Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which domain of the CSA CCM would most likely address controls related to data encryption and key management?

   • AData Security & Information Lifecycle Management
   • BApplication & Interface Security
   • CBusiness Continuity & Operations Resilience
   • DIdentity & Access Management
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a primary purpose of using a risk assessment framework in a cloud environment?

   • ATo replace the need for compliance audits
   • BTo automatically implement security controls without human intervention
   • CTo provide a structured and consistent methodology for identifying, analyzing, and evaluating risks
   • DTo guarantee that all identified risks are eliminated
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is using ISO/IEC 27005 to manage risks for its cloud email service. During the risk assessment, they identify that the risk of phishing is high. They decide to implement multi-factor authentication and employee training. What type of risk treatment option are they applying?

   • ARisk transfer
   • BRisk reduction
   • CRisk retention
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A multinational company uses a hybrid cloud environment with sensitive customer data stored in a public cloud object storage service. The risk manager wants to conduct a risk assessment following ISO/IEC 27005 and needs to ensure that risk treatment decisions are documented and reviewed periodically. Which sequence of activities aligns with ISO/IEC 27005?

   • AQuantify all risks using the FAIR model and then select controls from the CSA CCM without establishing a risk context.
   • BEstablish risk context, identify risks, analyze risks, evaluate risks, treat risks, and then monitor and review risks on a scheduled basis.
   • CPerform a single risk assessment and then archive the results without further review, as long as no major changes occur.
   • DIdentify risks, immediately implement controls, and then document the controls without performing risk analysis or evaluation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of the CSA Cloud Controls Matrix (CCM)?

   • ATo offer a certification program for cloud providers
   • BTo provide a legal framework for cloud contracts
   • CTo provide a set of cloud-specific security controls mapped to industry standards and best practices
   • DTo define a pricing model for cloud services
   Reveal Solution Discussion Select an answer first