Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has implemented a risk treatment plan that includes encryption and access controls for a sensitive database. The residual risk is rated as low, which is within the company's risk appetite. However, the company's risk monitoring program detects that a new type of attack could bypass the access controls. What should the company do?

   • AAccept the risk because the residual risk was previously low
   • BContinue with the existing controls because the residual risk is low
   • CTransfer the risk to an insurance provider to cover the new attack vector
   • DReassess the risk and update the treatment plan to address the new attack vector
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   An organization has implemented security controls to reduce a risk. The remaining risk is still above the organization's risk appetite. What should the organization do next?

   • AAccept the residual risk without further action
   • BIgnore the residual risk
   • CIncrease the risk appetite
   • DImplement additional risk treatment measures
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has a risk treatment plan that includes quarterly vulnerability scans. After a major cloud migration, the company notices that the scans are not covering the new environment. What should the company do?

   • AWait for the next quarterly review to update the scan scope
   • BRely on the cloud provider's vulnerability scans for the new environment
   • CContinue with the existing scans because the migration does not affect security
   • DUpdate the vulnerability scan scope to include the new cloud environment
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial services company runs a customer-facing web application in a public cloud. A risk assessment identified a high-likelihood, high-impact risk of a data breach due to a known vulnerability in a third-party payment processing library. The company has a low risk appetite and cannot accept any residual risk that could lead to a breach. The vulnerability cannot be patched because the vendor has not released a fix. What is the most appropriate risk treatment option?

   • ATransfer the risk by purchasing cyber insurance that covers breach response costs.
   • BAvoid the risk by removing the payment processing feature from the application until the vendor releases a patch.
   • CAccept the risk because the vulnerability is in a third-party library and the company has no direct control over the fix.
   • DMitigate the risk by adding a web application firewall (WAF) rule to block exploit attempts.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company uses a cloud-based database that stores financial data. The risk assessment identified a risk of unauthorized data modification by a malicious insider. The company wants to implement a detective control to detect such activity. Which control should be implemented?

   • APurchase cyber insurance to cover losses from insider threats.
   • BEnable database auditing and alerts for unusual modification patterns.
   • CEncrypt the database at rest and in transit.
   • DImplement strict access controls and least-privilege permissions.
   Reveal Solution Discussion Select an answer first