Cloud Security Governance and Risk Management CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has a hybrid cloud environment with sensitive data stored in a private cloud and less-sensitive data in a public cloud. The security team wants to implement continuous monitoring but has limited resources. Which approach best balances cost and coverage?

   • AImplement continuous monitoring for both clouds using a single tool that covers both environments.
   • BRely on the public cloud provider's monitoring and ignore the private cloud.
   • CConduct manual monthly audits of both clouds instead of continuous monitoring.
   • DImplement continuous monitoring only for the public cloud, since it is more exposed.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is using a cloud provider's Platform as a Service (PaaS) offering to run a web application. The provider manages the runtime environment, but the company writes the application code. Which security responsibility belongs to the company?

   • APatching the operating system of the underlying servers.
   • BSecuring the application code and its dependencies.
   • CConfiguring the network firewall at the hypervisor level.
   • DManaging the physical security of the data center.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large enterprise is moving to a multi-cloud environment. The CISO wants to ensure consistent security governance across AWS, Azure, and Google Cloud. The security team proposes using each cloud provider's native policy service. What is the primary governance challenge with this approach?

   • AThe cloud providers will not allow the organization to create custom policies.
   • BThe organization will lose visibility into its cloud resources.
   • CNative policy services do not support compliance frameworks like PCI DSS.
   • DInconsistent policy enforcement and management across different cloud providers.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A global company is subject to GDPR, HIPAA, and PCI DSS. The compliance team is designing a unified governance framework. Which approach is most effective?

   • AAdopt a single framework, such as ISO 27001, and assume it covers all regulatory requirements.
   • BMap common controls across all frameworks and implement a single set of controls that satisfies the most stringent requirements.
   • CMaintain separate compliance programs for each regulation to avoid conflicts.
   • DPrioritize PCI DSS because it has the most prescriptive requirements.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which activity is an example of continuous monitoring in a cloud environment?

   • AReviewing cloud access logs on a regular basis
   • BConducting a one-time vulnerability assessment
   • CWriting a risk assessment report
   • DImplementing a firewall rule
   Reveal Solution Discussion Select an answer first