Free SecurityX Governance, Risk, and Compliance Practice Questions | CAS-005

This domain represents 20% of CAS-005 and covers governance frameworks, enterprise risk, compliance strategy, third-party risk, policy, privacy, and security program oversight.

Sample Question 1 — Governance, Risk, and Compliance

Developers at a software company keep asking the security team whether new internal services may use TLS 1.1, which cipher suites are permitted, and what minimum key lengths are required. The CISO wants these answers to be mandatory and consistent across all teams. Which of the following documents should the security team create?

  1. A. A cryptographic guideline that recommends preferred protocols and key lengths
  2. B. A cryptographic standard that mandates protocol versions and key lengths (Correct answer)
  3. C. A step-by-step procedure for requesting a certificate from the internal CA
  4. D. An acceptable use policy that describes how employees may use company systems

Correct answer: B

Explanation: B is correct because standards define mandatory, specific, measurable requirements, such as minimum protocol versions and key lengths, that support a higher-level policy. A is incorrect because guidelines are recommendations that allow discretion, but the CISO wants the requirements to be mandatory. C is incorrect because a procedure describes how to perform a task; it does not define which cryptographic settings are required. D is incorrect because an acceptable use policy governs user behavior and is too high level to specify protocol versions or cipher suites.

Sample Question 2 — Governance, Risk, and Compliance

An internal audit finds that system administrators perform the quarterly privileged access review required by the access control policy in very different ways. Some export user lists from the directory, others review only group names, and several skip service accounts. Which of the following would best address this finding?

  1. A. Rewriting the access control policy to state that reviews are mandatory
  2. B. Writing a step-by-step procedure for performing the access review (Correct answer)
  3. C. Publishing a guideline that suggests possible approaches to reviewing access
  4. D. Increasing the review frequency from quarterly to monthly

Correct answer: B

Explanation: B is correct because the policy already requires the review; a procedure provides the detailed, repeatable steps that make the review consistent and complete. A is incorrect because the policy already mandates the review; restating it does not tell administrators how to perform it consistently. C is incorrect because guidelines are optional recommendations, so they would not eliminate the inconsistency the audit found. D is incorrect because reviewing more often does not fix the fact that each administrator reviews access differently and incompletely.

Sample Question 3 — Governance, Risk, and Compliance

A security architect wants to give development teams secure design advice for a new microservices platform. Teams use different languages and frameworks, and the architect wants them to apply judgment rather than follow rigid rules. Which of the following document types is most appropriate?

  1. A. Standards
  2. B. Procedures
  3. C. Guidelines (Correct answer)
  4. D. Policies

Correct answer: C

Explanation: C is correct because guidelines offer recommended practices that teams can adapt to their context, which suits diverse technology stacks where rigid rules would not fit. A is incorrect because standards are mandatory and specific, which conflicts with the architect's goal of letting teams apply judgment. B is incorrect because procedures prescribe exact step-by-step actions, which is the opposite of allowing teams to apply judgment. D is incorrect because policies state high-level management intent and requirements; they do not provide detailed design advice.

Sample Question 4 — Governance, Risk, and Compliance

During a recent ransomware incident, the legal director, the communications manager, and the CISO each assumed one of the others would approve the public statement. The statement was delayed by two days. Which of the following would best prevent this problem in future incidents?

  1. A. An updated incident response policy that requires timely public communication
  2. B. A communication tree that lists phone numbers for all incident response team members
  3. C. A tabletop exercise that focuses on technical containment of ransomware
  4. D. A RACI matrix for incident activities that assigns a single accountable role to each decision (Correct answer)

Correct answer: D

Explanation: D is correct because a RACI matrix clarifies who is responsible, accountable, consulted, and informed for each activity, and assigning exactly one accountable party removes ambiguity about who approves the statement. A is incorrect because a policy requirement for timely communication does not clarify who has authority to approve the statement. B is incorrect because a contact list helps people reach each other but does not define who is accountable for approving the statement. C is incorrect because a technical containment exercise does not address the decision-ownership gap in communications.

Sample Question 5 — Governance, Risk, and Compliance

A newly hired CISO finds that the organization has a complete set of security policies, but business unit leaders routinely ignore them and approve their own exceptions. Security staff lack the authority to enforce compliance. Which of the following should the CISO secure first?

  1. A. A GRC tool that tracks policy exceptions across business units
  2. B. An expanded awareness training program for all employees
  3. C. A rewrite of all policies to make them shorter and easier to read
  4. D. Executive sponsorship of the security program (Correct answer)

Correct answer: D

Explanation: D is correct because security policies are only effective when senior management visibly supports and enforces them; executive sponsorship gives the program the authority it currently lacks. A is incorrect because tracking exceptions records the problem but does not give security staff the authority to enforce policies. B is incorrect because the problem is business leaders overriding policy, not a lack of employee knowledge. C is incorrect because leaders are ignoring policies because enforcement is not supported, not because the policies are too long.

