Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company runs a critical application in a public cloud and has implemented continuous compliance monitoring using a third-party tool. The tool generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and has started ignoring alerts. The compliance officer wants to improve the effectiveness of the monitoring program without adding more staff. Which action should the team take first?

   • AIncrease the frequency of compliance reports to provide more data to the compliance officer.
   • BTune the monitoring tool's rules and thresholds to reduce false positives, and establish a triage process for remaining alerts.
   • CMigrate to a different cloud provider that has fewer compliance issues.
   • DDisable all alerts that are not directly related to a compliance requirement.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is migrating a critical application to the cloud. The risk assessment identifies a high-risk vulnerability in a third-party component. The vendor will not provide a patch for six months. The company cannot delay the migration. Which risk treatment option is most appropriate?

   • AAvoid the risk by not migrating the application
   • BAccept the risk without any controls
   • CMitigate the risk by implementing compensating controls and monitoring the vulnerability
   • DTransfer the risk to the cloud provider
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which legal issue is most directly associated with the storage of personal data in a cloud data center located in a different country?

   • AIntellectual property infringement
   • BData residency and cross-border data transfer regulations
   • CPatent licensing issues
   • DContractual breach of service level agreements
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a cloud-specific risk that an organization should consider when moving to a multi-tenant public cloud?

   • AIncomplete data deletion due to shared infrastructure
   • BInadequate backup procedures
   • CInsufficient physical security at the data center
   • DLack of encryption in transit
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is assessing the risk of moving a legacy application to the cloud. The application has a known vulnerability that cannot be patched immediately. The risk owner decides to accept the risk for a limited time. Which process should be implemented to ensure this is managed properly?

   • ADocument the risk acceptance, set a review date, and implement compensating controls
   • BTransfer the risk to the cloud provider
   • CIgnore the risk until the vulnerability can be patched
   • DImmediately shut down the application
   Reveal Solution Discussion Select an answer first