A financial services firm must collect evidence of access control effectiveness for SOX compliance. Currently, administrators manually export access logs from multiple systems and compile them into a monthly report. The process is time-consuming and often misses critical anomalies. Which improvement best addresses these issues?

Store all access logs in a central repository and require administrators to query them only during audits.

Use a SIEM tool to collect logs but continue generating compliance reports manually.

Increase the frequency of manual log exports to weekly and have two administrators review the reports.

Implement a GRC tool that automatically collects access logs from all systems, correlates them, and generates compliance reports.

What is a common feature of compliance tracking tools that helps auditors verify that controls are operating effectively?

Generation of vulnerability scan reports

Real-time blocking of non-compliant activities

Automated collection and storage of audit evidence

Automatic remediation of all control failures

What is a key benefit of integrating a GRC tool with an organization's existing identity management system?

It enables automated user access reviews based on current roles and permissions

It automatically grants compliance certifications to all users

It ensures that all users have the same level of access

It eliminates the need for separate security monitoring tools

What is a primary advantage of automating compliance evidence collection?

It reduces the time and effort required to gather evidence while improving consistency

It replaces the need for periodic risk assessments

It eliminates the need for manual review by auditors

It guarantees that all compliance requirements are met without human intervention

How can integrating a GRC tool with a ticketing system enhance compliance management?

By automatically closing all tickets related to security incidents

By linking compliance tasks and evidence to incident and change records

By replacing the need for change management processes

By preventing any changes to the IT environment

CompTIASecurityX (CASP+)

Domain 1Objective 5

GRC Tools CAS-005 Practice Questions (Page 5)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

20%of the exam

Questions 21–25

21application · medium
A financial services firm must collect evidence of access control effectiveness for SOX compliance. Currently, administrators manually export access logs from multiple systems and compile them into a monthly report. The process is time-consuming and often misses critical anomalies. Which improvement best addresses these issues?
Select an answer first
22foundation · easy
What is a common feature of compliance tracking tools that helps auditors verify that controls are operating effectively?
Select an answer first
23foundation · easy
What is a key benefit of integrating a GRC tool with an organization's existing identity management system?
Select an answer first
24foundation · easy
What is a primary advantage of automating compliance evidence collection?
Select an answer first
25foundation · easy
How can integrating a GRC tool with a ticketing system enhance compliance management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.