Recognize Risk Management Concepts Related to Cloud Services. CLO-002 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is vendor lock-in in cloud computing?

   • AThe inability to use any cloud services
   • BThe process of signing a contract with a cloud provider
   • CThe difficulty of moving workloads or data away from a cloud provider due to technical or contractual constraints
   • DThe requirement to use only one cloud provider for all services
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company stores customer data in a cloud object storage service. A risk assessment identifies that the data is not encrypted at rest, and there is a high likelihood of a data breach if the storage is compromised. The company wants to reduce the likelihood and impact of this risk. Which action best mitigates this risk?

   • AAccept the risk because the data is not highly sensitive.
   • BMove the data to a different cloud provider that offers encryption by default.
   • CEnable server-side encryption for the storage service.
   • DPurchase cyber liability insurance to cover potential breach costs.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of classifying a cloud asset?

   • AAssigning a cost center to a cloud resource
   • BTagging a database as 'confidential' because it contains customer personal data
   • CDeploying a virtual machine in a specific availability zone
   • DCreating a backup of a storage account
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has a low-value, non-critical cloud application that stores no sensitive data. A risk assessment identifies a potential vulnerability that could cause a brief service outage. The cost to fix the vulnerability is higher than the potential loss from an outage. The company decides not to fix the vulnerability. Which risk management strategy is the company applying?

   • ARisk acceptance
   • BRisk transfer
   • CRisk mitigation
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is considering purchasing cyber insurance to cover the financial impact of a potential data breach. However, the company also wants to reduce the likelihood of a breach. Which approach best combines risk transfer and risk mitigation?

   • AAccept the risk and do not purchase insurance or implement controls.
   • BImplement security controls only, and do not purchase insurance.
   • CPurchase cyber insurance only, and rely on the insurance to cover any losses.
   • DPurchase cyber insurance and implement strong security controls such as encryption and access management.
   Reveal Solution Discussion Select an answer first