Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A mid-sized company is moving its customer-facing application to AWS. The security team is defining the cloud governance model. They need to ensure that the development teams can provision resources quickly, but the security team must approve any changes to security group rules and IAM policies. Which governance approach best meets this requirement?

   • ACentralized governance with no delegated authority
   • BFully decentralized governance with no central oversight
   • CCentralized governance with delegated operational autonomy
   • DShared responsibility model with no formal policies
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a cloud GRC framework, which activity is primarily associated with the 'governance' component?

   • AEstablishing policies and decision rights for cloud resource usage
   • BConducting vulnerability scans on cloud-hosted applications
   • CReporting compliance status to regulatory authorities
   • DDefining the organization's cloud risk appetite and tolerance levels
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's compliance team needs to provide evidence to an auditor that their cloud environment meets internal security policies. They want to automate the collection of evidence. Which approach is most effective?

   • AUse cloud-native configuration monitoring tools and export logs to a central SIEM
   • BCreate a static compliance document and update it annually
   • CAsk the cloud provider to provide a compliance report for the customer's environment
   • DManually screenshot the cloud console configurations before the audit
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large enterprise is adopting a hybrid cloud model. The security team wants to enforce consistent security policies across on-premises and cloud environments, but the business units want flexibility to choose cloud services. The governance committee must decide on a model. Which approach balances centralized control with business unit agility?

   • AEstablish a cloud center of excellence (CCoE) with defined guardrails and a self-service portal
   • BUse only one cloud provider to simplify governance
   • CAllow each business unit to manage its own cloud governance independently
   • DCentralize all cloud decisions at the corporate IT department
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is preparing for an external audit of its cloud environment. The auditor requires evidence of continuous compliance monitoring and incident response. The company has a CSPM tool and a SIEM. What is the most effective way to provide the required evidence?

   • AGenerate automated reports from the CSPM and SIEM that cover the audit period
   • BProvide the auditor with access to the live CSPM and SIEM dashboards
   • CCreate a summary document of monitoring activities for the audit period
   • DRely on the cloud provider's audit reports
   Reveal Solution Discussion Select an answer first