CAS-004 Governance, Risk and Compliance Practice Test 6 — 15 Questions

Question 1

A security analyst discovers that a third-party vendor has been granted access to the company's production database for support purposes. The vendor's contract expires in two weeks. What is the BEST course of action to ensure compliance with the principle of least privilege and reduce risk?

Accepted Answer

Immediately revoke the vendor's database access and provide temporary access only if needed.. Revoking access before contract end ensures that the vendor cannot access data after the relationship ends, complying with least privilege. Extending or monitoring only would still leave access beyond necessity, and waiting is risky.

Answer

Extend the contract for another year to maintain support continuity.

Answer

Wait until the contract expires and then revoke access.

Answer

Monitor the vendor's activities until the contract expires.

Question 2

An organization is evaluating its cloud service provider's security posture as part of third-party risk management. Which regulatory framework requires the organization to ensure that the provider has appropriate technical and organizational measures to protect personal data?

Accepted Answer

GDPR. GDPR Article 28 explicitly requires data processors to implement appropriate technical and organizational measures. PCI DSS focuses on cardholder data, SOX on financial controls, and HIPAA on healthcare data.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 3

A security architect is designing a risk mitigation strategy for a critical application. Which TWO of the following are examples of risk acceptance? (Select TWO.)

Accepted Answer

Obtaining senior management sign-off to accept the risk without additional controls.. Risk acceptance involves acknowledging the risk and taking no further action, or obtaining a formal waiver. Insurance transfers risk, not accepts. Implementing controls reduces risk. Outsourcing transfers risk.

Answer

Outsourcing the application hosting to a third party.

Answer

Purchasing cyber insurance to cover potential losses.

Answer

Implementing an intrusion prevention system to reduce the likelihood of attacks.

Question 4

During a business continuity planning meeting, the team identifies several critical systems. Which THREE of the following are key components of a Business Impact Analysis (BIA)? (Select THREE.)

Accepted Answer

Mission-essential functions. A BIA identifies recovery time objective (RTO), recovery point objective (RPO), and mission-essential functions. Asset inventory and threat modeling may be inputs but are not core BIA outputs.

Answer

Inventory of all hardware assets

Answer

Threat modeling of likely attack vectors

Question 5

An organization is creating a data classification policy. Which THREE of the following are common classification levels used in government and defense? (Select THREE.)

Accepted Answer

Top Secret. Common government classification levels are Unclassified, Confidential, Secret, and Top Secret. Private and Public are common in commercial but not standard in government classification.

Answer

Private

Answer

Public

Question 6

A compliance officer is reviewing logs from a web application and finds multiple failed login attempts from a single IP address. Which type of control should be implemented to reduce the risk of brute-force attacks?

Accepted Answer

Account lockout policy. Account lockout policies prevent brute-force attacks by locking accounts after a number of failed attempts. Encryption, firewalls, and hashing do not directly address brute-force login attempts.

Answer

Network firewall

Answer

Password hashing

Answer

Encryption of traffic

Question 7

An organization is merging with another company and needs to ensure that the combined entity's security policies are aligned. Which document type should the security team prioritize to harmonize security expectations and responsibilities?

Accepted Answer

Acceptable Use Policy (AUP). An Acceptable Use Policy (AUP) defines acceptable behavior and responsibilities for users, making it key for harmonizing expectations. BCP focuses on continuity, DRP on recovery, and NDA on confidentiality.

Answer

Disaster Recovery Plan (DRP)

Answer

Non-Disclosure Agreement (NDA)

Answer

Business Continuity Plan (BCP)

Question 8

A security auditor finds that a company's backup tapes are stored in the same building as the primary data center. Which risk treatment strategy does this lack represent?

Accepted Answer

Risk mitigation. Storing backups at a separate site is risk mitigation through redundancy. The current practice increases risk due to common physical location. Acceptance, transference, and avoidance are not directly addressed here.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transference

Question 9

A small business wants to achieve compliance with PCI DSS. Which approach should they take to minimize the scope of the assessment?

Accepted Answer

Segment the cardholder data environment from the corporate network. Segmenting the cardholder data environment (CDE) from other networks reduces the number of systems in scope. Encryption, tokenization, and training are important but do not directly reduce scope like segmentation does.

Answer

Implement a tokenization service

Answer

Encrypt all cardholder data at rest

Answer

Train employees on security awareness

Question 10

An organization is required to retain logs for seven years per regulatory requirement. Which of the following should be considered to ensure the integrity of these logs?

Accepted Answer

Write-once, read-many (WORM) storage. Write-once, read-many (WORM) storage ensures logs cannot be altered or deleted. Encryption, compression, and hashing provide security or validation but not immutable storage.

Answer

Hashing each log entry

Answer

Encryption of the logs

Answer

Compression to reduce storage space

Question 11

A company is implementing a risk management framework and needs to prioritize remediation of vulnerabilities based on potential impact. Which of the following is the MOST appropriate approach?

Accepted Answer

Perform a quantitative risk assessment using asset value and loss expectancy. A quantitative risk assessment uses asset value and loss expectancy to prioritize risks based on impact. Option A ignores asset criticality; Option B considers only likelihood; Option D is not prioritization.

Answer

Focus on vulnerabilities with the highest CVSS score regardless of asset value

Answer

Remediate all vulnerabilities within 30 days of discovery

Answer

Address vulnerabilities in order of ease of exploitation

Question 12

A financial institution is required to comply with PCI DSS. A low-severity vulnerability is found in the cardholder data environment that would cost significant downtime to patch. What is the BEST course of action?

Accepted Answer

Implement compensating controls and formally accept the risk with documented approval. PCI DSS allows risk acceptance with compensating controls and documented approval. Option A lacks documentation; Option C may cause unacceptable downtime; Option D does not directly address the vulnerability.

Answer

Transfer the risk to a third party

Answer

Accept the risk without documentation

Answer

Immediately patch the vulnerability

Question 13

An organization wants to ensure that its employees understand their responsibilities regarding data protection. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Conduct regular security awareness training with assessments. Regular training with assessments ensures ongoing awareness and understanding. Options A, B, and C are passive methods that are less effective.

Answer

Include a clause in the employment contract

Answer

Post posters in common areas

Answer

Distribute a data protection policy annually via email

Question 14

A company is evaluating a new cloud service provider. The provider has a SOC 2 Type II report covering the previous year. Which additional assurance should the company request to verify the provider's current security controls?

Accepted Answer

Request a penetration test report covering the current year. A penetration test report provides current, independent validation of security controls. Option B relies on a historical report; Option C is duplicative; Option D is not a standard assurance method.

Answer

Accept the SOC 2 report as sufficient

Answer

Implement continuous monitoring of the provider

Answer

Request a third-party audit of the SOC 2 report

Question 15

During a risk assessment, the analyst identifies that a legacy system containing sensitive data cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk treatment strategy is MOST appropriate?

Accepted Answer

Mitigation by implementing compensating controls. Implementing compensating controls reduces the risk while allowing the system to operate. Option A may not be feasible; Option C does not reduce the risk; Option D is less proactive.

Answer

Transfer by purchasing cyber insurance

Answer

Avoidance by decommissioning the system

Answer

Acceptance by documenting the risk