GRC Tools CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A government agency must collect and analyze data to demonstrate compliance with federal security regulations. The agency has a GRC tool that can collect data from various sources, but the data is often incomplete or inconsistent. The agency needs to ensure the data is reliable for compliance reporting. What is the most important step to improve data quality?

   • AUse the GRC tool to generate reports directly from raw data without any processing.
   • BCollect data from a single source to ensure consistency.
   • CHave analysts manually review and correct all data before it is entered into the GRC tool.
   • DImplement data validation rules in the GRC tool to check for completeness and consistency during data collection.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which data collection technique is most appropriate for verifying that security patches are applied to all systems?

   • ASocial engineering testing of employees
   • BReview of physical access logs
   • CManual review of firewall rules
   • DAutomated vulnerability scanning and asset inventory reports
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial institution is required to continuously monitor its critical systems for compliance with PCI DSS. The security team has implemented a SIEM tool that collects logs from all systems. However, the SIEM generates a high volume of alerts, many of which are false positives. The team is overwhelmed and may miss genuine compliance issues. What is the best way to improve the effectiveness of continuous monitoring?

   • AIncrease the number of alerts reviewed by adding more security analysts.
   • BTune the SIEM correlation rules to reduce false positives and focus on high-risk events.
   • CDisable alerts for low-risk events to reduce the volume.
   • DUse the GRC tool to manually review all SIEM alerts on a weekly basis.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A utility company must collect data from smart meters to prove compliance with energy consumption regulations. The data must be collected at regular intervals and analyzed for anomalies. Which data collection method is most appropriate?

   • AHave field technicians manually download data from each meter during monthly inspections.
   • BStore meter data in a local database and analyze it only during annual audits.
   • CCollect data only when a customer complains about their bill.
   • DUse a supervisory control and data acquisition (SCADA) system to collect meter data automatically and feed it into a compliance analytics platform.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization must demonstrate compliance with HIPAA and ISO 27001 to external auditors. The compliance team manually maps each control to the corresponding framework requirement, but the mapping is inconsistent and outdated. Which approach best improves the accuracy and maintainability of the control-to-framework mapping?

   • AUse a GRC tool that supports automated mapping of controls to multiple framework requirements and maintains a centralized repository.
   • BCreate a single spreadsheet that lists each control and the framework requirement it satisfies, and update it quarterly.
   • CHire an external consultant to re-map all controls to both frameworks annually.
   • DAdopt the ISO 27001 framework as the sole standard and map HIPAA requirements to it manually.
   Reveal Solution Discussion Select an answer first