mediumMultiple Choice
CAS-004 Practice Question: Implementing a new vendor risk management program
A company is implementing a new vendor risk management program. Which of the following is the BEST approach to assess third-party security controls?
⚠ Common exam trap
CAS-005 often tests whether candidates recognize that self-assessment alone is insufficient for vendor risk assessment — the trap is picking 'rely on the vendor's self-assessment questionnaire' because it sounds efficient, but the BEST approach requires independent verification through standardized questionnaires plus audits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a standardized security questionnaire and conduct on-site audits
The best approach to assess third-party security controls is to use a standardized security questionnaire (e.g., based on ISO 27001, NIST, or SIG) combined with on-site audits. This provides a structured, verifiable assessment that goes beyond self-reported claims and allows the organization to validate the vendor's actual security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the vendor’s financial stability
Why it's wrong here
Financial stability indicates business continuity and solvency, not the presence or effectiveness of security controls, so it cannot assess third-party security. It belongs in a broader vendor due-diligence programme covering viability. Assessing controls requires evidence such as SOC 2 reports, certifications, or audit results.
- ✓
Use a standardized security questionnaire and conduct on-site audits
Why this is correct
Standardised questionnaires give consistent, comparable evidence across every vendor, while on-site audits verify that claimed controls actually operate in practise. Together they satisfy the requirement to assess third-party security controls rather than relying on vendor self-attestation alone.
- ✗
Rely on the vendor’s self-assessment questionnaire
Why it's wrong here
A self-assessment questionnaire reflects only what the vendor claims, providing no independent verification of control effectiveness. It is a reasonable first screening step, but the best approach corroborates it with independent evidence such as SOC 2 reports or audits. Relying solely on vendor assertions leaves unverified risk.
- ✗
Review only public breach reports about the vendor
Why it's wrong here
Public breach reports capture only incidents that became public, leaving most control weaknesses unassessed, so they cannot evidence a vendor's security posture. They are useful as supplementary threat intelligence. A structured assessment, such as reviewing SOC 2 reports or completed questionnaires, is needed to evaluate controls directly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.