Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A financial services firm is evaluating the risk of a data breach in its cloud environment. The CISO wants to express risk in monetary terms to justify security investments to the board. The team has historical data on breach frequency and estimated loss per event. They also need to account for uncertainty in their estimates. Which framework is best suited for this quantitative risk analysis?

   • AFAIR model
   • BCSA CCM
   • CNIST RMF
   • DISO/IEC 27005
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   According to ISO/IEC 27005, which phase of risk management involves deciding whether to accept, avoid, transfer, or mitigate a risk?

   • ARisk analysis
   • BRisk treatment
   • CRisk identification
   • DRisk evaluation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A federal agency is required to use NIST RMF for its cloud systems. During the 'Categorize' step, the system is determined to have a high impact level. The team is now selecting controls. What is the primary consideration when selecting controls in a cloud environment?

   • ASelecting a baseline of controls and tailoring them based on the system's impact level and the shared responsibility model.
   • BSelecting all controls from the catalog regardless of impact level to ensure maximum security.
   • CSelecting only the controls that the cloud provider offers.
   • DSelecting controls based on the lowest cost to implement.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise is moving to a hybrid cloud model and must comply with multiple regulations. They need a risk framework that can be applied consistently across on-premises and cloud environments, and they also want to quantify risks in financial terms for board reporting. Which combination of frameworks would best meet these needs?

   • AUse only the CSA CCM for both risk assessment and financial quantification.
   • BUse ISO/IEC 27005 for the overall risk management process and FAIR for quantitative analysis of key risks.
   • CUse FAIR as the sole framework for all risk management activities.
   • DUse NIST RMF for cloud and ISO/IEC 27005 for on-premises, and do not combine them.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is using NIST RMF to assess a workload on a PaaS platform. The provider manages the runtime environment, but the customer is responsible for the application code and data. During the risk assessment, the team needs to determine who is responsible for patching the application framework. What is the correct approach?

   • AAssume the provider is responsible for all patching because it is a PaaS service.
   • BAssume the customer is responsible for all patching because they wrote the application code.
   • CCheck the shared responsibility model for the specific PaaS service to determine if the provider patches the framework or if the customer must do it.
   • DSkip patching responsibilities and focus only on data security.
   Reveal Solution Discussion Select an answer first