hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: The security architect for a global manufacturing…
You are the security architect for a global manufacturing company that has recently experienced a ransomware attack. The attack originated from a third-party vendor's compromised VPN account, which had been granted privileged access to the corporate network for remote maintenance. The vendor is a critical supplier of industrial control system (ICS) components. The incident severely disrupted production for three days. Post-incident analysis reveals that the vendor's security posture was not assessed prior to granting access, and the contract did not include specific security requirements or audit rights. The company now wants to implement a vendor risk management program to prevent future incidents. Which of the following is the MOST comprehensive and effective course of action to address the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop a vendor risk management policy that includes security assessments, contractual clauses, and periodic audits
Establishing a formal vendor risk management program with contractual security requirements and periodic audits directly addresses the lack of assessment and oversight. Option A is wrong because network segmentation alone does not enforce vendor compliance. Option B is wrong because MFA is a single control; it does not replace a program. Option D is wrong because instituting background checks does not ensure technical security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement network segmentation to isolate vendor access to specific systems
Why it's wrong here
Segmentation reduces blast radius but does not enforce vendor risk management.
- ✗
Conduct background checks on all vendor personnel before granting access
Why it's wrong here
Background checks do not address technical security controls.
- ✓
Develop a vendor risk management policy that includes security assessments, contractual clauses, and periodic audits
Why this is correct
A comprehensive program addresses root cause of lack of oversight.
- ✗
Require all vendors to use multi-factor authentication (MFA) for remote access
Why it's wrong here
MFA is good but does not address contractual or audit requirements.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.