Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has implemented continuous compliance monitoring in its cloud environment. The monitoring system uses a policy-as-code approach to automatically remediate non-compliant resources. However, the company has experienced an incident where a critical resource was automatically terminated because it was misconfigured. The company wants to avoid such incidents while maintaining continuous compliance. Which change should the company make?

   • AIncrease the frequency of automatic remediation to catch issues faster.
   • BKeep automatic remediation but exclude all resources tagged as critical from the policy enforcement.
   • CDisable automatic remediation entirely and rely on periodic manual audits.
   • DChange the remediation action from automatic termination to alerting and manual review for critical resources.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has implemented continuous compliance monitoring in its cloud environment using a combination of native cloud services and third-party tools. The monitoring system currently checks for misconfigurations and generates alerts, but the company's security team is struggling to prioritize remediation efforts because the alerts are not linked to business impact. The compliance officer wants to improve the monitoring program to focus on the most critical risks. Which enhancement should the team implement?

   • AIntegrate the monitoring system with a risk register that assigns business impact scores to affected assets and services.
   • BCreate a dashboard that displays the total number of alerts per day for management review.
   • CAutomatically remediate all alerts using infrastructure-as-code without human review.
   • DIncrease the frequency of monitoring scans from daily to hourly to catch issues faster.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational company is using a public cloud provider with data centers in several countries. The company's data protection officer (DPO) is concerned about the legal implications of data transfers between countries. The company has customers in the EU and the US. Which action should the DPO take to address these concerns?

   • AConduct a data flow mapping exercise to identify all data transfers and assess the legal basis for each transfer.
   • BEnsure that all data is stored in the EU to avoid any cross-border transfers.
   • CAnonymize all personal data to avoid data protection obligations.
   • DRely on the cloud provider's privacy policy to ensure legal compliance.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has implemented continuous compliance monitoring using a CSPM tool. However, the security team is overwhelmed by alerts, many of which are false positives. They want to reduce alert fatigue while maintaining effective monitoring. Which strategy is most effective?

   • ADisable all alerts and rely on quarterly manual audits
   • BIncrease the severity threshold for all alerts to reduce volume
   • CAssign all alerts to a single analyst to handle
   • DTune the CSPM tool's policies to the organization's specific risk appetite and context
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is evaluating compliance frameworks for its cloud environment. The company needs to demonstrate to customers that it has implemented appropriate security controls and is willing to undergo independent audits. The company is considering both ISO 27001 and SOC 2. Which factor should the company consider when choosing between the two?

   • AISO 27001 is only applicable to cloud providers, while SOC 2 is applicable to all organizations.
   • BISO 27001 requires a formal management system and certification, while SOC 2 provides an attestation report based on trust services criteria.
   • CSOC 2 is required by law, while ISO 27001 is voluntary.
   • DSOC 2 is a certification that is more widely recognized than ISO 27001.
   Reveal Solution Discussion Select an answer first