CAS-004 Governance, Risk and Compliance — 40 Questions

Question 1

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Accepted Answer

Adopt a unified control framework such as NIST SP 800-53. Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Answer

Focus only on the most stringent regulation

Answer

Implement automated GRC tools without changing controls

Answer

Maintain separate control sets for each regulation

Question 2

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Option B is correct because a BA agreement is required under HIPAA to ensure the provider contractually agrees to safeguard ePHI. Option A is wrong because the risk assessment should drive decisions, not just acceptance. Option C is wrong because encryption does not eliminate the need for contractual protections. Option D is wrong because a SOC 2 report without HIPAA coverage does not suffice.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 3

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

Accepted Answer

Include security requirements in contracts and conduct periodic audits. Including security requirements in contracts and conducting periodic audits is the most effective method because it creates a legally binding obligation for vendors to adhere to the organization's security policies, and audits provide direct, verifiable evidence of compliance. Unlike self-assessments or certifications, audits allow the organization to actively inspect controls, configurations, and processes, ensuring ongoing adherence rather than relying on a point-in-time assertion. This approach aligns with the NIST SP 800-53 continuous monitoring framework and is a core principle of third-party risk management (TPRM) in the CAS-004 domain.

Answer

Require vendors to obtain ISO 27001 certification

Answer

Send annual self-assessment questionnaires

Answer

Perform quarterly penetration tests on vendor networks

Question 4

A company's data classification policy labels all financial data as 'Confidential.' An employee accidentally emails a spreadsheet containing customer payment information to an unauthorized external party. Which type of control failure occurred?

Accepted Answer

Preventive control failure. A preventive control failure occurred because the organization lacked a technical safeguard—such as Data Loss Prevention (DLP) rules, email content filtering, or mandatory access controls—to block the outbound transmission of confidential financial data. Preventive controls are designed to stop unauthorized actions before they happen, and the absence of such a mechanism allowed the accidental email to be sent. The failure is not in detection or correction, but in the inability to prevent the data exfiltration at the point of transmission.

Answer

Corrective control failure

Answer

Administrative control failure

Answer

Detective control failure

Question 5

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 6

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. Option B is correct because conducting a single PIA that addresses both regulations is efficient. Option A is wrong because separate PIAs are redundant. Option C is wrong because PIAs should be conducted before processing. Option D is wrong because only high-risk processing is not sufficient for all processing.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data

Question 7

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

Accepted Answer

Avoid the risk by not collecting unnecessary personal data. With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

Answer

Transfer the risk through cyber insurance

Answer

Mitigate the risk by encrypting personal data

Answer

Accept the risk and self-insure

Question 8

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 9

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

Accepted Answer

Organizational policy violation. Option D is correct because the employee's action directly violates the company's internal security policy requiring VPN for all remote access. This is a policy violation, not a legal or regulatory one, as the company has established a mandatory rule that the employee failed to follow. The use of a personal device without VPN to access company email is a clear breach of organizational policy, which is a governance issue within the company's risk management framework.

Answer

Legal violation

Answer

Standards violation

Answer

Regulatory compliance violation

Question 10

An organization discovers that a vendor's data breach exposed customer PII. The contract with the vendor does not address breach notification. What is the BEST way to prevent this in the future?

Accepted Answer

Add a breach notification clause in vendor contracts. Adding a breach notification clause directly addresses the contractual gap that left the organization without recourse or timely notification when the vendor suffered a data breach. This contractual remedy ensures that future incidents trigger a predefined notification process, aligning with regulatory requirements such as GDPR or HIPAA that mandate breach notification obligations for data processors. Without such a clause, the organization has no enforceable mechanism to compel the vendor to report breaches, regardless of other risk management activities.

Answer

Purchase cyber insurance covering vendor breaches

Answer

Terminate the vendor relationship immediately

Answer

Conduct more frequent vendor risk assessments

Question 11

A company's risk register shows a high-likelihood, high-impact risk related to ransomware. The cost to mitigate fully is $2M, while the expected annual loss is $500K. Which risk response is most appropriate?

Accepted Answer

Accept the risk and implement monitoring controls. The cost to fully mitigate the ransomware risk is $2M, which far exceeds the expected annual loss of $500K. This makes full mitigation economically unjustifiable under a cost-benefit analysis. Accepting the risk with monitoring controls allows the organization to detect ransomware early and respond, without spending more on prevention than the potential loss itself.

