How should I use these Governance, Risk and Compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Governance, Risk and Compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Governance, Risk and Compliance domain.

CAS-004 · topic practice

Governance, Risk and Compliance practice questions

Practise CompTIA SecurityX CAS-004 Governance, Risk and Compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Governance, Risk and Compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Governance, Risk and Compliance

Governance, Risk and Compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Governance, Risk and Compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Governance, Risk and Compliance questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Governance, Risk and Compliance explanation →

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Trap 1: Focus only on the most stringent regulation

Ignores overlapping requirements

Trap 2: Implement automated GRC tools without changing controls

Does not address control consolidation

Trap 3: Maintain separate control sets for each regulation

Increases complexity and redundancy

Study all Governance, Risk and Compliance common traps →

A
Adopt a unified control framework such as NIST SP 800-53
Allows mapping to multiple regulations
B
Focus only on the most stringent regulation
Why wrong: Ignores overlapping requirements
C
Implement automated GRC tools without changing controls
Why wrong: Does not address control consolidation
D
Maintain separate control sets for each regulation
Why wrong: Increases complexity and redundancy

Governance, Risk and Compliance practice questions

What to know about Governance, Risk and Compliance

Common Governance, Risk and Compliance exam traps

Governance, Risk and Compliance questions

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

A healthcare organization is planning to migrate patient data to a cloud provider. The risk assessment identifies that the provider's SOC 2 report does not cover HIPAA controls. What is the BEST course of action?

An organization wants to ensure that its third-party vendors comply with the company's security policies. Which of the following is the MOST effective method?

A company's data classification policy labels all financial data as 'Confidential.' An employee accidentally emails a spreadsheet containing customer payment information to an unauthorized external party. Which type of control failure occurred?

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

An organization's risk appetite is defined as 'low' for data privacy. Which of the following risk treatments is most aligned with this appetite?

A security architect is designing a system that must comply with FedRAMP Moderate controls. The system will use a cloud service provider (CSP) that is already FedRAMP Authorized. What is the primary benefit of using this CSP?

A company's security policy requires that all remote access be conducted via VPN. An employee uses a personal device without VPN to access company email. Which type of policy violation is this?

An organization discovers that a vendor's data breach exposed customer PII. The contract with the vendor does not address breach notification. What is the BEST way to prevent this in the future?

A company's risk register shows a high-likelihood, high-impact risk related to ransomware. The cost to mitigate fully is $2M, while the expected annual loss is $500K. Which risk response is most appropriate?

Which TWO of the following are key components of a governance framework? (Select TWO)

Which THREE of the following are required for a valid Business Associate Agreement (BAA) under HIPAA? (Select THREE)

Which TWO of the following are examples of administrative controls? (Select TWO)

Which THREE of the following are common challenges when implementing a vendor risk management program? (Select THREE)

A multinational corporation must comply with GDPR, CCPA, and LGPD. The CISO proposes a unified data classification policy. Which approach best minimizes compliance conflicts?

A security engineer is reviewing firewall logs and finds multiple failed SSH attempts from an internal IP. Which control should be implemented to reduce this risk?

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Track your progress over time

Start a Governance, Risk and Compliance only practice session

Related CAS-004 topic practice pages

Scripting, Containers and Automation practice questions

Application Environment, Configuration and Security practice questions

Governance, Risk and Compliance practice questions

Security Engineering practice questions

Security Architecture practice questions

Security Operations practice questions

CAS-004 fundamentals practice questions

CAS-004 scenario practice questions

CAS-004 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid