CAS-004 Governance, Risk and Compliance Practice Test 2 — 15 Questions

Question 1

You are the security architect for a mid-sized e-commerce company that processes credit card payments. The company must comply with PCI DSS. Currently, the cardholder data environment (CDE) includes a web server, an application server, and a database server, all on the same flat network segment. The QSA has identified that the CDE is not properly segmented, and network access controls are insufficient. The company wants to minimize the scope of PCI compliance by reducing the number of systems that handle cardholder data. You propose implementing network segmentation to isolate the CDE. Which of the following is the most effective approach to reduce PCI scope while maintaining business functionality?

Accepted Answer

Deploy a firewall between the CDE and corporate network, allowing only necessary traffic. Option D is correct because deploying a firewall between the CDE and the corporate network, and restricting traffic to only what is necessary, creates a proper network segmentation boundary. This isolation reduces the PCI DSS scope by ensuring that only systems within the CDE are subject to the full set of PCI requirements, while the corporate network remains out of scope. The firewall enforces a default-deny policy, which aligns with PCI DSS Requirement 1 for network segmentation and access control.

Answer

Encrypt all cardholder data at rest and in transit

Answer

Replace the database with a tokenization service and remove the database from the CDE

Answer

Move all servers to a DMZ and implement host-based firewalls

Question 2

You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?

Accepted Answer

Block top secret content and allow confidential content with an override requiring a business justification. Option D is correct because it aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.

Answer

Encrypt all emails containing any sensitive data and allow delivery

Answer

Block both top secret and confidential content with no override

Answer

Block top secret content and allow confidential content with an audit log

Question 3

A multinational corporation must comply with GDPR, CCPA, and LGPD. The CISO proposes a unified data classification policy. Which approach best minimizes compliance conflicts?

Accepted Answer

Create a unified policy meeting the most stringent requirements of all three regulations. Option B is correct because a unified policy that meets the most stringent requirements of GDPR, CCPA, and LGPD ensures baseline compliance across all jurisdictions without violating any regulation. This approach minimizes conflicts by harmonizing data classification rules, such as consent management and data subject rights, under the highest common denominator, which is GDPR for most provisions like explicit consent and 72-hour breach notification.

Answer

Adopt a unified policy based on GDPR as the strictest regulation

Answer

Use a single policy based on the company's country of incorporation

Answer

Implement separate policies for each regulation

Question 4

A security engineer is reviewing firewall logs and finds multiple failed SSH attempts from an internal IP. Which control should be implemented to reduce this risk?

Accepted Answer

Implement account lockout after 5 failed attempts. Option B is correct because implementing an account lockout policy after a defined number of failed attempts (e.g., 5) directly mitigates brute-force or password-guessing attacks against SSH. This control enforces a threshold that stops automated scripts or manual attempts from continuing, reducing the risk of unauthorized access without blocking legitimate administrative traffic.

Answer

Allow SSH only from a specific management subnet

Answer

Install a host-based IDS on the server

Answer

Disable SSH and use Telnet instead

Question 5

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit

Question 6

An organization is evaluating risk treatment options for a critical vulnerability with a CVSS score of 9.8. The cost to remediate is $500,000, and the potential loss if exploited is estimated at $2,000,000. Which risk response is most appropriate?

Accepted Answer

Remediate the vulnerability. With a CVSS score of 9.8 (critical) and a potential loss of $2,000,000, the cost to remediate ($500,000) is significantly lower than the expected loss. Remediation reduces the risk to an acceptable residual level, making it the most cost-effective response. This aligns with the principle that when the cost of remediation is less than the potential loss, the organization should directly fix the vulnerability.

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Answer

Avoid the risk by decommissioning the affected system

Question 7

A company's risk assessment identifies that employees often use weak passwords. Which control directly addresses this risk?

Accepted Answer

Enforce a strong password policy. Enforcing a strong password policy directly addresses the risk of weak passwords by mandating complexity, length, and expiration requirements (e.g., minimum 12 characters, mixed case, numbers, symbols). This control reduces the likelihood of successful brute-force or dictionary attacks by increasing the entropy of user credentials. Unlike other options, it specifically targets the root cause—weak password creation—rather than adding compensating controls.

Answer

Conduct security awareness training

Answer

Deploy single sign-on

Answer

Implement multi-factor authentication

Question 8

Which TWO of the following are key elements of a data classification policy?

Accepted Answer

Handling and labeling procedures. Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Answer

Acceptable use guidelines for company devices

Answer

Backup frequency and retention periods

Answer

Encryption algorithms and key lengths

Question 9

Which THREE of the following are required components of a Business Continuity Plan (BCP) per ISO 22301?

