Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which criterion is most appropriate for deciding whether a residual risk can be formally accepted?

   • AThe risk is unknown to the organization
   • BThe risk is transferred to the cloud provider
   • CThe risk has no potential impact
   • DThe risk is below the organization's risk tolerance threshold
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A cloud security team identifies a high-impact risk from a legacy application that is no longer aligned with business goals. The team decides to decommission the application and remove its associated cloud resources. Which risk treatment option does this action represent?

   • AMitigate
   • BAccept
   • CAvoid
   • DTransfer
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A startup uses a third-party payment processing API to handle customer transactions. The startup's risk assessment shows that a data breach at the payment processor could expose customer data. The startup has limited resources and wants to minimize its security burden. Which risk treatment option is most appropriate?

   • AMitigate the risk by building an in-house payment processing system
   • BAvoid the risk by not accepting online payments
   • CTransfer the risk by using the payment processor and relying on its security controls
   • DAccept the risk because the payment processor is a reputable company
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During risk response planning, an organization identifies a risk that exceeds its risk tolerance. The organization decides to implement additional security controls to reduce the likelihood of the risk occurring. Which risk treatment option is being selected in the response plan?

   • AAccept
   • BTransfer
   • CAvoid
   • DMitigate
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A healthcare organization uses a cloud-based EHR system. A risk assessment identified two high-priority risks: (1) unauthorized access to patient data due to weak authentication, and (2) prolonged downtime of the EHR system during a regional outage. The organization has a moderate risk appetite, a limited security budget, and must comply with data protection regulations. The security team must develop a risk response plan. Which combination of treatments best balances the constraints?

   • AAvoid both risks by moving the EHR system back to on-premises infrastructure.
   • BImplement multi-factor authentication (MFA) for all users and purchase cloud provider credits to offset potential downtime costs.
   • CMitigate the authentication risk by enforcing MFA, and mitigate the downtime risk by implementing a multi-region failover architecture.
   • DAccept the authentication risk because MFA would inconvenience users, and transfer the downtime risk to the cloud provider through a service-level agreement (SLA).
   Reveal Solution Discussion Select an answer first