An organization has implemented risk treatment measures for its cloud environment. To ensure these measures remain effective over time, what should the organization do?

Conduct periodic reviews and monitoring of the controls

Assume the controls are effective without review

Only review controls after a security incident

Disable the controls after implementation to reduce costs

An organization decides to formally accept a residual risk for a cloud application. Which step is essential to properly document this risk acceptance?

Deleting all related risk assessment records

Implementing additional security controls

Transferring the risk to a third party

Obtaining approval from the appropriate management authority

A company is considering outsourcing its identity management to a cloud provider. The risk assessment shows that a compromise of the identity provider could affect all users. The company wants to transfer this risk. Which approach is most effective?

Sign a contract with the provider that includes service level agreements and security responsibilities

Accept the risk because the provider is a major cloud company

Use the provider's multi-factor authentication and single sign-on capabilities

Avoid the risk by keeping identity management on-premises

A company's incident response plan is not integrated with its business continuity plan. A recent denial-of-service attack caused significant downtime, and the company struggled to coordinate response and recovery. The risk assessment identifies that similar attacks are likely to recur. The company has a moderate risk appetite and limited budget. What should the company do to improve its risk treatment?

Purchase additional DDoS protection from the cloud provider

Accept the risk because the company has a moderate risk appetite

Develop a unified incident response and business continuity plan with clear roles and communication protocols

Increase the budget for cyber insurance to cover downtime costs

To ensure effective recovery from a realized risk, an organization integrates its risk treatment measures with which of the following?

Incident response and business continuity plans

Human resources onboarding plans

EC-CouncilCloud Security Essentials

Domain 7Objective 5

Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 3)

Part of the Cloud Security Risk Assessment and Management domain, which makes up ~13% of our current practice bank.

46questions here

10free pages

8concepts

Questions 11–15

11foundation · easy
An organization has implemented risk treatment measures for its cloud environment. To ensure these measures remain effective over time, what should the organization do?
Select an answer first
12foundation · easy
An organization decides to formally accept a residual risk for a cloud application. Which step is essential to properly document this risk acceptance?
Select an answer first
13application · medium
A company is considering outsourcing its identity management to a cloud provider. The risk assessment shows that a compromise of the identity provider could affect all users. The company wants to transfer this risk. Which approach is most effective?
Select an answer first
14expert · hard
A company's incident response plan is not integrated with its business continuity plan. A recent denial-of-service attack caused significant downtime, and the company struggled to coordinate response and recovery. The risk assessment identifies that similar attacks are likely to recur. The company has a moderate risk appetite and limited budget. What should the company do to improve its risk treatment?
Select an answer first
15foundation · easy
To ensure effective recovery from a realized risk, an organization integrates its risk treatment measures with which of the following?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.