Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After implementing security controls, a company has a residual risk of unauthorized access to a development environment. The risk is rated as low likelihood and low impact, and it falls within the company's risk appetite. What should the company do to manage this residual risk?

   • AImplement additional controls to eliminate the residual risk entirely.
   • BIgnore the residual risk because it is low and does not require monitoring.
   • CTransfer the residual risk to the cloud provider through the shared responsibility model.
   • DAccept the residual risk and include it in the risk register for periodic review.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company's risk acceptance criteria require that any accepted risk be approved by the CISO and reviewed quarterly. A risk assessment identifies a low-likelihood, medium-impact risk that is within the company's risk appetite. The cost to mitigate the risk is high. The CISO is on leave for a month. What should the company do?

   • AHave the designated alternate approver formally accept the risk and document it
   • BWait for the CISO to return to formally accept the risk
   • CAccept the risk informally and document it after the CISO returns
   • DMitigate the risk because the CISO is unavailable
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A company uses a cloud service provider (CSP) that is responsible for securing the underlying infrastructure, while the company is responsible for securing its applications and data. Which risk management concept does this arrangement illustrate?

   • ARisk mitigation
   • BRisk avoidance
   • CRisk acceptance
   • DShared responsibility model
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After implementing mitigation controls, a company recalculates the risk for a critical application. The residual risk is still rated as high because the controls reduce likelihood but not impact. The organization's risk appetite is moderate and does not permit high residual risk. What should the company do next?

   • AReclassify the risk as low because controls were implemented
   • BAccept the residual risk because the controls were implemented as planned
   • CImplement additional controls to reduce the impact, such as isolation and redundancy
   • DTransfer the risk to an insurance provider and consider the risk managed
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   An organization's cloud environment experiences a security breach. The incident response team follows a predefined plan to contain the threat and restore services. Which type of plan does this represent?

   • ABusiness continuity plan
   • BDisaster recovery plan
   • CIncident response plan
   • DRisk acceptance plan
   Reveal Solution Discussion Select an answer first