GRC Tools CAS-005 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A multinational company must track compliance with GDPR, PCI DSS, and local data protection laws across multiple business units. The compliance team needs a single dashboard showing which requirements are met, which are in progress, and which are non-compliant. Which tool feature is most essential for this task?

   • AA spreadsheet with conditional formatting that highlights non-compliant requirements based on manual data entry.
   • BA document management system that stores all compliance policies and procedures in one place.
   • CA GRC platform with compliance tracking modules that map controls to multiple regulations and provide real-time status dashboards.
   • DA ticketing system that allows employees to submit compliance tasks and track their completion.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a GRC context, what is the main purpose of using automated workflows for policy exceptions?

   • ATo ensure that exception requests are consistently routed to the correct approvers and tracked
   • BTo bypass security controls when an exception is granted
   • CTo automatically approve all exception requests
   • DTo eliminate the need for documenting exceptions
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial institution must continuously monitor its network for changes that could affect compliance with PCI DSS. The security team wants to detect unauthorized configuration changes as soon as they occur. Which monitoring approach is most effective?

   • ARely on the network team to report any changes they make to the compliance team.
   • BConduct weekly manual reviews of system configurations against a baseline.
   • CUse a file integrity monitoring (FIM) tool that alerts on unauthorized changes to critical system files and configurations.
   • DImplement a configuration management database (CMDB) and require all changes to be approved before implementation.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A healthcare organization is subject to both HIPAA and state-level privacy laws that are more stringent than HIPAA. The compliance team currently tracks compliance using a GRC tool that only supports HIPAA. The team needs to ensure compliance with both sets of regulations. What is the best course of action?

   • AUse a separate spreadsheet to track state law compliance and keep it updated manually.
   • BConfigure the GRC tool to include custom controls for the state laws and map them to the HIPAA controls.
   • CReplace the GRC tool with a new one that supports both HIPAA and state laws.
   • DRely on the HIPAA compliance status as a proxy for state law compliance.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A manufacturing company wants to integrate its GRC tool with its industrial control systems (ICS) to monitor compliance with safety regulations. However, the ICS environment is highly sensitive and cannot tolerate downtime or performance degradation. The GRC integration must not disrupt production. What is the most important consideration when planning this integration?

   • AEnsure the integration uses read-only access to the ICS to avoid any impact on production.
   • BUse a direct database connection to the ICS to collect data in real time.
   • CInstall the GRC tool directly on the ICS network to reduce latency.
   • DSchedule data collection during maintenance windows to avoid peak production times.
   Reveal Solution Discussion Select an answer first