CAS-004 Governance, Risk, and Compliance Practice Question
A healthcare organization is required to comply with HIPAA. During an audit, the auditor requests evidence of access controls for electronic protected health information (ePHI). Which of the following would be the BEST evidence to provide?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access review logs showing periodic reviews of user permissions
Access review logs demonstrate ongoing monitoring and management of access rights, which is a key HIPAA requirement for administrative safeguards. A signed policy is insufficient without evidence of enforcement. A network diagram shows architecture, not control. A training completion report addresses workforce training, not access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A report of employee security training completion
Why it's wrong here
This is training, not access control evidence.
- ✗
A signed copy of the access control policy
Why it's wrong here
This shows policy exists, not that controls are implemented.
- ✓
Access review logs showing periodic reviews of user permissions
Why this is correct
This demonstrates ongoing compliance with access control requirements.
- ✗
A network diagram of the IT infrastructure
Why it's wrong here
This shows architecture, not access control implementation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.