A company is evaluating a new cloud service that will process sensitive financial data. The risk assessment reveals a high likelihood of a data breach due to the service's immature security controls. The company's risk appetite is moderate. Which combination of strategies is most appropriate?

Accept the risk because the service is needed for business operations.

Mitigate the risk by requiring the provider to implement additional security controls, and monitor the effectiveness of those controls.

Avoid the risk by not using the service at all.

Transfer the risk by purchasing insurance and do not implement any additional controls.

A company has implemented a cloud security governance framework. To ensure the framework remains effective, the security team wants to establish a process for continuous improvement. Which activity is most aligned with continuous improvement?

Publishing the security policy on the company intranet and leaving it unchanged.

Setting up a one-time audit to verify compliance with the framework.

Conducting periodic reviews of security metrics and adjusting policies based on findings.

Delegating all security monitoring to the cloud provider.

A company is implementing a cloud risk management process. After identifying and assessing risks, the team implements controls. What is the next step in the risk management process?

Continuously monitor the effectiveness of the controls and review risks on a regular basis.

Document the risk assessment and archive it for compliance purposes.

Reassess all risks using a different methodology.

Move on to the next project without further review.

A company is evaluating two risk mitigation options for a critical cloud application. Option 1 costs $50,000 per year and reduces the annualized loss expectancy (ALE) from $200,000 to $20,000. Option 2 costs $30,000 per year and reduces the ALE from $200,000 to $60,000. The company has a limited budget and wants to maximize risk reduction per dollar spent. Which option should the company choose?

Neither option, because the costs exceed the benefits.

Option 2, because it provides the best benefit-cost ratio.

Both options, because they are complementary.

Option 1, because it provides the greatest absolute reduction in ALE.

EC-CouncilCloud Security Essentials

Domain 8Objective 3

Cloud Security Governance and Risk Management CSE Practice Questions (Page 2)

Part of the Cloud Compliance and Governance domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

8 Concepts in This Objective

Cloud Security Governance Framework
Cloud Risk Management Process
Cloud Compliance Standards and Regulations
Shared Responsibility Model in Governance
Cloud Policy and Procedure Development
Risk Assessment Methods for Cloud
Cloud Risk Mitigation Strategies
Continuous Monitoring and Improvement

Questions 6–10

6expert · hard
A company is evaluating a new cloud service that will process sensitive financial data. The risk assessment reveals a high likelihood of a data breach due to the service's immature security controls. The company's risk appetite is moderate. Which combination of strategies is most appropriate?
Select an answer first
7application · medium
A company has implemented a cloud security governance framework. To ensure the framework remains effective, the security team wants to establish a process for continuous improvement. Which activity is most aligned with continuous improvement?
Select an answer first
8application · medium
A company is implementing a cloud risk management process. After identifying and assessing risks, the team implements controls. What is the next step in the risk management process?
Select an answer first
9expert · hard
A company is evaluating two risk mitigation options for a critical cloud application. Option 1 costs $50,000 per year and reduces the annualized loss expectancy (ALE) from $200,000 to $20,000. Option 2 costs $30,000 per year and reduces the ALE from $200,000 to $60,000. The company has a limited budget and wants to maximize risk reduction per dollar spent. Which option should the company choose?
Select an answer first
10foundation · easy
Which compliance framework is specifically designed for organizations that handle credit card information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud Security Governance and Risk Management CSE Practice Questions (Page 2)

Questions 6–10

A company is evaluating a new cloud service that will process sensitive financial data. The risk assessment reveals a high likelihood of a data breach due to the service's immature security controls. The company's risk appetite is moderate. Which combination of strategies is most appropriate?

A company has implemented a cloud security governance framework. To ensure the framework remains effective, the security team wants to establish a process for continuous improvement. Which activity is most aligned with continuous improvement?

A company is implementing a cloud risk management process. After identifying and assessing risks, the team implements controls. What is the next step in the risk management process?

Which compliance framework is specifically designed for organizations that handle credit card information?

Keep studying — Cloud Compliance and Governance