A company has identified a high-risk vulnerability in a cloud application that is critical to business operations. The vulnerability could be exploited to access customer data. The company's risk appetite is low, but the application cannot be taken offline without significant business disruption. Which risk treatment option is most appropriate?

Accept the risk because taking the application offline is too disruptive.

Avoid the risk by immediately shutting down the application.

Transfer the risk by purchasing cyber insurance.

Implement compensating controls, such as web application firewall (WAF) and enhanced monitoring, while planning a patch.

What is the purpose of continuous monitoring in cloud risk management?

To transfer risks to the cloud provider

To perform a one-time risk assessment

To ensure that security controls remain effective and compliant over time

To replace the need for risk mitigation

An organization is establishing a cloud governance framework. The board of directors wants to ensure that cloud investments align with business objectives while managing risk. Which governance structure is most effective?

Establish a cloud governance framework that is identical to the on-premises governance framework.

Delegate all cloud governance decisions to the IT security team.

Create a cloud governance board with representatives from security, finance, legal, and business units.

Adopt the cloud provider's governance policies as the organization's own.

What is the primary goal of implementing security controls as a risk mitigation strategy?

To document risks for compliance purposes

To reduce the likelihood or impact of a risk

To transfer the risk to the cloud provider

To eliminate all risks completely

A company is moving from an on-premises data center to a public cloud IaaS model. The security team is concerned about the loss of physical control over the infrastructure. Which risk treatment is most appropriate to address this concern?

Mitigate the risk by selecting a provider with strong physical security certifications and conducting regular audits.

Avoid the risk by keeping all data on-premises.

Accept the risk because the cloud provider is responsible for physical security.

Transfer the risk by requiring the provider to sign a contract with liability clauses.

EC-CouncilCloud Security Essentials

Domain 8Objective 3

Cloud Security Governance and Risk Management CSE Practice Questions (Page 4)

Part of the Cloud Compliance and Governance domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

8 Concepts in This Objective

Cloud Security Governance Framework
Cloud Risk Management Process
Cloud Compliance Standards and Regulations
Shared Responsibility Model in Governance
Cloud Policy and Procedure Development
Risk Assessment Methods for Cloud
Cloud Risk Mitigation Strategies
Continuous Monitoring and Improvement

Questions 16–20

16expert · hard
A company has identified a high-risk vulnerability in a cloud application that is critical to business operations. The vulnerability could be exploited to access customer data. The company's risk appetite is low, but the application cannot be taken offline without significant business disruption. Which risk treatment option is most appropriate?
Select an answer first
17foundation · easy
What is the purpose of continuous monitoring in cloud risk management?
Select an answer first
18application · medium
An organization is establishing a cloud governance framework. The board of directors wants to ensure that cloud investments align with business objectives while managing risk. Which governance structure is most effective?
Select an answer first
19foundation · easy
What is the primary goal of implementing security controls as a risk mitigation strategy?
Select an answer first
20expert · hard
A company is moving from an on-premises data center to a public cloud IaaS model. The security team is concerned about the loss of physical control over the infrastructure. Which risk treatment is most appropriate to address this concern?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.