CAS-004 Governance, Risk and Compliance Practice Test 8 — 15 Questions

Question 1

An organization's business continuity plan (BCP) includes a recovery time objective (RTO) of 4 hours for its critical ERP system. During a disaster, the system is restored in 5 hours. Which of the following is the MOST significant impact?

Accepted Answer

Unacceptable business downtime and potential contractual penalties. Option C is correct because exceeding the RTO results in unacceptable downtime and potential revenue loss. Option A is wrong because RPO affects data loss, not uptime. Option B is wrong because rerouting does not fix the missed RTO. Option D is wrong because insurance may cover financial loss but does not address the operational impact.

Answer

Need to reroute network traffic to the DR site

Answer

Higher cost for cyber insurance premiums

Answer

Increased recovery point objective (RPO) for the last backup

Question 2

A company is evaluating a vendor that will process sensitive customer data. The vendor's SOC 2 Type II report shows that controls were in place but had several exceptions noted. Which of the following is the BEST course of action?

Accepted Answer

Perform a risk assessment on the exceptions. Option D is correct because a risk assessment should be conducted to evaluate the exceptions in the context of the company's risk appetite. Option A is wrong because rejecting without analysis is hasty. Option B is wrong because accepting without review is negligent. Option C is wrong because a Type I report covers a point in time, not operations.

Answer

Request a SOC 2 Type I report instead

Answer

Accept the vendor because it has a Type II report

Answer

Reject the vendor immediately due to exceptions

Question 3

A multinational corporation must comply with both the EU's GDPR and the California Consumer Privacy Act (CCPA). Which of the following scenarios would cause a conflict between these regulations?

Accepted Answer

GDPR requires explicit consent for data processing, while CCPA allows opt-out for data sale. Option B is correct because GDPR requires consent for certain processing, while CCPA allows opt-out for sale of data; these can conflict. Option A is wrong because both require breach notification. Option C is wrong because both allow data access. Option D is wrong because both address data minimization similarly.

Answer

One regulation requires breach notification, the other does not

Answer

CCPA imposes data minimization, while GDPR does not

Answer

Both require data access rights for individuals

Question 4

An organization is implementing a third-party risk management program. Which of the following is the FIRST step in the vendor risk assessment process?

Accepted Answer

Identify the vendor and the type of data it will handle. Option A is correct because identifying the vendor and the data it will access is foundational. Option B is wrong because a contract review comes later. Option C is wrong because on-site audits occur after initial assessment. Option D is wrong because risk treatment is after assessment.

Answer

Conduct an on-site audit of the vendor's facilities

Answer

Review the vendor's contractual security clauses

Answer

Determine risk treatment options

Question 5

Which TWO of the following are essential elements of an effective data governance framework?

Accepted Answer

Data classification policies and procedures. Options B and D are correct. Data classification policies define how data is categorized, and data stewardship assigns ownership. Option A is wrong because encryption is a technical control, not governance. Option C is wrong because data localization is a compliance requirement, not a governance element. Option E is wrong because breach response is operational.

Answer

Mandatory data localization requirements

Answer

Automated breach notification system

Answer

Implementation of full-disk encryption on all endpoints

Question 6

Which THREE of the following are required by the NIST Cybersecurity Framework (CSF) for the 'Protect' function?

Accepted Answer

Performing regular maintenance of systems. Options A, C, and E are correct. Access control (PR.AC), data security (PR.DS), and maintenance (PR.MA) are part of the Protect function. Option B is wrong because 'Respond' is a separate function. Option D is wrong because risk assessment is under 'Identify'.

Answer

Conducting a risk assessment for critical assets

Answer

Developing an incident response plan

Question 7

Which TWO of the following are common compliance frameworks used in the healthcare industry?

Accepted Answer

HIPAA. Options A and C are correct. HIPAA is the U.S. healthcare privacy rule, and HITECH strengthens HIPAA. Option B is wrong because PCI DSS is for payment card data. Option D is wrong because SOX is for financial reporting. Option E is wrong because ISO 27001 is general.

Answer

PCI DSS

Answer

ISO 27001

Answer

SOX

Question 8

Refer to the exhibit. Based on the data classification policy JSON, what action is MOST consistent with the policy?

Accepted Answer

Block the email and notify the security team. Option A is correct because the policy states that Confidential data must be transmitted via VPN or encrypted email; unencrypted email is not allowed, so the transmission should be blocked. Option B is wrong because the policy does not permit downgrading classification. Option C is wrong because no override clause is indicated. Option D is wrong because unencrypted email is explicitly prohibited.

Answer

Allow the email but reclassify the document as 'Internal'

Answer

Allow the email with an exception request

Answer

Encrypt the email automatically with S/MIME

Question 9

You are the security architect for a global manufacturing company that has recently experienced a ransomware attack. The attack originated from a third-party vendor's compromised VPN account, which had been granted privileged access to the corporate network for remote maintenance. The vendor is a critical supplier of industrial control system (ICS) components. The incident severely disrupted production for three days. Post-incident analysis reveals that the vendor's security posture was not assessed prior to granting access, and the contract did not include specific security requirements or audit rights. The company now wants to implement a vendor risk management program to prevent future incidents. Which of the following is the MOST comprehensive and effective course of action to address the root cause?

