Cloud Security Governance and Risk Management CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has implemented a cloud governance framework and wants to ensure ongoing compliance with GDPR and PCI DSS. The compliance team needs to detect configuration drift and unauthorized changes in real time. Which practice should they implement?

   • ASchedule quarterly manual audits of all cloud resources.
   • BRely on the cloud provider's compliance certifications to ensure ongoing compliance.
   • CPerform a one-time risk assessment and implement all recommended controls.
   • DDeploy continuous monitoring tools that automatically audit cloud resources and alert on policy violations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses a multi-cloud environment with workloads in AWS and Azure. The security team wants to establish a continuous monitoring process to detect misconfigurations and compliance drift. They currently have separate dashboards for each cloud provider. Which approach best supports continuous monitoring and improvement?

   • ARely on the cloud providers' compliance certifications to ensure ongoing security.
   • BCreate a manual checklist and have the security team audit configurations monthly.
   • CUse the native monitoring tools of each cloud provider and review them quarterly.
   • DDeploy a cloud security posture management (CSPM) tool that aggregates findings from both clouds into a single dashboard.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of an acceptable use policy (AUP) in a cloud environment?

   • ATo specify technical security controls for cloud services
   • BTo classify data based on sensitivity levels
   • CTo outline steps for responding to security incidents
   • DTo define the acceptable ways that cloud resources may be used
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is developing a cloud security policy. The policy must be enforceable and practical. Which characteristic is most important for the policy to be effective?

   • AThe policy is reviewed once every five years to ensure stability.
   • BThe policy is identical to the cloud provider's security policy.
   • CThe policy includes specific, measurable controls and assigns clear ownership for enforcement.
   • DThe policy is written in broad terms to allow flexibility in interpretation.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is developing an incident response policy for its cloud environment. The policy must define roles and responsibilities for detecting and responding to security incidents. Which element is most important to include in the policy?

   • AA clear escalation path and communication plan that includes the cloud provider's incident response contacts.
   • BA policy that prohibits the use of cloud provider tools for incident response.
   • CA list of all cloud provider data center locations.
   • DA requirement to delete all logs after an incident to protect privacy.
   Reveal Solution Discussion Select an answer first