Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is considering outsourcing its email security to a cloud-based email filtering service. The company wants to transfer the risk of email-borne malware. Which factor is most important to evaluate when determining the effectiveness of this risk transfer?

   • AThe provider's data center location and compliance certifications.
   • BThe service provider's ability to block all malware before it reaches the company's inbox.
   • CThe cost of the service compared to the potential impact of a malware attack.
   • DThe service-level agreement (SLA) that defines the provider's performance and liability.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company has implemented a risk treatment plan that includes new security controls. The CISO wants to ensure that the controls remain effective over time. Which ongoing activity should be established?

   • AConduct a one-time audit after implementation to verify the controls work.
   • BSchedule periodic reviews of control effectiveness and monitor changes in the threat landscape.
   • CRely on the cloud provider's security certifications to guarantee control effectiveness.
   • DReassess the risk only when a security incident occurs.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An organization determines that the cost of implementing strong encryption for a low-impact dataset exceeds the potential loss from a data breach. The organization decides to proceed without additional controls and formally documents this decision. Which risk treatment option is being applied?

   • ATransfer
   • BAvoid
   • CMitigate
   • DAccept
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company runs a critical application in the cloud and wants to reduce the financial impact of a potential service outage. The company has already implemented high-availability architecture but wants to further reduce the residual financial risk. Which risk transfer mechanism would be most effective?

   • ABuy business interruption insurance that covers revenue loss and extra expenses during an outage.
   • BOutsource the application management to a third-party vendor that assumes all operational risks.
   • CPurchase cloud service credits from the provider to offset future downtime costs.
   • DSign a contract with the cloud provider that includes a service-level agreement (SLA) with financial penalties for downtime.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's risk assessment shows that a legacy application has a high likelihood of being exploited due to unpatched vulnerabilities. The application is critical to operations and cannot be taken offline. The organization has a moderate risk appetite and limited security staff. Which combination of treatment actions should be prioritized in the risk response plan?

   • AImplement a web application firewall and increase logging and monitoring
   • BDecommission the application immediately to eliminate the risk
   • CMove the application to a different cloud provider to reduce risk
   • DPurchase cyber insurance and accept the residual risk without further action
   Reveal Solution Discussion Select an answer first