GRC Tools CAS-005 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a primary benefit of continuous monitoring in risk management?

   • AIt automatically eliminates all identified risks
   • BIt reduces the need for any human involvement in risk management
   • CIt provides up-to-date information on the effectiveness of risk mitigation controls
   • DIt ensures that risk levels never change
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A logistics company wants to integrate its GRC tool with its existing ERP system to automate the tracking of regulatory compliance for international shipments. The goal is to reduce manual data entry and improve accuracy. Which integration method is most appropriate?

   • AKeep the systems separate and have the compliance team review shipment logs during audits.
   • BHave employees manually enter shipment data into the GRC tool after each shipment.
   • CUse a file transfer protocol (FTP) to upload shipment data to the GRC tool on a weekly basis.
   • DUse a middleware solution to connect the ERP and GRC systems and synchronize data automatically.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When mapping organizational processes to a compliance framework, what is the primary purpose of identifying the controls that apply to each process?

   • ATo assign ownership of each control to a specific department
   • BTo replace all existing process documentation with the framework's control descriptions
   • CTo determine which framework requirements are satisfied by existing controls and which require additional implementation
   • DTo ensure that every process has at least one control mapped to it
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A software development company must provide evidence of secure coding practices to an external auditor for a client's compliance audit. The company uses a GRC tool to track security training and code review processes. Which reporting feature is most useful for demonstrating compliance?

   • AA report that lists all security tools used by the company and their versions.
   • BA report that shows the number of code reviews conducted and the number of vulnerabilities found and remediated.
   • CA report that summarizes the company's overall security posture based on a self-assessment.
   • DA report that lists all employees who have completed security training and their completion dates.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise is considering automating its compliance evidence collection for SOC 2. The security team has identified several tools that can generate evidence, but the GRC tool currently requires manual uploads. The team must decide whether to invest in API integrations or continue with manual uploads. What is the primary trade-off to consider?

   • AAPI integrations are always more cost-effective than manual uploads.
   • BManual uploads are more secure because they avoid external connections.
   • CManual uploads provide better audit trails because they are human-reviewed.
   • DAPI integrations reduce manual effort but require ongoing maintenance and potential security risks.
   Reveal Solution Discussion Select an answer first