Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare startup is migrating its patient-facing web application to AWS. The company must comply with HIPAA and wants to use a risk framework that provides a comprehensive set of cloud-specific security controls mapped to compliance requirements. The security team has limited experience with formal risk management and needs a framework that can be used as a baseline for both risk assessment and continuous compliance monitoring. Which framework should they choose?

   • AFAIR model
   • BISO/IEC 27005
   • CCSA Cloud Controls Matrix (CCM)
   • DNIST Risk Management Framework (RMF)
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is using the FAIR model to quantify the risk of a ransomware attack on a cloud storage service. They have estimated that the annualized loss expectancy (ALE) is $500,000. However, the analyst is uncertain about the probability of a breach. What is the best way to handle this uncertainty in the FAIR analysis?

   • AUse a range of probabilities and calculate a range of possible ALE values to present to management.
   • BIgnore the uncertainty and use a single point estimate for simplicity.
   • CUse the most optimistic probability to keep the ALE low and avoid alarming management.
   • DUse the most pessimistic probability to ensure the worst-case scenario is covered.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When applying a risk assessment framework to a cloud environment, which activity is most aligned with the customer's responsibility in the shared responsibility model?

   • AReviewing the provider's physical security controls
   • BManaging risks of the underlying network infrastructure
   • CAssessing risks related to the hypervisor
   • DEvaluating risks associated with the customer's data classification and access controls
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization is migrating a patient-facing application to a public cloud IaaS environment. The compliance team must demonstrate alignment with HIPAA security requirements to auditors. The organization has no existing risk framework in place and needs a structured way to map cloud-specific controls to HIPAA requirements while clarifying which security controls are the cloud provider's responsibility. Which approach best meets these needs?

   • AAdopt the CSA Cloud Controls Matrix (CCM) and map its control domains to HIPAA security rule requirements, using the shared responsibility model to assign control ownership.
   • BUse ISO/IEC 27005 to perform a risk assessment and then select controls from ISO/IEC 27002, assuming these controls automatically satisfy HIPAA requirements.
   • CImplement the NIST Risk Management Framework (RMF) steps and rely on the system security plan to document HIPAA compliance without referencing cloud-specific controls.
   • DApply the FAIR model to quantify the financial risk of a data breach and use that quantification as the sole evidence of HIPAA compliance.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the cloud shared responsibility model, which party is typically responsible for managing risks associated with the physical security of data centers?

   • ACloud service provider
   • BThird-party auditor
   • CBoth customer and provider equally
   • DCloud customer
   Reveal Solution Discussion Select an answer first