Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A multinational corporation operates in a highly regulated industry and uses a hybrid cloud environment. They must comply with multiple regulations, including GDPR and local data residency laws. The risk team needs to select a framework that can be tailored to different regulatory requirements while also supporting continuous risk monitoring. Which framework selection is most appropriate?

   • ASelect the FAIR model to quantify risks and then use those numbers to prove compliance to regulators.
   • BUse only ISO/IEC 27005 because it is an international standard that automatically satisfies all regulatory requirements.
   • CAdopt NIST RMF as the overarching process and use CSA CCM to map controls to specific regulatory requirements.
   • DRely on the CSA CCM alone as the complete risk management framework, without any additional process.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A security manager wants to integrate a risk assessment framework into the organization's existing cloud risk management process, which already includes regular vulnerability scans and incident response. The goal is to ensure that risk assessments are updated based on new threats and changes in the cloud environment. Which practice best supports this integration?

   • ADiscontinue the existing incident response process and rely solely on the risk assessment framework.
   • BSchedule periodic risk reviews that incorporate vulnerability scan results and incident lessons learned into the risk assessment.
   • CConduct a risk assessment only when a major incident occurs.
   • DUse the FAIR model to replace the existing vulnerability scanning process.
   Reveal Solution Discussion Select an answer first