive customer data. The organization must comply with multiple regulations, including GDPR and PCI DSS. The architect needs to ensure that data protection controls are integrated from the outset. Which approach best aligns with the principle of privacy by design?

Accepted Answer

Conduct a data protection impact assessment (DPIA) before development begins.. Conducting a data protection impact assessment before development begins is a core privacy by design practice. It proactively identifies privacy risks and ensures controls are integrated into the system architecture from the start. Encryption after deployment, default settings, and consent are either reactive or insufficient to meet the principle of privacy by design.

Answer

Obtain consent from all customers for data processing.

Answer

Rely on the cloud provider's default security settings.

Answer

Implement encryption for data at rest after the system is deployed.

Question 4

A security analyst is reviewing the organization's incident response plan. The plan includes a section on communication with external parties. Which of the following best describes the primary purpose of a communication plan during a security incident?

Accepted Answer

To ensure timely and accurate information sharing with stakeholders, regulators, and the public.. The communication plan is a component of incident response that focuses on information sharing with stakeholders, including executives, legal, regulators, and customers. Its primary goal is to ensure timely, accurate, and compliant messaging. Technical containment and evidence handling are separate processes, making the stakeholder communication purpose the correct choice.

Answer

To outline the technical steps for containing the incident.

Answer

To document the chain of custody for forensic evidence.

Answer

To provide technical details of the incident to the security operations team.

Question 5

A security analyst is reviewing the organization's incident response plan and notices that it lacks a formal process for communicating with external stakeholders during a breach. Which of the following should the analyst recommend to address this gap?

Accepted Answer

Develop a communication plan that includes predefined templates, contact lists, and approval workflows for external notifications.. A formal communication plan with predefined templates, contact lists, and approval workflows ensures that external stakeholders receive timely, accurate, and authorized information during a breach. This directly addresses the identified gap. SIEM, tabletop exercises, and insurance do not provide the structured communication process required.

Answer

Increase the cyber insurance coverage to include crisis management services.

Answer

Implement a security information and event management (SIEM) system to automate alerting of external parties.

Answer

Conduct a tabletop exercise to test the existing incident response plan without modifying it.

Question 6

A software company is pursuing ISO/IEC 27001 certification. The ISMS scope covers its cloud-hosted product and corporate IT. An auditor requests evidence that management reviews the ISMS at planned intervals. Which artifact should the security manager provide?

Accepted Answer

Management review meeting minutes with inputs, decisions, and actions. Clause 9.3 of ISO/IEC 27001 mandates that top management review the ISMS at planned intervals, considering status of actions, changes, performance feedback, and risk assessment results. Documented minutes capturing inputs, decisions, and resulting actions are the direct evidence auditors seek. Other artifacts such as internal audit reports or the Statement of Applicability may feed the review but do not demonstrate that it took place.

Answer

The latest internal audit report and nonconformity log

Answer

Business continuity and disaster recovery test results

Answer

The Statement of Applicability listing implemented controls

Question 7

A retail company is building a new mobile application that will collect customer location data. The legal team asks the security manager to ensure the design follows privacy by design principles from the earliest stages. Which action best demonstrates privacy by design in this scenario?

Accepted Answer

Perform a privacy impact assessment and design data minimization controls before development begins. Privacy by design means embedding privacy into systems and processes from the outset, not retrofitting it later. An early privacy impact assessment combined with data minimization controls during design directly implements that principle. The other actions either collect excessive data, react after release, or rely on a single control that does not address purpose limitation and minimization, so they do not meet the legal team's request.

Answer

Add a privacy policy link to the application store listing after the application is released

Answer

Encrypt location data at rest and assume that encryption alone satisfies privacy requirements

Answer

Collect precise location data continuously so that future marketing features have a rich data set

Question 8

A multinational retailer operates under GDPR for its EU customers and must demonstrate accountability to supervisory authorities. The Chief Privacy Officer wants a mechanism that documents, on an ongoing basis, which processing activities occur, what data categories are involved, and how long each is retained. Which GDPR instrument should the privacy team maintain to satisfy this requirement?

Accepted Answer

Records of Processing Activities (RoPA) under Article 30. The Records of Processing Activities is the Article 30 accountability instrument that captures processing purposes, data categories, recipients, retention, and safeguards in one maintained register. A DPIA analyses a single high-risk activity, while SCCs and BCRs are cross-border transfer mechanisms. Only the RoPA provides the persistent, organization-wide documentation the retailer needs to show supervisory authorities how EU personal data is handled and retained.

Answer

Standard Contractual Clauses (SCCs)

Answer

Binding Corporate Rules (BCRs)

Answer

Data Protection Impact Assessment (DPIA)

Question 9

A newly hired Chief Information Security Officer is establishing a governance structure and wants to define who is accountable for accepting residual risk that exceeds the organization's stated risk appetite. According to common governance practice, which role holds that accountability?

Accepted Answer

The board of directors or an executive risk committee with authority delegated by the board.. Governance accountability for accepting risk beyond the approved appetite belongs to the board of directors or a delegated executive risk committee. Operational and assurance roles support risk management but do not own the decision to retain risk at the enterprise level.

Answer

The internal audit director who reports findings to the audit committee.

Answer

The third-party managed security service provider under the outsourcing agreement.

Answer

The security operations center manager who oversees day-to-day monitoring and incident response.

