Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's risk assessment identifies a low-likelihood, low-impact risk related to a non-critical internal tool. The cost to mitigate the risk exceeds the potential loss. The organization's risk appetite statement allows acceptance of risks below a defined threshold. What is the appropriate action according to formal risk acceptance criteria?

   • AAccept the risk informally without documentation because it is low impact
   • BTransfer the risk to an insurance provider to avoid the approval process
   • CMitigate the risk anyway because all risks should be reduced to zero
   • DDocument the risk, obtain approval from the designated authority, and monitor it periodically
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An organization deploys a cloud-based intrusion detection system (IDS) that generates alerts when suspicious network traffic is observed. Which category of security control does the IDS represent?

   • APreventive
   • BDeterrent
   • CDetective
   • DCorrective
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization's risk assessment identifies that a ransomware attack could cause significant downtime for its customer-facing application. The organization decides to implement a mitigation control. Which control best integrates with incident response and business continuity to reduce the impact of a ransomware attack?

   • AImplement a honeypot to detect attackers before they deploy ransomware
   • BRegularly test backups and document restoration procedures
   • CIncrease the number of virtual machines to handle the load
   • DPurchase cyber insurance to cover ransom payments
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has a critical application that is vulnerable to a known exploit. The vendor has not yet released a patch. The company cannot afford downtime. Which combination of controls should be implemented to reduce the risk while waiting for the patch?

   • AIncrease the number of application instances to improve availability
   • BTake the application offline until the patch is available
   • CImplement a virtual patch using a web application firewall and enable enhanced logging
   • DPurchase cyber insurance to cover potential losses from exploitation
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's risk assessment identifies that a new cloud storage service has a high likelihood of data leakage due to misconfiguration. The company is in a regulated industry and has a low risk appetite. The security team has limited time to implement controls. Which risk response plan should be prioritized?

   • AAccept the risk because the storage service is new and the team is busy
   • BDelay the implementation of the storage service until a full security review is completed
   • CPurchase cyber insurance to cover potential data breach costs
   • DImplement automated configuration checks and restrict access to the storage service
   Reveal Solution Discussion Select an answer first