Identifying Cloud Security Risks CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is starting a cloud risk assessment and needs to gather information about how different departments use cloud services. The security team wants to identify risks that may not be visible through automated tools. Which method is most effective for this purpose?

   • ASend a questionnaire to all employees asking about their cloud usage
   • BConduct structured interviews with department heads and IT staff
   • CReview the company's financial records for cloud spending
   • DDeploy an automated cloud security posture management tool
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is using a cloud platform where multiple customers share the same physical infrastructure. The security team is concerned about the risk of another tenant accessing their data. Which cloud-specific risk is most directly related to this concern?

   • AMisconfiguration of the company's own firewall rules
   • BInsider threat from the company's own employees
   • CPhysical theft of servers in the data center
   • DData exposure due to multi-tenancy
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After identifying several cloud risks, a security analyst must document them for stakeholder review. Which documentation approach best supports further analysis and communication?

   • ASend an email to the IT team summarizing the risks in a paragraph
   • BCreate a risk register that lists each risk, its likelihood, impact, and recommended mitigation
   • CVerbally report the risks to the security manager and rely on their memory
   • DStore the findings in a shared spreadsheet without any categorization
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A cloud security team is identifying risks for a new software-as-a-service (SaaS) application that will handle employee personal data. The team needs to gather information about how the SaaS provider manages security and what data it processes. Which method is most appropriate for this initial risk identification?

   • APerform a network vulnerability scan of the SaaS provider's infrastructure
   • BConduct a questionnaire to the SaaS provider about security controls and data handling
   • CInterview the company's end users about their experience
   • DReview the company's own firewall logs
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a cloud environment with a mix of data: customer payment information, internal HR records, and public product documentation. The security team must classify these assets to prioritize risk assessment, but they have limited time. The company is subject to PCI DSS and GDPR. Which classification strategy best balances regulatory requirements and resource constraints?

   • AClassify based on the cloud provider's default labels
   • BClassify all data as high sensitivity to ensure compliance
   • CClassify customer payment information and HR records as high sensitivity, and product documentation as low
   • DClassify only customer payment information as high sensitivity
   Reveal Solution Discussion Select an answer first