Accepted Answer

Develop a vendor risk management policy that includes security assessments, contractual clauses, and periodic audits. Option C is correct because establishing a formal vendor risk management program with contractual security requirements and periodic audits directly addresses the lack of assessment and oversight. Option A is wrong because network segmentation alone does not enforce vendor compliance. Option B is wrong because MFA is a single control; it does not replace a program. Option D is wrong because instituting background checks does not ensure technical security controls.

Answer

Implement network segmentation to isolate vendor access to specific systems

Answer

Conduct background checks on all vendor personnel before granting access

Answer

Require all vendors to use multi-factor authentication (MFA) for remote access

Question 10

You are the compliance officer for a financial institution that must adhere to the Payment Card Industry Data Security Standard (PCI DSS). During a quarterly vulnerability scan, you discover that several critical vulnerabilities in the cardholder data environment (CDE) were not remediated within the required 30-day window. Additionally, the most recent penetration test report shows that a segmentation control between the CDE and the corporate network is not functioning as intended. The next PCI DSS assessment is in two months. Which of the following remediation actions should be prioritized FIRST to maintain compliance?

Accepted Answer

Re-establish correct segmentation between CDE and corporate network. Option D is correct because fixing the segmentation failure is critical; without proper segmentation, the entire network might be considered in scope, increasing compliance burden. Option A is wrong because patching vulnerabilities is important but the segmentation issue broader. Option B is wrong because compensating controls may be temporary but segmentation is a fundamental requirement. Option C is wrong because delaying assessment is not a remediation.

Answer

Implement a compensating control for the segmentation failure and document it

Answer

Immediately patch all critical vulnerabilities in the CDE

Answer

Request an extension from the acquirer for the next assessment

Question 11

A financial institution is adopting a new vendor-managed SaaS platform for customer data processing. The CISO wants to ensure the vendor's security controls meet regulatory requirements before data is transferred. Which of the following should be completed FIRST?

Accepted Answer

Perform a third-party risk assessment.. B is correct because a third-party risk assessment is the initial step to evaluate the vendor's security posture against compliance. A and C are technical assessments that come later. D is a control implementation that should follow assessment.

Answer

Execute a penetration test on the SaaS platform.

Answer

Implement data loss prevention controls.

Answer

Conduct a vulnerability assessment of the vendor's network.

Question 12

A healthcare organization is implementing HIPAA Security Rule safeguards. Which TWO of the following are required administrative safeguards? (Choose TWO.)

Accepted Answer

Security management process.. A and C are correct. Administrative safeguards include security management process and assigned security responsibility. B is a technical safeguard, D is a physical safeguard, and E is a technical safeguard.

Answer

Encryption of ePHI at rest.

Answer

Unique user identification.

Answer

Facility access controls.

Question 13

During an incident response exercise, a company discovers that sensitive data was exfiltrated. The CIRT needs to determine the root cause and prevent recurrence. Which THREE of the following steps are part of the lessons learned process? (Choose THREE.)

Accepted Answer

Identify gaps in security controls and recommend improvements.. A, C, and E are correct. Lessons learned includes updating the plan, identifying gaps, and documenting events. B is part of investigation, not lessons learned. D is immediate containment.

Answer

Conduct a full forensic analysis of affected systems.

Answer

Disable the compromised accounts immediately.

Question 14

A small business uses a single on-premise server running a custom application and a SQL database. The IT manager is concerned about data loss due to hardware failure. The company has a backup tape drive but often forgets to change tapes. The RTO is 24 hours and RPO is 4 hours. Which of the following is the BEST improvement to meet the RPO/RTO requirements?

Accepted Answer

Use a cloud-based backup service with hourly incremental backups.. D is correct. Hourly cloud backups meet the 4-hour RPO and likely achieve 24-hour RTO. RAID protects against disk failure but not other hardware failures. Daily backups may miss the RPO. Failover clustering is expensive and complex for a small business.

Answer

Purchase a second identical server and set up failover clustering.

Answer

Switch to daily differential backups and store tapes offsite.

Answer

Implement a RAID 1 mirroring for the server's hard drives.

Question 15

A company is developing a new mobile app that will process users' biometric data for authentication. The legal team is concerned about compliance with the GDPR's data protection by design. Which of the following is the MOST appropriate control to implement?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) before development.. D is correct. A DPIA is required by GDPR for high-risk processing like biometrics. Consent is important but does not replace the DPIA. Encryption is a technical control but the DPIA is foundational for 'by design'.

Answer

Obtain explicit consent from users before data collection.

Answer

Store biometric data in hashed form on the device.

Answer

Implement strong encryption for data in transit and at rest.