CAS-004 Governance, Risk and Compliance Practice Test 1 — 15 Questions

Question 1

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Accepted Answer

Adopt a unified control framework such as NIST SP 800-53. Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Answer

Focus only on the most stringent regulation

Answer

Implement automated GRC tools without changing controls

Answer

Maintain separate control sets for each regulation

Question 2

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

Accepted Answer

Require the provider to sign a Business Associate Agreement (BAA). Option B is correct because a BA agreement is required under HIPAA to ensure the provider contractually agrees to safeguard ePHI. Option A is wrong because the risk assessment should drive decisions, not just acceptance. Option C is wrong because encryption does not eliminate the need for contractual protections. Option D is wrong because a SOC 2 report without HIPAA coverage does not suffice.

Answer

Request the provider's most recent SOC 3 report

Answer

Accept the risk and proceed with migration

Answer

Require the provider to encrypt all data at rest and in transit

Question 3

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

Accepted Answer

Include security requirements in contracts and conduct periodic audits. Including security requirements in contracts and conducting periodic audits is the most effective method because it creates a legally binding obligation for vendors to adhere to the organization's security policies, and audits provide direct, verifiable evidence of compliance. Unlike self-assessments or certifications, audits allow the organization to actively inspect controls, configurations, and processes, ensuring ongoing adherence rather than relying on a point-in-time assertion. This approach aligns with the NIST SP 800-53 continuous monitoring framework and is a core principle of third-party risk management (TPRM) in the CAS-004 domain.

Answer

Require vendors to obtain ISO 27001 certification

Answer

Send annual self-assessment questionnaires

Answer

Perform quarterly penetration tests on vendor networks

Question 4

A company's data classification policy labels all financial data as 'Confidential.' An employee accidentally emails a spreadsheet containing customer payment information to an unauthorized external party. Which type of control failure occurred?

Accepted Answer

Preventive control failure. A preventive control failure occurred because the organization lacked a technical safeguard—such as Data Loss Prevention (DLP) rules, email content filtering, or mandatory access controls—to block the outbound transmission of confidential financial data. Preventive controls are designed to stop unauthorized actions before they happen, and the absence of such a mechanism allowed the accidental email to be sent. The failure is not in detection or correction, but in the inability to prevent the data exfiltration at the point of transmission.

Answer

Corrective control failure

Answer

Administrative control failure

Answer

Detective control failure

Question 5

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their impact if disrupted. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the operational and financial impact if they were disrupted. This foundational step determines which systems and functions are essential to the organization's survival, directly informing the selection of recovery strategies and objectives. Without a BIA, continuity planning lacks a data-driven basis for prioritizing resources.

Answer

Identify vulnerabilities and threats

Answer

Determine recovery time objectives (RTOs)

Answer

Develop continuity strategies

Question 6

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. Option B is correct because conducting a single PIA that addresses both regulations is efficient. Option A is wrong because separate PIAs are redundant. Option C is wrong because PIAs should be conducted before processing. Option D is wrong because only high-risk processing is not sufficient for all processing.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data

Question 7

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

Accepted Answer

Avoid the risk by not collecting unnecessary personal data. With a 'low' risk appetite for data privacy, the organization must minimize exposure to privacy breaches. Avoiding the risk by not collecting unnecessary personal data is the most aligned treatment because it eliminates the privacy risk entirely rather than reducing or transferring it. This approach ensures no personal data exists to be compromised, directly supporting a low-risk appetite.

Answer

Transfer the risk through cyber insurance

Answer

Mitigate the risk by encrypting personal data

Answer

Accept the risk and self-insure

Question 8

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

Accepted Answer

The CSP's authorization can be reused, reducing the agency's assessment burden. The primary benefit of using a FedRAMP Authorized CSP is that the CSP has already undergone a rigorous third-party assessment and continuous monitoring process. This allows the agency to reuse the existing authorization (via the 'JAB' or agency Provisional Authorization), significantly reducing the time, cost, and effort required for the agency's own assessment and authorization (ATO) process. It does not eliminate the agency's responsibility for risk management or compliance with FedRAMP Moderate controls, but it leverages the CSP's proven security posture.