Accepted Answer

Scope and policy for business continuity. ISO 22301 mandates that a Business Continuity Plan (BCP) must include the scope and policy for business continuity (Option B) to define the boundaries and objectives of the BCP. This ensures alignment with organizational strategy and compliance requirements, as specified in Clause 4.3 (Scope) and Clause 5.2 (Policy) of the standard.

Answer

Detailed technical recovery procedures for IT systems

Answer

Vulnerability scanner configuration

Question 10

An auditor reviews this IAM policy attached to a user group. What is the primary compliance concern?

Accepted Answer

The policy violates the principle of least privilege. Option C is correct because the IAM policy grants wildcard actions (Action: '*') on all resources (Resource: '*'), which violates the principle of least privilege by allowing any user in the group to perform any operation on any resource. This broad permission set creates an excessive attack surface and is a primary compliance concern under frameworks like NIST SP 800-53 or PCI DSS, which require restricting access to only what is necessary for job functions.

Answer

The policy restricts access to specific resources

Answer

The policy does not enable logging

Answer

The policy does not allow any actions

Question 11

A security analyst reviews this output from an SSH session. What security control is in place on the remote server?

Accepted Answer

MaxAuthTries limit in SSH configuration. The output shows repeated 'Permission denied' messages followed by 'Connection closed by remote host' after a specific number of attempts. This behavior is characteristic of the MaxAuthTries directive in the SSH server configuration (sshd_config), which limits the number of authentication attempts per connection. When the limit is reached, the SSH server immediately closes the connection, as seen in the output.

Answer

Account lockout policy

Answer

Fail2ban or similar IP blocking

Answer

SSH banner

Question 12

A financial institution must ensure that its data classification policy aligns with regulatory requirements for customer financial information. Which of the following actions best demonstrates governance in this context?

Accepted Answer

Implement a formal data classification policy that maps data types to regulatory categories and enforce it via technical controls.. Option A is correct because it directly implements governance by establishing a formal data classification policy that maps data types to specific regulatory categories (e.g., PCI DSS, GLBA, SOX) and enforces compliance through technical controls such as Data Loss Prevention (DLP) rules, access control lists (ACLs), and encryption policies. This structured approach ensures that customer financial information is consistently protected according to legal requirements, rather than relying on ad-hoc or incomplete measures.

Answer

Restrict all customer financial data to a single secure server without labeling.

Answer

Allow data owners to classify data on an ad-hoc basis as needed.

Answer

Encrypt all customer data at rest and in transit regardless of classification.

Question 13

A security analyst is reviewing the results of a vulnerability scan and identifies a critical vulnerability in a legacy application that cannot be patched because it is no longer supported by the vendor. The application is critical for business operations. Which of the following risk treatment strategies should the organization implement?

Accepted Answer

Risk acceptance with compensating controls such as network segmentation and strict access controls.. Option D is correct because when a legacy application cannot be patched due to vendor end-of-life, the organization must accept the residual risk while implementing compensating controls. Network segmentation (e.g., VLANs, ACLs) and strict access controls (e.g., least privilege, MFA) reduce the attack surface and contain potential exploitation, aligning with the risk acceptance strategy under the NIST SP 800-37 risk management framework.

Answer

Risk transfer by purchasing cyber insurance to cover potential losses.

Answer

Risk mitigation by applying a vendor-supplied patch.

Answer

Risk avoidance by decommissioning the application and migrating to a new system.

Question 14

During a third-party risk assessment, an organization discovers that a cloud service provider (CSP) stores data in a jurisdiction with conflicting privacy laws. The organization's legal team advises that this could expose the organization to regulatory penalties. Which of the following contractual clauses would best address this compliance risk?

Accepted Answer

Include a Data Processing Agreement (DPA) that requires data to be stored only in approved jurisdictions.. A Data Processing Agreement (DPA) is the correct contractual mechanism to enforce data residency restrictions. By requiring the CSP to store data only in approved jurisdictions, the DPA directly addresses the compliance risk of conflicting privacy laws and potential regulatory penalties, as it legally binds the provider to specific geographic data handling requirements.

Answer

Insert a right-to-audit clause allowing the organization to inspect the CSP's facilities.

Answer

Negotiate a service-level agreement (SLA) guaranteeing 99.99% uptime.

Answer

Require the CSP to sign a business associate agreement (BAA) under HIPAA.

Question 15

An organization is implementing a governance framework to ensure that security controls are aligned with business objectives. Which of the following frameworks is specifically designed for this purpose?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed to align IT governance and security controls with business objectives by providing a comprehensive framework that links business goals to IT goals and enablers. It focuses on governance of enterprise IT (GEIT), ensuring that security investments and controls directly support strategic business outcomes, unlike other frameworks that are more operational or compliance-focused.

Answer

NIST SP 800-53

Answer

ITIL 4

Answer

ISO/IEC 27001