Explain Policies or Procedures. CLO-002 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company's change management policy requires that all changes be approved by the change advisory board (CAB). A critical security patch must be applied immediately to address a vulnerability that is being actively exploited. The CAB is not scheduled to meet for another two days. What should the change management process allow for in this situation?

   • AAn emergency change process that allows expedited approval, with a post-implementation review.
   • BA policy that allows the IT team to apply the patch without any approval.
   • CA policy that requires the CEO to approve the change before it is applied.
   • DA policy that requires waiting for the next CAB meeting to approve the change.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to tailor cloud policies to meet specific departmental needs?

   • ATo ensure that all departments have identical policies
   • BTo make the policies more complex and difficult to follow
   • CTo eliminate the need for governance
   • DBecause different departments may have different compliance and operational requirements
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is migrating to the cloud and needs to ensure that all employees know how to report a suspected security incident. Which communication policy element is most important to establish?

   • AA monthly newsletter summarizing cloud security best practices.
   • BA policy that requires employees to investigate incidents before reporting them.
   • CA clear escalation path with contact information for the incident response team.
   • DA policy that only the IT department can report incidents.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's security team suspects that a compromised administrator account was used to access a cloud storage bucket containing sensitive customer data. The incident response plan requires immediate action. Which step should the team perform first?

   • ANotify all customers that their data may have been exposed.
   • BDelete the storage bucket to prevent further data loss.
   • CDisable the compromised account and revoke its access keys.
   • DReview the access logs to determine what data was accessed.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A cloud administrator is writing an SOP for responding to a cloud service outage. What should the SOP include?

   • AA list of all cloud services and their pricing.
   • BStep-by-step instructions for diagnosing and escalating the outage, including who to contact.
   • CA description of the company's organizational structure.
   • DA policy for approving new cloud vendors.
   Reveal Solution Discussion Select an answer first