CAS-004 Governance, Risk, and Compliance Practice Question
An organization's security team has drafted a new acceptable use policy that defines how employees may handle company devices, email, and internet access. Before the policy is published and enforced, which action is most important to complete?
⚠ Common exam trap
The trap here is focusing on distribution mechanics such as publishing or translating, when the policy's legitimacy depends on formal leadership approval before anything else.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain review and formal approval from executive management and the appropriate governance body
Approval by executive management and the relevant governance body is what gives a policy its authority. Without that endorsement, the acceptable use policy is an unreviewed draft that cannot be enforced consistently, may conflict with legal or contractual obligations, and offers no defensible basis for disciplinary action. Distribution, translation, and version archiving are supporting activities that follow approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Translate the policy into every language spoken by employees before any review occurs
Why it's wrong here
Translation improves accessibility but is a distribution concern that follows approval and content finalization. Translating a draft that may still change wastes effort and risks confusing employees with outdated wording, so it is not the most important action before the policy can be validly published and enforced.
- ✗
Archive the draft in the document management system with a version number
Why it's wrong here
Version control supports document management but does not confer authority or legitimacy on a policy. Archiving alone leaves the document unapproved and unenforceable, so it cannot substitute for the governance review and executive endorsement that make the acceptable use policy binding on employees and defensible during audits or disciplinary proceedings.
- ✗
Publish the policy on the intranet and begin disciplinary enforcement immediately
Why it's wrong here
Publishing and enforcing an unapproved policy creates legal and morale problems because employees can be disciplined under rules that leadership never sanctioned. Without formal approval, the document lacks organizational authority, and any enforcement action could be challenged or overturned, so this step is premature and undermines the credibility of the security program.
- ✓
Obtain review and formal approval from executive management and the appropriate governance body
Why this is correct
Policies gain authority only when senior leadership formally approves them, which signals organizational commitment and provides the mandate for enforcement. Approval by executive management and the relevant governance body also ensures the policy aligns with business objectives and legal obligations, and it establishes accountability if disciplinary action is later required for violations, making this the essential step before publication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.