Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which type of report is typically generated for stakeholders to demonstrate compliance with a specific framework?

   • ANetwork traffic analysis report
   • BIncident response report
   • CSOC 2 Type II report
   • DPenetration test report
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization wants to ensure that any unauthorized change to a cloud resource is automatically detected and remediated. They have a policy that all storage buckets must be private. Which strategy best achieves continuous compliance?

   • ATrain developers to follow the policy and rely on their compliance
   • BUse a policy-as-code tool that automatically reverts non-compliant changes
   • CConduct weekly manual reviews of bucket permissions
   • DSet up alerts and have a team respond during business hours
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of a compliance standard that applies to cloud service providers and their customers?

   • AISO 27001
   • BREST API
   • CTCP/IP
   • DHTML5
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is developing a GRC framework for its cloud environment. The framework must ensure that security policies are aligned with business goals and that compliance obligations are met. Which element is essential for this alignment?

   • AA set of technical security controls
   • BA compliance checklist
   • CA governance committee that reviews security policies and risk decisions
   • DA cloud provider's shared responsibility model
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has identified a high-risk vulnerability in a cloud application that is exposed to the internet. The vulnerability is not yet exploited, but the risk assessment indicates a high likelihood of exploitation. The company's security team must decide whether to remediate the vulnerability immediately or wait for the next scheduled maintenance window. The application is business-critical and cannot tolerate downtime. Which action best balances risk and business continuity?

   • AImmediately apply the patch, accepting the risk of downtime to the business-critical application.
   • BDo nothing until the next maintenance window because the vulnerability is not yet exploited.
   • CTake the application offline until the vulnerability is patched.
   • DImplement a temporary compensating control, such as a web application firewall rule, and schedule remediation at the next maintenance window.
   Reveal Solution Discussion Select an answer first