CAS-004 Governance, Risk, and Compliance Practice Question
An organization is reviewing its supply chain risk management. Which TWO of the following are effective strategies to manage fourth-party risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include a right-to-audit clause that covers subcontractors
To manage fourth-party risk, organizations can require their vendors to flow down security requirements to subcontractors and include right-to-audit clauses that extend to subcontractors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use only vendors that are SOC 2 certified
Why it's wrong here
SOC 2 does not guarantee coverage of fourth-party risk.
- ✗
Reduce reliance on vendors by bringing services in-house
Why it's wrong here
This reduces third-party risk, not specifically fourth-party.
- ✗
Conduct penetration tests on all fourth parties directly
Why it's wrong here
Direct testing may be impractical and is usually done via vendor.
- ✓
Include a right-to-audit clause that covers subcontractors
Why this is correct
Correct: This ensures the ability to audit fourth parties.
- ✓
Require vendors to contractually mandate security controls for their subcontractors
Why this is correct
Correct: This flows down requirements to fourth parties.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.