CAS-004 Governance, Risk, and Compliance Practice Question
An organization is adopting the NIST Risk Management Framework (RMF). During which step would the security team select and implement security controls, and how does this map to the organization's governance structure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.
In NIST RMF, Step 2 (Select) and Step 3 (Implement) involve selecting controls from NIST SP 800-53 and implementing them. This aligns with governance through the risk executive function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Step 4: Assess — controls are evaluated for effectiveness.
Why it's wrong here
Assessment occurs after implementation to verify controls are working.
- ✗
Step 1: Prepare — the organization establishes risk management roles and responsibilities.
Why it's wrong here
Preparation sets the stage but does not include selecting or implementing controls.
- ✗
Step 5: Authorize — a senior official accepts the risk.
Why it's wrong here
Authorization is a decision point after assessment.
- ✓
Step 2: Select and Step 3: Implement — controls are chosen based on risk assessment and integrated into the system.
Why this is correct
These steps directly involve selecting and deploying security controls.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.