Cloud Risk Treatment, Response, and Mitigation CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company uses a cloud object storage service to store sensitive customer data. A risk assessment identified a high likelihood of data exposure due to misconfigured bucket permissions. The company wants to reduce both the likelihood and the impact of this risk. Which combination of controls should the security team implement?

   • AEnable server-side encryption and rely on the cloud provider's default bucket permissions.
   • BTransfer the risk by purchasing cyber insurance and do not change the bucket permissions.
   • CImplement a preventive control by enforcing least-privilege access policies and a detective control by enabling access logging and alerts for public buckets.
   • DAccept the risk because the data is encrypted and the cloud provider is responsible for security.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A company purchases a cyber insurance policy to cover financial losses from a potential data breach in its cloud environment. Which risk treatment approach does this represent?

   • ARisk transfer
   • BRisk avoidance
   • CRisk mitigation
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company's risk assessment identifies that a cloud provider outage could cause significant downtime for its critical application. The company has a low risk appetite and cannot afford extended downtime. The company is considering whether to implement a multi-cloud strategy or rely on the provider's SLA. Which approach best manages the risk?

   • ARely on the provider's SLA for compensation if an outage occurs
   • BImplement a multi-cloud strategy with active-active failover to reduce downtime risk
   • CPurchase cyber insurance to cover losses from provider outages
   • DAccept the risk because the provider has a strong track record
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   A cloud security team notices that a new type of malware is targeting the cloud service they use. The team updates its risk assessment to reflect this new threat. Which activity does this update represent?

   • ARisk acceptance
   • BRisk avoidance
   • CRisk transfer
   • DRisk monitoring and review
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A healthcare organization stores de-identified patient data in a public cloud object storage bucket. The risk assessment identifies a moderate likelihood of a misconfigured bucket exposing data, with a high impact due to reputational damage. The organization has a low risk appetite and cannot afford the operational overhead of continuous monitoring. Which risk treatment option best aligns with the organization's constraints?

   • AAvoid the risk by deleting the data from the cloud and storing it on-premises
   • BTransfer the risk by purchasing cyber liability insurance
   • CMitigate the risk by enabling private access and applying least-privilege policies
   • DAccept the risk because the data is de-identified and the likelihood is only moderate
   Reveal Solution Discussion Select an answer first