Cloud Security Governance and Risk Management CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which risk assessment method uses subjective ratings such as high, medium, and low to evaluate risks?

   • AVulnerability scanning
   • BQuantitative analysis
   • CPenetration testing
   • DQualitative analysis
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial services company is evaluating two cloud providers for a new customer-facing application. Provider A offers a lower price but has experienced two publicized outages in the past year. Provider B is more expensive but has a stronger uptime record and offers contractual credits for downtime. The company's risk team needs to choose a provider while balancing cost and availability risk. Which approach best aligns with a quantitative risk assessment?

   • AEstimate the expected monetary loss from downtime for each provider and compare the total cost of ownership.
   • BSelect Provider A because the lower cost reduces financial risk.
   • CSelect Provider B because its better uptime eliminates all availability risk.
   • DPerform a qualitative risk assessment and choose the provider with the best security certifications.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How does the shared responsibility model affect cloud governance?

   • AIt eliminates the need for customer-side governance
   • BIt clarifies which security controls are managed by the provider and which by the customer
   • CIt transfers all compliance obligations to the provider
   • DIt requires the customer to audit the provider's physical security
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company operates a hybrid cloud environment and must comply with PCI DSS. The compliance team has implemented continuous monitoring, but the auditor requires evidence that monitoring is effective. Which additional step is necessary to close the loop in the continuous monitoring process?

   • AAutomate all remediation actions without human review.
   • BStore all monitoring logs for at least one year.
   • CEstablish a formal review process that periodically evaluates monitoring alerts and adjusts controls accordingly.
   • DIncrease the frequency of monitoring to every minute.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multinational e-commerce company processes credit card payments and stores personal data of customers in the EU. The company must comply with both PCI DSS and GDPR. The compliance team is designing a governance framework to address both sets of requirements. Which action best aligns with both regulations?

   • AAnonymize all personal data to avoid GDPR obligations, and use tokenization for cardholder data.
   • BImplement encryption for cardholder data at rest and in transit, and establish data subject access request (DSAR) procedures.
   • CRely solely on the cloud provider's PCI DSS attestation to ensure compliance.
   • DStore all personal data in the EU region and do not transfer any data outside the EU.
   Reveal Solution Discussion Select an answer first