CASP+ Risk Management and Compliance 3

Question 1

Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

Question 2

An organization performs a gap analysis against ISO 27001. Which output BEST prioritizes remediation efforts?

Accepted Answer

A risk-ranked list of control gaps with associated residual risk levels

Answer

Risk-ranking gaps by residual risk ensures that the most dangerous deficiencies are remediated first, optimizing the allocation of limited security resources.

Question 3

Which standard specifically defines requirements for payment card data security applicable to merchants and service providers?

Accepted Answer

PCI DSS (Payment Card Industry Data Security Standard)

Answer

PCI DSS is the global security standard mandated by card brands (Visa, Mastercard, etc.) for any organization that stores, processes, or transmits cardholder data.

Question 4

A CASP+ professional is building a vendor risk management program. Which assessment type provides the MOST assurance about a cloud provider's security controls?

Accepted Answer

SOC 2 Type II report from an independent auditor

Answer

A SOC 2 Type II report documents testing of controls over a period (typically 6–12 months) by an independent auditor, providing high-confidence evidence of operational effectiveness.

Question 5

Which risk management framework does NIST recommend for federal information systems and is widely adopted in the US private sector?

Accepted Answer

NIST Risk Management Framework (RMF)

Answer

NIST RMF (SP 800-37) provides a structured, six-step process (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) for managing information system risk.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Risk Management and Compliance 3