A cloud service provider must maintain continuous compliance with ISO 27001 and SOC 2. The security team wants to detect control failures as soon as they occur, rather than discovering them during quarterly audits. Which approach best supports this objective?

Schedule monthly manual reviews of all control evidence to identify any failures.

Conduct a comprehensive risk assessment every six months and update the control documentation accordingly.

Rely on customer complaints to identify potential control failures and address them as they arise.

Implement automated monitoring tools that continuously collect and analyze control evidence and alert on deviations.

A professional services firm must provide evidence to a client that its data handling practices comply with GDPR. The firm uses a GRC tool to track data processing activities and privacy impact assessments. Which documentation is most important to include in the audit evidence package?

A summary of the firm's overall security posture based on an internal risk assessment.

A record of data processing activities, including the purpose, categories of data, and retention periods.

A list of all software tools used by the firm and their versions.

A list of all employees who have completed GDPR training.

What is a key requirement for maintaining documentation that supports compliance audits?

Ensuring that documentation is retained for the required period and is easily accessible to auditors

Keeping documentation only in the minds of key employees

Storing documentation in a format that is not readable by auditors

Deleting documentation after each audit to reduce storage costs

A manufacturing company needs to collect data from various IoT sensors to demonstrate compliance with environmental regulations. The data must be collected continuously and analyzed for anomalies. Which data collection method is most appropriate?

Use automated data collection tools that ingest sensor data in real time and feed it into a centralized analytics platform.

Store raw sensor data in a local database and analyze it only if a compliance issue is suspected.

Have operators manually record sensor readings in a logbook at the end of each shift.

Collect sensor data only during scheduled audits to reduce storage costs.

A hospital network must track compliance with HIPAA across multiple departments. Each department uses different systems to manage patient data, and the compliance team needs to ensure all required controls are in place. Which tool capability is most important for tracking compliance across these varied systems?

The ability to integrate with various data systems and automatically collect compliance evidence.

The ability to send email reminders to department heads about upcoming compliance tasks.

The ability to store all compliance documents in a centralized document repository.

The ability to create custom reports for each department's management.

CompTIASecurityX (CASP+)

Domain 1Objective 5

GRC Tools CAS-005 Practice Questions (Page 3)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

20%of the exam

Questions 11–15

11application · medium
A cloud service provider must maintain continuous compliance with ISO 27001 and SOC 2. The security team wants to detect control failures as soon as they occur, rather than discovering them during quarterly audits. Which approach best supports this objective?
Select an answer first
12application · medium
A professional services firm must provide evidence to a client that its data handling practices comply with GDPR. The firm uses a GRC tool to track data processing activities and privacy impact assessments. Which documentation is most important to include in the audit evidence package?
Select an answer first
13foundation · easy
What is a key requirement for maintaining documentation that supports compliance audits?
Select an answer first
14application · medium
A manufacturing company needs to collect data from various IoT sensors to demonstrate compliance with environmental regulations. The data must be collected continuously and analyzed for anomalies. Which data collection method is most appropriate?
Select an answer first
15application · medium
A hospital network must track compliance with HIPAA across multiple departments. Each department uses different systems to manage patient data, and the compliance team needs to ensure all required controls are in place. Which tool capability is most important for tracking compliance across these varied systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.