Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A company has a limited security budget and must address three risks: (1) a high-likelihood, low-impact risk of phishing, (2) a low-likelihood, high-impact risk of a data center outage, and (3) a medium-likelihood, medium-impact risk of misconfigured cloud resources. The company's risk appetite is moderate. Which risk response plan best prioritizes the use of limited resources?

   • ATransfer the phishing risk to an external security provider, accept the outage risk, and ignore misconfigurations.
   • BImplement security awareness training for phishing, purchase insurance for the outage, and deploy automated configuration checks for misconfigurations.
   • CFocus all resources on preventing the data center outage by building a redundant infrastructure.
   • DAccept the phishing risk because it is low impact, and implement manual configuration reviews for misconfigurations.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A company has a cloud-based application that is critical to business operations. The risk assessment identified a high-impact risk of a ransomware attack. The company has implemented preventive controls, but the CISO wants to ensure effective response and recovery if the attack occurs. Which additional measure is most important to integrate with the incident response plan?

   • APurchase cyber insurance to cover ransom payments.
   • BIncrease the frequency of vulnerability scans.
   • CDocument the incident response plan and store it in a secure location.
   • DRegularly test backups by restoring data in a isolated environment.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An e-commerce company experiences a data breach that exposes customer payment information. The incident response team contains the breach and restores services. The risk assessment identifies that the root cause was a misconfigured database that was publicly accessible. Which set of controls should be implemented to address the root cause and reduce the likelihood of recurrence?

   • AIncrease the database backup frequency to ensure faster recovery
   • BEnable database encryption at rest and in transit
   • CPurchase additional cyber insurance to cover future breach costs
   • DApply network security rules to restrict database access and enable configuration auditing
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm is considering outsourcing its email and collaboration services to a cloud provider. The risk assessment identifies that email data is sensitive and subject to regulatory requirements. The firm wants to transfer some risk to the provider. Which approach best aligns with the shared responsibility model to achieve effective risk transfer?

   • AUse the provider's default security settings and assume the provider manages all risks
   • BRely on the provider's security certifications to assume all security responsibilities are transferred
   • CDefine contractual security requirements and implement customer-side controls for data and access
   • DSign a contract that holds the provider liable for any data breach regardless of cause
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has a risk acceptance policy that states risks with a likelihood rating of 'low' and an impact rating of 'low' can be accepted by the IT manager, while higher risks require CISO approval. A risk assessment identified a risk with a likelihood of 'medium' and an impact of 'low'. What should the company do?

   • ATransfer the risk to the cloud provider because it is not low/low.
   • BEscalate the risk to the CISO for approval because the likelihood is medium.
   • CAccept the risk because the impact is low.
   • DReject the risk and require mitigation because it is not low/low.
   Reveal Solution Discussion Select an answer first