CAS-004 Governance, Risk and Compliance Practice Test 5 — 15 Questions

Question 1

During a third-party risk assessment, a security architect discovers that a vendor's data retention policy does not align with the organization's legal requirements. Which of the following is the BEST course of action?

Accepted Answer

Request the vendor to update its retention policy to align with legal requirements.. Option D is correct because the best first step is to request the vendor to comply, as termination or acceptance are premature.

Answer

Accept the risk and document it in the risk register.

Answer

Immediately terminate the vendor contract.

Answer

Implement compensating controls to enforce data deletion after the required period.

Question 2

Which of the following is the PRIMARY purpose of a business continuity plan (BCP)?

Accepted Answer

Ensure critical business functions continue during a disruption.. Option C is correct because a BCP aims to sustain critical business processes, not just IT recovery.

Answer

Assign roles for incident response.

Answer

Restore IT systems after a disaster.

Answer

Establish procedures for data backup.

Question 3

Which TWO of the following are key components of a risk assessment methodology?

Accepted Answer

Threat identification.. Threat identification and asset inventory are core components of a risk assessment, while risk appetite is a guiding parameter.

Answer

Disaster recovery.

Answer

Risk appetite.

Answer

Incident response.

Question 4

Which THREE of the following are required for PCI DSS compliance regarding cardholder data?

Accepted Answer

Maintain a vulnerability management program.. PCI DSS requires encryption of transmissions (Req 4), access restriction (Req 7), and vulnerability management (Req 6/11). MFA for physical access is not required; data storage after authorization is limited.

Answer

Store cardholder data after authorization.

Answer

Implement multifactor authentication for all physical access to data centers.

Question 5

Refer to the exhibit. Which of the following best describes the effect of this ACL?

Accepted Answer

Blocks all traffic to the 10.0.0.0/24 network.. Option B is correct because the ACL explicitly denies all traffic destined to the 10.0.0.0/24 network.

Answer

Blocks all traffic from the 10.0.0.0/24 network.

Answer

Permits all traffic to the 10.0.0.0/24 network.

Answer

Permits all traffic from the 10.0.0.0/24 network.

Question 6

A security architect is designing a data classification scheme. Which of the following is the MOST effective way to ensure consistent labeling across the organization?

Accepted Answer

Automated classification based on data content.. Option D is correct because automated classification minimizes human error and provides uniform application of labels.

Answer

Implementing DLP solutions.

Answer

Manual labeling by data owners.

Answer

User training and awareness.

Question 7

During an audit, a compliance officer finds that the organization has not conducted a risk assessment in over two years. Which of the following is the MOST significant risk?

Accepted Answer

Non-compliance with regulatory fines.. Option C is correct because regulatory fines can be substantial and are directly tied to compliance requirements, making it the most significant risk.

Answer

Inability to prioritize security investments.

Answer

Loss of customer trust.

Answer

Increased likelihood of successful attacks.

Question 8

Which TWO of the following are examples of compensating controls for a security control deficiency?

Accepted Answer

Increasing logging and monitoring.. Compensating controls are alternative measures that mitigate the risk from a primary control failure; stricter access and enhanced monitoring are good examples.

Answer

Accepting the risk.

Answer

Purchasing cyber insurance.

Answer

Re-architecting the network.

Question 9

Refer to the exhibit. Which of the following best describes the security constraint imposed by this policy?

Accepted Answer

Only allows access from a specific VPC endpoint.. Option B is correct because the condition string requires the request to originate from the specified VPC endpoint, enforcing a network-level constraint.

Answer

Only allows access during business hours.

Answer

Only allows access from a specific IAM user.

Answer

Only allows access to a specific S3 bucket.

Question 10

Which of the following is the BEST definition of a risk register?

Accepted Answer

A list of identified risks with associated attributes such as impact, likelihood, and owner.. Option B is correct because a risk register is a structured repository for documenting and tracking risks.

Answer

A report of audit findings and non-conformities.

Answer

A document that outlines the organization's risk appetite.

Answer

A tool used to automate risk assessment processes.

Question 11

A security analyst is reviewing a third-party assessment report and notes that the vendor's encryption algorithms are outdated. The contract requires the vendor to follow industry best practices. Which of the following is the BEST response?

Accepted Answer

Request the vendor to upgrade encryption algorithms to current standards.. Option A is correct because the contract establishes the requirement, and requesting an upgrade is the proper first step to remedy the deficiency.

Answer

Conduct a penetration test on the vendor's system.

Answer

Terminate the contract immediately.

Answer

Accept the risk because the vendor is technically compliant with the contract.

Question 12

Refer to the exhibit. This clause is a requirement of which of the following?

Accepted Answer

GDPR Article 32.. Option B is correct because the text is a direct excerpt from the GDPR, Article 32, which mandates security measures for personal data processing.

Answer

PCI DSS.

Answer

ISO 27001.

Answer

HIPAA Security Rule.

Question 13

An organization wants to ensure that its supply chain vendors are compliant with its security policies. Which of the following is the MOST effective approach?

Accepted Answer

Implement a continuous monitoring program using automated tools.. Option C is correct because continuous monitoring offers real-time visibility and is scalable for a large vendor base, aligning with best practices for third-party risk management.

Answer

Conduct on-site audits of all vendors.

Answer

Include security requirements in contracts and rely on legal remedies.

Answer

Require vendors to complete a self-assessment questionnaire.

Question 14

A security team is adopting the NIST risk management framework. Which step should they perform first?

Accepted Answer

Categorize.. Option D is correct because the NIST RMF requires categorization of the system and data as the initial step to guide subsequent risk management decisions.

Answer

Select.

Answer

Implement.

Answer

Assess.

Question 15

A company is implementing a risk management framework to comply with PCI DSS. Which type of control is a firewall rule that blocks all inbound traffic except HTTP and HTTPS?

Accepted Answer

Preventive. A firewall rule that blocks traffic is a preventive control because it prevents unauthorized access. Detective controls identify incidents after they occur, corrective controls fix issues, and compensating controls provide alternative security.

Answer

Corrective

Answer

Compensating

Answer

Detective