CAS-004 Governance, Risk, and Compliance Practice Question
A hospital's security manager is aligning internal documents after a policy refresh. The board approved a statement that defines the organization's overall security intent and assigns responsibility to executive leadership, but it deliberately avoids naming specific products or technical settings. Which document type has the board approved?
⚠ Common exam trap
The trap here is assuming that because the document avoids technical detail it must be a guideline, when the board's formal approval and assignment of responsibility make it a mandatory policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security policy
A policy is the management-approved, high-level statement that expresses security intent and assigns accountability without dictating products or settings. Standards enforce specific mandatory requirements, procedures describe operational steps, and guidelines offer optional advice. Because the board's document sets direction and delegates responsibility at an enterprise level while avoiding technical specificity, it is a policy sitting at the top of the governance hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A security standard
Why it's wrong here
Standards are mandatory, specific requirements that translate policy intent into measurable rules, such as approved cipher suites or password length. They contain the technical specificity the board's statement deliberately omits. Because the approved document sets direction and assigns accountability without prescribing products or configurations, it functions at a higher level than a standard and would not be classified as one.
- ✓
A security policy
Why this is correct
A policy is a high-level, management-approved statement of intent that defines the organization's security objectives and assigns responsibility without prescribing technical detail. The board's document matches this exactly: it sets overall direction, delegates accountability to executives, and intentionally avoids product-specific or configuration-level content. That places it at the top of the governance hierarchy, above standards and procedures.
- ✗
A security procedure
Why it's wrong here
Procedures are step-by-step operational instructions describing how to perform a specific task, such as how to onboard an account or respond to a phishing report. They are tactical and highly detailed, the opposite of a broad statement of intent. The board-approved document described here establishes direction and responsibility rather than prescribing sequential actions, so it is not a procedure.
- ✗
A security guideline
Why it's wrong here
Guidelines are non-mandatory recommendations and best practices that suggest approaches without imposing requirements. The document here was formally approved by the board and assigns responsibility, which signals a mandatory governance instrument rather than advisory guidance. Because guidelines lack that authority and directive force, the board's approved statement is better characterized as a policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.