Identifying Cloud Security Risks CSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A risk analyst is identifying risks for a new cloud service. The analyst has limited time and must choose between conducting interviews with the provider's security team and sending a detailed questionnaire. The provider has been responsive in the past, but the questionnaire may take weeks to be returned. Which approach is most appropriate?

   • AConduct interviews with the provider's security team
   • BSend the questionnaire and wait for the response
   • CUse automated tools to assess the provider's security
   • DSkip the provider assessment and rely on public information
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an automated tool commonly used to identify cloud security risks?

   • ACloud security posture management (CSPM) tools
   • BRisk assessment questionnaires
   • CThreat modeling workshops
   • DEmployee interviews
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a large amount of data in cloud storage, including public marketing files, internal project plans, and customer PII. The security team must classify the data to prioritize risk assessment. The company has a limited budget and cannot assess all data at the same level. What is the most effective classification strategy?

   • AClassify all data as high sensitivity to ensure thorough assessment
   • BClassify internal project plans as high sensitivity because they are not public
   • CClassify customer PII as high sensitivity, internal project plans as medium, and marketing files as low, then focus assessment on PII
   • DClassify marketing files as high sensitivity because they are public
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is moving its customer relationship management (CRM) system to a public cloud. The CRM contains sensitive customer data. The security team is identifying risks related to shared responsibility. Which risk is most directly associated with the shared responsibility model?

   • AThe cloud provider experiences a power outage in its data center
   • BThe cloud provider's physical security is breached
   • CThe customer fails to configure access controls on the CRM application
   • DThe cloud provider changes its pricing model
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a cloud-based customer relationship management (CRM) service. The CRM provider recently announced a change in its data retention policy, and the company's security team is concerned about potential exposure of customer data. The company has no direct control over the CRM's underlying infrastructure. Which risk source should the security team prioritize in their risk identification process?

   • AInsider threat from the company's own employees
   • BThird-party service provider policy changes
   • CMulti-tenancy vulnerabilities in the CRM platform
   • DInternal misconfiguration of the CRM's access controls
   Reveal Solution Discussion Select an answer first