Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is using ISO/IEC 27005 for risk management in a multi-cloud environment. They have identified a risk that is currently treated by accepting it, but the risk level has increased due to new regulatory requirements. What should the company do according to ISO/IEC 27005?

   • ASwitch to the FAIR model to quantify the risk and then decide.
   • BImmediately implement all possible controls without re-evaluating the risk.
   • CContinue accepting the risk because it was previously accepted.
   • DRe-evaluate the risk treatment decision, considering the new regulatory requirements, and select an appropriate treatment option (e.g., mitigate, transfer, or avoid).
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A startup is building a cloud-native application on a public cloud and needs a lightweight risk assessment process that can be integrated into their DevOps pipeline. They want to identify risks early and continuously, without a heavy compliance burden. Which framework is most suitable for this agile environment?

   • AIntegrate NIST RMF with automated security scanning and continuous monitoring in the CI/CD pipeline.
   • BRely solely on the CSA CCM to select controls without integrating risk assessment into the development process.
   • CUse ISO/IEC 27005 as a one-time assessment at project initiation and then stop.
   • DAdopt the FAIR model and only quantify risks after a security incident occurs.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is using NIST RMF to assess risks for a workload deployed on a public cloud IaaS platform. During the 'Assess' step, they find that the cloud provider has implemented physical security controls, but the customer is responsible for patching the operating system. How should the risk assessment document this?

   • ARecord the provider's physical controls as inherited and the customer's patching controls as system-specific, and assess both accordingly.
   • BAsk the provider to implement all controls, including OS patching, to simplify the assessment.
   • COnly assess the customer-implemented controls and ignore the provider's controls.
   • DMark all controls as inherited because the provider is responsible for the underlying infrastructure.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A government contractor is moving a workload to a public cloud and must apply the NIST RMF. During the 'Select' step, the team identifies a set of baseline controls. However, they realize that some controls are inherited from the cloud provider and others must be implemented by the customer. What is the most appropriate action to clarify control ownership and ensure the RMF process is correctly applied?

   • AAssume the cloud provider is responsible for all controls because it is a public cloud.
   • BSelect only the controls that the customer can implement on-premises to avoid ambiguity.
   • CSkip the Select step and proceed directly to implementation of all controls.
   • DMap each control to the shared responsibility model, documenting which party is accountable for implementation and monitoring.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the NIST Risk Management Framework (RMF), which step involves selecting and implementing security controls to mitigate identified risks?

   • AAuthorize
   • BCategorize
   • CAssess
   • DSelect
   Reveal Solution Discussion Select an answer first