Answer

The agency no longer needs to conduct any risk assessments

Answer

The CSP guarantees 100% security

Answer

The system automatically complies with all international regulations

Question 9

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

Accepted Answer

Organizational policy violation. Option D is correct because the employee's action directly violates the company's internal security policy requiring VPN for all remote access. This is a policy violation, not a legal or regulatory one, as the company has established a mandatory rule that the employee failed to follow. The use of a personal device without VPN to access company email is a clear breach of organizational policy, which is a governance issue within the company's risk management framework.

Answer

Legal violation

Answer

Standards violation

Answer

Regulatory compliance violation

Question 10

An organization discovers that a vendor's data breach exposed customer PII. The contract with the vendor does not address breach notification. What is the BEST way to prevent this in the future?

Accepted Answer

Add a breach notification clause in vendor contracts. Adding a breach notification clause directly addresses the contractual gap that left the organization without recourse or timely notification when the vendor suffered a data breach. This contractual remedy ensures that future incidents trigger a predefined notification process, aligning with regulatory requirements such as GDPR or HIPAA that mandate breach notification obligations for data processors. Without such a clause, the organization has no enforceable mechanism to compel the vendor to report breaches, regardless of other risk management activities.

Answer

Purchase cyber insurance covering vendor breaches

Answer

Terminate the vendor relationship immediately

Answer

Conduct more frequent vendor risk assessments

Question 11

A company's risk register shows a high-likelihood, high-impact risk related to ransomware. The cost to mitigate fully is $2M, while the expected annual loss is $500K. Which risk response is most appropriate?

Accepted Answer

Accept the risk and implement monitoring controls. The cost to fully mitigate the ransomware risk is $2M, which far exceeds the expected annual loss of $500K. This makes full mitigation economically unjustifiable under a cost-benefit analysis. Accepting the risk with monitoring controls allows the organization to detect ransomware early and respond, without spending more on prevention than the potential loss itself.

Answer

Avoid the risk by discontinuing use of IT systems

Answer

Mitigate the risk by implementing full endpoint protection

Answer

Transfer the risk via cyber insurance

Question 12

Which TWO of the following are key components of a governance framework? (Select TWO)

Accepted Answer

Policies and procedures. Policies and procedures are foundational to a governance framework because they define the rules, standards, and operational guidelines that an organization must follow to ensure compliance, security, and risk management. They establish the 'what' and 'how' for decision-making and behavior, aligning with frameworks like ISO 27001 or NIST SP 800-53. Without documented policies and procedures, governance lacks enforceable structure and accountability.

Answer

Vulnerability scanning schedule

Answer

Firewall rules

Answer

Penetration test results

Question 13

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Accepted Answer

Permitted and required uses of PHI. A Business Associate Agreement (BAA) must specify the permitted and required uses of Protected Health Information (PHI) by the business associate. This is a core requirement under HIPAA §164.504(e)(2)(i) to ensure the business associate does not use or disclose PHI beyond what is authorized by the covered entity or required by law.

Answer

Indemnification clause for breaches

Answer

Requirement to store data in the United States

Question 14

Which TWO of the following are examples of administrative controls? (Select TWO)

Accepted Answer

Security awareness training. Security awareness training (C) is an administrative control because it involves policies, procedures, and human behavior management rather than technical mechanisms. It educates users on security risks and compliance requirements, reducing the likelihood of social engineering or policy violations. This aligns with the administrative domain of the CIA triad's governance framework.

Answer

Firewall rules

Answer

Encryption of data at rest

Answer

Intrusion detection system

Question 15

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

Accepted Answer

Lack of visibility into vendor security practices. A is correct because organizations often lack visibility into vendor security practices, meaning they cannot verify whether vendors comply with security policies or contractual obligations. This challenge arises when vendors do not provide access to their security controls, audit reports, or real-time monitoring data, leaving gaps in the risk assessment process.

Answer

Over-automation of risk scoring

Answer

Excessive cooperation from vendors