Cloud Security Governance and Risk Management CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is adopting a multi-cloud strategy and needs to establish a governance framework. The security team is drafting policies. Which policy component is essential to ensure that cloud resources are provisioned and used in alignment with the organization's risk appetite?

   • AA password policy that requires 12-character passwords for all cloud user accounts.
   • BA data classification policy that defines categories and handling requirements for all data stored in the cloud.
   • CA vendor management policy that requires all cloud providers to be ISO 27001 certified.
   • DA cost management policy that sets monthly spending limits for each cloud account.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is expanding its online store to accept payments from customers in the European Union. The company already complies with PCI DSS. The compliance officer wants to ensure the new EU customer data handling is compliant. What additional compliance requirement is most likely to apply?

   • AHIPAA, because the company will handle health information.
   • BNo additional requirements, because PCI DSS already covers all data protection.
   • CGDPR, because the company will process personal data of EU residents.
   • DSOC 2, because the company will process credit card payments.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which activity is a core component of cloud security governance?

   • ADefining security policies and assigning accountability for cloud resources
   • BPerforming daily backups of cloud data
   • CMigrating all workloads to a single cloud provider
   • DConfiguring network firewalls and intrusion detection systems
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is migrating a legacy application to an IaaS cloud. The application has a known vulnerability that the vendor will not patch. The security team has implemented network segmentation and strict firewall rules to limit exposure. However, the compliance officer is concerned that the risk is still too high. Which additional measure best addresses the residual risk?

   • AImplement an intrusion prevention system (IPS) and enable virtual patching.
   • BTransfer the risk to the cloud provider by signing a liability waiver.
   • CAccept the residual risk because the network segmentation is sufficient.
   • DDisable the application's network access entirely.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A multinational company is developing a cloud security policy. The company operates in the EU and the US and processes personal data of EU citizens. The policy must address GDPR requirements. Which policy element is essential to include?

   • AA policy that prohibits the use of any public cloud for personal data.
   • BA policy that delegates all GDPR compliance responsibilities to the cloud provider.
   • CA data classification scheme that identifies personal data and applies appropriate safeguards.
   • DA policy that requires all personal data to be stored only in the EU.
   Reveal Solution Discussion Select an answer first