Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company has implemented a risk management process based on NIST RMF for its cloud environment. The security team wants to ensure that risks are continuously monitored and that controls remain effective as the cloud environment changes. Which activity is most aligned with the 'Monitor' step of NIST RMF?

   • AContinuously track control effectiveness and system changes, and report the security state to appropriate officials on a scheduled basis.
   • BRe-categorize the system every time a minor change occurs, without assessing control effectiveness.
   • CPerform a one-time control assessment at the time of system authorization and then discontinue monitoring.
   • DReplace the NIST RMF with ISO/IEC 27005 for monitoring because it is more cloud-specific.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is deciding between two cloud security investments: one that reduces the likelihood of a data breach and another that reduces the impact of a breach. The CISO wants to use the FAIR model to determine which investment provides the greater risk reduction per dollar spent. What is the most appropriate way to use FAIR for this decision?

   • AUse FAIR to determine which investment is more aligned with the CSA CCM controls.
   • BUse FAIR to calculate the total cost of each investment and choose the cheaper one.
   • CEstimate the loss event frequency and loss magnitude for each investment scenario, calculate the annualized loss exposure for each, and compare the reduction in risk.
   • DUse FAIR to replace the need for a risk assessment framework entirely.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company uses a public cloud IaaS environment where the cloud provider manages the hypervisor and physical network, while the customer manages the virtual machines and applications. During a risk assessment using NIST RMF, the team must assign responsibility for implementing a control that restricts network access to the virtual machines. Who is responsible for implementing this control?

   • ABoth the provider and customer share equal responsibility for all network controls.
   • BThe cloud provider, because they manage the physical network infrastructure.
   • CThe customer, but only if the control is listed in the provider's compliance documentation.
   • DThe customer, because the control applies to the virtual network and virtual machines, which are customer-managed components in IaaS.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is evaluating risk assessment frameworks for a new cloud initiative. They need to choose between NIST RMF, ISO/IEC 27005, CSA CCM, and FAIR. The company has a strong compliance focus and needs to demonstrate due diligence to regulators, but also wants to quantify risks in financial terms for the board. Which combination of frameworks is most appropriate?

   • AUse only CSA CCM because it is cloud-specific and maps to regulations.
   • BUse NIST RMF as the primary process and integrate FAIR for financial quantification of key risks.
   • CUse ISO/IEC 27005 and FAIR, but skip NIST RMF because it is too complex.
   • DUse only FAIR because it provides the financial quantification the board wants.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which ISO/IEC 27005 activity involves estimating the likelihood and impact of a risk event on a cloud-based information asset?

   • ARisk identification
   • BRisk evaluation
   • CRisk analysis
   • DRisk communication
   Reveal Solution Discussion Select an answer first