CAS-004 Governance, Risk, and Compliance Practice Question
An organization wants to implement continuous compliance monitoring for PCI DSS. Which of the following tools would be MOST effective for this purpose?
⚠ Common exam trap
CAS-005 often tests the distinction between tools that provide point-in-time assessments (like vulnerability scanners) and those that enable continuous monitoring (like SIEM), so candidates may incorrectly choose a scanner because it sounds security-focused.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SIEM system
A SIEM (Security Information and Event Management) system is the most effective tool for continuous compliance monitoring because it aggregates and correlates log data from across the environment in real time, providing ongoing visibility into security events and control effectiveness. For PCI DSS, this directly supports requirements like 10.x (logging and monitoring), 11.5 (change detection), and 12.10 (incident response), enabling automated alerts and evidence collection. Unlike point-in-time tools, a SIEM continuously ingests data, making it ideal for demonstrating sustained compliance rather than periodic snapshots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption solution
Why it's wrong here
Encryption protects data at rest and in transit but produces no evidence of ongoing control adherence, so it cannot satisfy PCI DSS continuous monitoring. It is tempting because encryption is a PCI DSS requirement, and it would be the right answer if the question asked how to protect stored cardholder data.
- ✗
Network firewall
Why it's wrong here
A network firewall enforces traffic filtering rules but generates no evidence mapping to PCI DSS control requirements, so it cannot monitor compliance continuously. It is the correct choice when the requirement is segmenting the cardholder data environment, not demonstrating ongoing adherence to the standard.
- ✗
Vulnerability scanner
Why it's wrong here
A vulnerability scanner identifies technical weaknesses on hosts and applications, producing point-in-time findings rather than continuous evidence against PCI DSS controls. It is the right tool for periodic vulnerability assessment, but continuous compliance monitoring requires automated, ongoing control-state evaluation across the environment.
- ✓
SIEM system
Why this is correct
A SIEM system continuously ingests and correlates log data from cardholder-data environment systems, generating real-time alerts against PCI DSS controls such as access monitoring, file integrity and log review. This satisfies the stem's continuous compliance monitoring requirement, unlike point-in-time assessment tools that only snapshot posture periodically.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.