Cloud Security Governance and Risk Management CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In the cloud risk management process, what is the primary purpose of the risk assessment step?

   • ATo continuously monitor risk indicators
   • BTo evaluate the likelihood and impact of identified risks
   • CTo identify all potential risks in the cloud environment
   • DTo implement security controls to reduce risk
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is performing a risk assessment for a new cloud application. The risk team has identified that a data breach could cost $1 million, and the likelihood of a breach is estimated at 10% per year. What is the annualized loss expectancy (ALE) for this risk?

   • A$1,000,000
   • B$10,000,000
   • C$100,000
   • D$10,000
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In the shared responsibility model, which of the following is typically the responsibility of the cloud customer?

   • AManaging the hypervisor layer
   • BSecuring the physical data center facilities
   • CConfiguring access controls for their cloud resources
   • DPatching the underlying network infrastructure
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company uses a SaaS HR platform that stores employee personal data. The company is the data controller. A data breach occurs due to a vulnerability in the SaaS provider's application. Which party is responsible for notifying the regulatory authority?

   • AThe company, as the data controller, is responsible for notifying the regulatory authority.
   • BThe SaaS provider, as the data processor, is responsible for notifying the regulatory authority.
   • CThe party that discovered the breach first is responsible for notification.
   • DBoth parties are equally responsible for notifying the regulatory authority.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is subject to both GDPR and PCI DSS. They are designing a new cloud application that will store both personal data and cardholder data. Which approach best ensures compliance with both regulations?

   • AApply the stricter of the two regulations to all data.
   • BImplement separate data stores and security controls for personal data and cardholder data.
   • CUse a cloud provider that is certified for both GDPR and PCI DSS.
   • DStore all data in a single database and rely on encryption to protect it.
   Reveal Solution Discussion Select an answer first