Cloud Security Governance and Risk Management CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cloud security team is evaluating risks for a new serverless application. They have limited historical data on the likelihood of serverless-specific threats. The team needs to prioritize risks quickly and with minimal cost. Which risk assessment method is most appropriate in this situation?

   • AQuantitative risk assessment using Monte Carlo simulation with assumed probability distributions.
   • BDefer risk assessment until the application has been in production for six months.
   • CApply a risk acceptance strategy for all serverless risks because the provider is responsible for the platform.
   • DQualitative risk assessment using expert judgment and scenario analysis.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is using a cloud provider's Infrastructure as a Service (IaaS) offering. The company's security team is responsible for securing the operating system and applications running on the virtual machines. Which security control is the cloud provider MOST likely responsible for?

   • AManaging the identity and access management for the company's users.
   • BProtecting the physical hosts and hypervisor layer.
   • CConfiguring the firewall rules within the virtual machines.
   • DPatching the guest operating system of the virtual machines.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has identified a high-impact risk in its cloud environment: a misconfigured database that could expose customer data. The risk owner is considering four strategies: (1) implement database encryption and access controls, (2) purchase cyber insurance, (3) discontinue the service that uses the database, and (4) do nothing and document the risk. Which strategy is the most appropriate primary response if the company's risk appetite is low and the service is critical to revenue?

   • AMitigate the risk by implementing encryption and strict access controls.
   • BTransfer the risk by purchasing cyber insurance.
   • CAvoid the risk by discontinuing the service.
   • DAccept the risk and document it.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of cloud security governance?

   • ATo eliminate all security risks in the cloud environment
   • BTo transfer all security responsibilities to the cloud provider
   • CTo ensure that cloud operations align with organizational objectives and compliance requirements
   • DTo maximize cloud performance and reduce costs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A startup is launching a new web application and must process credit card payments. To achieve PCI DSS compliance, they need to minimize the scope of their cardholder data environment (CDE). Which strategy most effectively reduces PCI DSS scope?

   • AUse a third-party payment processor that handles cardholder data directly, so the startup never stores or processes card data.
   • BEncrypt all cardholder data stored in the startup's database.
   • COutsource the entire application hosting to a PCI-compliant cloud provider.
   • DSegment the network so that only a small part of the infrastructure can access cardholder data.
   Reveal Solution Discussion Select an answer first