Sample Question 6 — Governance, Risk, and Compliance

A board of directors asks the CIO to adopt a framework that aligns IT governance with business objectives, defines control objectives that auditors can assess, and assigns clear management responsibilities for IT. Which of the following frameworks best meets this request?

  1. A. CIS Critical Security Controls
  2. B. OWASP Software Assurance Maturity Model
  3. C. ITIL
  4. D. COBIT (Correct answer)

Correct answer: D

Explanation: D is correct because COBIT is an IT governance and management framework that links IT goals to enterprise objectives and defines control objectives and responsibilities that support audit. A is incorrect because the CIS Controls are a prioritized set of technical safeguards, not a governance framework aligning IT with business objectives. B is incorrect because OWASP SAMM measures and improves software security practices; it does not address enterprise IT governance. C is incorrect because ITIL focuses on IT service management practices, such as incident and change management, rather than enterprise IT governance and control objectives.

Sample Question 7 — Governance, Risk, and Compliance

An IT operations manager wants to reduce repeated outages by improving how the organization handles incidents, problems, changes, and service requests across its IT services. Which of the following frameworks is most appropriate?

  1. A. ISO/IEC 27001
  2. B. NIST Cybersecurity Framework
  3. C. COBIT
  4. D. ITIL (Correct answer)

Correct answer: D

Explanation: D is correct because ITIL provides IT service management practices, including incident, problem, change, and request management, that improve service reliability. A is incorrect because ISO/IEC 27001 defines requirements for an information security management system, not operational service management practices. B is incorrect because NIST CSF organizes cybersecurity outcomes and risk management, not IT service management processes. C is incorrect because COBIT addresses IT governance and control objectives at the enterprise level rather than detailed service management practices.

Sample Question 8 — Governance, Risk, and Compliance

A development team copies the production customer database into the development environment every Friday so developers can reproduce bugs with realistic data. The database contains names, addresses, and payment card tokens. Which of the following should the security team require?

  1. A. Masking sensitive fields before loading data into development (Correct answer)
  2. B. Encrypting the development database with the same keys used in production
  3. C. Restricting development database access to senior developers only
  4. D. Deleting the copied data from development every Monday morning

Correct answer: A

Explanation: A is correct because data governance for staging environments requires that sensitive production data be masked, anonymized, or replaced with synthetic data before use in development, where controls are weaker. B is incorrect because sharing production keys expands their exposure, and developers with database access would still see the sensitive data. C is incorrect because limiting access reduces exposure slightly but still places real customer data in a less-controlled environment. D is incorrect because the sensitive data would still be exposed in development for several days each week.

Sample Question 9 — Governance, Risk, and Compliance

During a review of staging environments, a security analyst discovers that the QA environment uses the same API credentials as production to connect to the company's payment processor. QA testers regularly run automated purchase scripts. Which of the following is the best recommendation?

  1. A. Storing the shared credentials in a secrets vault used by both environments
  2. B. Limiting QA test runs to business hours when staff can monitor transactions
  3. C. Provisioning separate sandbox credentials from the payment processor for QA testing (Correct answer)
  4. D. Rotating the shared production credentials every 30 days

Correct answer: C

Explanation: C is correct because each environment should have its own credentials, and payment processors provide sandbox credentials so testing cannot trigger real transactions or expose production secrets. A is incorrect because a vault protects how credentials are stored but QA would still use production credentials. B is incorrect because monitoring does not prevent real charges or the exposure of production credentials in QA. D is incorrect because rotation does not stop QA scripts from using production credentials to create real transactions.

Sample Question 10 — Governance, Risk, and Compliance

A critical vulnerability is announced in a widely used Java logging library. The security team cannot determine which servers run applications that include the library, which business services depend on those servers, or who owns them. Which of the following would best address this gap for future events?

  1. A. A network diagram showing all subnets and firewalls
  2. B. A CMDB that maps configuration items to services and owners (Correct answer)
  3. C. A policy requiring application owners to patch within 30 days
  4. D. An annual penetration test of internet-facing applications

Correct answer: B

Explanation: B is correct because a CMDB tracks configuration items, the software they run, how they relate to business services, and who owns them, which supports fast impact analysis during vulnerability events. A is incorrect because network diagrams show connectivity, not which applications include specific libraries or who owns them. C is incorrect because a patching deadline is useful only if the organization can first identify affected systems and owners. D is incorrect because a yearly test does not provide a current inventory of software, dependencies, and owners.

SecurityX practice-test hub · Mixed quick-start test