Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes the relationship among the three components of a GRC framework in a cloud environment?

   • ACompliance is the primary driver of governance, risk management is a subset of compliance, and governance is the documentation of both.
   • BRisk management is the creation of corporate policies, governance is the enforcement of those policies, and compliance is the monitoring of cloud resources.
   • CGovernance sets the strategic direction and policies, risk management identifies and evaluates uncertainties that could affect objectives, and compliance ensures adherence to laws, regulations, and internal policies.
   • DGovernance is the process of auditing cloud providers, risk management is the selection of security controls, and compliance is the implementation of those controls.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is evaluating two cloud providers. Provider A has SOC 2 Type II and ISO 27001 certifications. Provider B has only a self-assessment questionnaire. The company handles sensitive customer data and wants to minimize compliance risk. Which provider should they choose?

   • AProvider B, because it is cheaper
   • BProvider A, because it has more certifications
   • CProvider B, because self-assessment is faster
   • DProvider A, because independent attestations provide more assurance
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is using a cloud provider that is ISO 27001 certified. The company's own security team wants to ensure that their use of the cloud services complies with the company's internal security policies. What should they do?

   • AImplement their own controls and monitor them continuously
   • BRely solely on the provider's ISO 27001 certification
   • CAsk the provider to implement the company's internal policies
   • DConduct an annual review of the provider's certification
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cloud security team is preparing for an external audit of its cloud environment. The auditor has requested evidence of access reviews, change management, and incident response. The team needs to provide this evidence in a way that is organized and easy for the auditor to review. Which approach should the team take?

   • AProvide the auditor with direct access to the cloud provider's management console to review all configurations.
   • BRely on the cloud provider's audit reports as evidence for all of the company's controls.
   • CCompile a control evidence package that maps each requested area to specific logs, reports, and policy documents.
   • DSend the auditor a list of all cloud resources and their owners, without additional documentation.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement accurately describes a compliance requirement in a cloud environment?

   • ACompliance requirements are static and do not change once defined
   • BCompliance requirements are the sole responsibility of the cloud provider
   • CCompliance requirements are contractual, regulatory, or internal obligations that the organization must meet
   • DCompliance requirements are optional best practices recommended by industry bodies
   Reveal Solution Discussion Select an answer first