Question 10

A financial services firm is undergoing a SOC 2 Type II examination. The auditor asks the CISO to demonstrate that the organization continuously monitors whether the controls described in the system description operated effectively throughout the review period. Which activity should the CISO present as the primary evidence supporting this requirement?

Accepted Answer

Collecting and retaining timestamped system-generated logs and control execution records across the entire audit period. SOC 2 Type II differs from Type I because it reports on control operating effectiveness over a period rather than design at a point in time. The strongest evidence is contemporaneous, system-generated, and timestamped, covering the full window. Signed questionnaires, single penetration tests, and policy manuals only show intent or a snapshot, so they cannot demonstrate that the described controls ran effectively on an ongoing basis.

Answer

Delivering the organization's information security policy manual and a list of planned future controls

Answer

Scheduling a one-time penetration test two weeks before the auditor's fieldwork begins

Answer

Providing a completed security questionnaire signed by the CISO on the last day of the audit period

Question 11

A multinational financial services firm must comply with the General Data Protection Regulation (GDPR). The Chief Information Security Officer (CISO) asks the security team to implement a mechanism that allows data subjects to request and receive a copy of their personal data in a structured, commonly used, and machine-readable format. Which of the following technical controls BEST addresses this requirement?

Accepted Answer

Implement an API endpoint that allows authenticated data subjects to download their personal data in JSON or CSV format.. The GDPR grants data subjects the right to data portability, which requires organizations to provide personal data in a structured, commonly used, and machine-readable format. An API endpoint that allows authenticated users to download their data in JSON or CSV directly satisfies this requirement. Other controls like DLP, encryption, or retention policies address different GDPR obligations and do not enable data subject access requests.

Answer

Establish a records retention policy that automatically deletes personal data after a defined period.

Answer

Deploy a data loss prevention (DLP) solution to monitor and block unauthorized exfiltration of personal data.

Answer

Configure database encryption at rest using Transparent Data Encryption (TDE) to protect personal data.

Question 12

A financial institution is adopting a risk management framework based on NIST SP 800-37. The CISO wants to ensure that risk responses are integrated into the enterprise architecture. Which of the following activities best supports this integration during the Risk Response step?

Accepted Answer

Mapping selected security controls to specific architectural components and documenting the relationships.. Mapping selected security controls to architectural components is the key activity that integrates risk responses into enterprise architecture. NIST SP 800-37's Risk Response step involves selecting controls, allocating them to systems, and documenting how they are implemented. By explicitly linking controls to architecture, the organization ensures that risk mitigation is designed into systems rather than bolted on later. This supports traceability and continuous monitoring.

Answer

Developing a risk register that lists identified risks and their owners.

Answer

Performing a business impact analysis (BIA) to identify critical business processes.

Answer

Conducting a tabletop exercise to validate the effectiveness of the risk response plan.

Question 13

A security architect is designing a new cloud-based system that must comply with the Payment Card Industry Data Security Standard (PCI DSS). The architect needs to ensure that cardholder data is protected both at rest and in transit. Which TWO of the following controls are required by PCI DSS to protect cardholder data in this scenario? (Choose two.)

Accepted Answer

Render primary account numbers (PAN) unreadable anywhere they are stored.. PCI DSS explicitly requires encrypting cardholder data during transmission over open, public networks (Requirement 4) and rendering stored PAN unreadable (Requirement 3). These two controls directly protect data in transit and at rest. WAF, physical access, and vulnerability scans are important but do not specifically fulfill the data protection requirements for those states.

Answer

Restrict physical access to cardholder data storage systems.

Answer

Conduct quarterly external and internal vulnerability scans.

Answer

Implement a web application firewall (WAF) in front of all public-facing web servers.

Question 14

A financial services firm's third-party risk team is onboarding a new SaaS payroll provider. The provider refuses to share its internal audit reports but will allow the firm to send its own assessor on-site to inspect the provider's controls. Which risk assessment method should the firm use to obtain assurance in this situation?

Accepted Answer

On-site assessment performed by the firm's own assessors. Because the provider withholds internal audit reports yet allows assessors on-site, the only method that yields independently verified, first-hand evidence of control effectiveness is a direct on-site assessment. Self-assessments and certifications provide weaker, provider-controlled evidence, and the SOC 2 report is unavailable by the provider's own refusal, leaving the on-site inspection as the reliable path.

Answer

Review of the provider's SOC 2 Type I report

Answer

Acceptance of the provider's ISO/IEC 27001 certificate as sufficient evidence

Answer

Self-assessment questionnaire completed by the provider's security team

Question 15

A financial services firm is selecting a cloud provider to host regulated customer data. The vendor risk team wants contractual language that lets the firm independently verify the provider's security posture over time rather than relying only on the provider's self-reported questionnaires. (Choose two.)

Accepted Answer

A clause requiring the provider to deliver current SOC 2 Type II reports at least annually. Ongoing independent visibility into a provider's security posture requires contractual rights that produce evidence rather than self-reporting. A right-to-audit establishes the legal ability to inspect and test controls, and a requirement for current SOC 2 Type II reports supplies recurring auditor-attested evidence of control effectiveness. Uptime SLAs, liability caps, and pricing clauses govern availability, financial exposure, and cost, none of which verify how the provider actually secures regulated data.

Answer

A limitation-of-liability cap tied to twelve months of fees

Answer

A service level agreement specifying 99.99% uptime credits

Answer

A most-favored-nation pricing clause