CAS-004 Governance, Risk, and Compliance Practice Question
An organization is reviewing its third-party risk management process. Which of the following clauses should be included in contracts with critical vendors to ensure ongoing visibility into their security posture?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Right-to-audit clause
A right-to-audit clause allows the organization to audit the vendor's controls and verify compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Non-disclosure agreement (NDA)
Why it's wrong here
NDA protects confidentiality but does not provide audit rights.
- ✗
Service-level agreement (SLA) for uptime
Why it's wrong here
SLA addresses availability, not security visibility.
- ✓
Right-to-audit clause
Why this is correct
Correct: This clause gives the organization the right to audit the vendor's security controls.
- ✗
Data processing agreement (DPA)
Why it's wrong here
DPA outlines data handling but not necessarily audit rights.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.