Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   A large enterprise is adopting a multi-cloud strategy with AWS and Azure. The CISO wants to establish a cloud governance model that clearly defines who can approve new cloud subscriptions, who sets security policies, and how decisions are escalated. The organization has separate IT, security, and finance teams. Which governance model best supports this need?

   • AA decentralized model where each business unit manages its own cloud subscriptions and security policies independently.
   • BA centralized cloud center of excellence (CCoE) with defined decision rights for subscription approval, policy setting, and escalation paths.
   • CA policy-as-code framework that automatically enforces security policies without human decision rights.
   • DA shared responsibility model that assigns all governance decisions to the cloud providers.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company is preparing for a compliance audit of its cloud environment. The auditor requires evidence that the company has a process for identifying and addressing security risks. The company has a risk register but it is not regularly updated. Which action should the company take to satisfy the auditor?

   • ACreate a new risk register solely for the audit, without updating the existing one.
   • BExplain that the risk register is internal and not subject to audit.
   • CProvide the auditor with the original risk register without updates.
   • DUpdate the risk register with recent risk assessments and demonstrate a recurring risk review process.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A company is establishing a GRC program for its cloud environment. The program must include a framework for identifying and assessing risks, a set of policies that define acceptable use and security requirements, and a process for demonstrating compliance with industry regulations. The company wants to align these components into a single cohesive program. Which approach best achieves this?

   • APurchase a GRC software tool and assume it automatically ensures compliance without further effort.
   • BIntegrate the risk assessment process with policy development and compliance reporting, using a common control framework.
   • CFocus only on compliance reporting and rely on the cloud provider to manage risks and policies.
   • DDevelop separate siloed processes for risk, policy, and compliance, each managed by different teams.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company uses a multi-cloud environment with AWS and Azure. The risk team wants to implement a continuous risk monitoring process that identifies misconfigurations and unauthorized changes across both clouds. Which approach best supports this requirement?

   • AConduct a manual risk assessment quarterly using spreadsheets
   • BUse AWS Config and Azure Policy separately and review reports monthly
   • CRely on the cloud providers' compliance certifications
   • DDeploy a third-party CSPM tool that integrates with both AWS and Azure APIs
   Reveal Solution Discussion Select an answer first