Answer

Avoid the risk by discontinuing use of IT systems

Answer

Mitigate the risk by implementing full endpoint protection

Answer

Transfer the risk via cyber insurance

Question 12

Which TWO of the following are key components of a governance framework? (Select TWO)

Accepted Answer

Policies and procedures. Policies and procedures are foundational to a governance framework because they define the rules, standards, and operational guidelines that an organization must follow to ensure compliance, security, and risk management. They establish the 'what' and 'how' for decision-making and behavior, aligning with frameworks like ISO 27001 or NIST SP 800-53. Without documented policies and procedures, governance lacks enforceable structure and accountability.

Answer

Vulnerability scanning schedule

Answer

Firewall rules

Answer

Penetration test results

Question 13

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Accepted Answer

Permitted and required uses of PHI. A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

Answer

Indemnification clause for breaches

Answer

Requirement to store data in the United States

Question 14

Which TWO of the following are examples of administrative controls? (Select TWO)

Accepted Answer

Security awareness training. Security awareness training (C) is an administrative control because it involves policies, procedures, and human behavior management rather than technical mechanisms. It educates users on security risks and compliance requirements, reducing the likelihood of social engineering or policy violations. This aligns with the administrative domain of the CIA triad's governance framework.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Intrusion detection system

Question 15

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

Accepted Answer

Lack of visibility into vendor security practices. A is correct because organizations often lack visibility into vendor security practices, meaning they cannot verify whether vendors comply with security policies or contractual obligations. This challenge arises when vendors do not provide access to their security controls, audit reports, or real-time monitoring data, leaving gaps in the risk assessment process.

Answer

Over-automation of risk scoring

Answer

Excessive cooperation from vendors

Question 16

You are the security architect for a mid-sized e-commerce company that processes credit card payments. The company must comply with PCI DSS. Currently, the cardholder data environment (CDE) includes a web server, an application server, and a database server, all on the same flat network segment. The QSA has identified that the CDE is not properly segmented, and network access controls are insufficient. The company wants to minimize the scope of PCI compliance by reducing the number of systems that handle cardholder data. You propose implementing network segmentation to isolate the CDE. Which of the following is the most effective approach to reduce PCI scope while maintaining business functionality?

Accepted Answer

Deploy a firewall between the CDE and corporate network, allowing only necessary traffic. Option D is correct because deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.

Answer

Encrypt all cardholder data at rest and in transit

Answer

Replace the database with a tokenization service and remove the database from the CDE

Answer

Move all servers to a DMZ and implement host-based firewalls

Question 17

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

Accepted Answer

Block top secret content and allow confidential content with an override requiring a business justification. Option D is correct because it aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Answer

Encrypt all emails containing any sensitive data and allow delivery

Answer

Block both top secret and confidential content with no override

Answer

Block top secret content and allow confidential content with an audit log

Question 18

A multinational corporation must comply with GDPR, CCPA, and LGPD. The CISO proposes a unified data classification policy. Which approach best minimizes compliance conflicts?

Accepted Answer

Create a unified policy meeting the most stringent requirements of all three regulations. Option B is correct because a unified policy that meets the most stringent requirements of GDPR, CCPA, and LGPD ensures baseline compliance across all jurisdictions without violating any regulation. This approach minimizes conflicts by harmonizing data classification rules, such as consent management and data subject rights, under the highest common denominator, which is GDPR for most provisions like explicit consent and 72-hour breach notification.

Answer

Adopt a unified policy based on GDPR as the strictest regulation

Answer

Use a single policy based on the company's country of incorporation

Answer

Implement separate policies for each regulation

Question 19

A security engineer is reviewing firewall logs and finds multiple failed SSH attempts from an internal IP. Which control should be implemented to reduce this risk?

Accepted Answer

Implement account lockout after 5 failed attempts. Option B is correct because implementing an account lockout policy after a defined number of failed attempts (e.g., 5) directly mitigates brute-force or password-guessing attacks against SSH. This control enforces a threshold that stops automated scripts or manual attempts from continuing, reducing the risk of unauthorized access without blocking legitimate administrative traffic.

Answer

Allow SSH only from a specific management subnet

Answer

Install a host-based IDS on the server

Answer

Disable SSH and use Telnet instead

Question 20

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit