Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial services firm is adopting the NIST Risk Management Framework (RMF) to assess a new cloud-based customer data platform. The platform uses a SaaS CRM and a PaaS database service. During the 'Select Controls' step, the security team must determine which controls are the responsibility of the organization versus the cloud provider. What is the most appropriate action?

   • AAdopt the CSA CCM controls as the sole control baseline and skip the NIST RMF categorization step.
   • BSelect baseline controls from NIST SP 800-53 and then apply the shared responsibility model to allocate control implementation between the organization and the cloud provider.
   • CSelect only the controls that the cloud provider's compliance documentation lists as implemented, and assume all other controls are not required.
   • DUse the FAIR model to select controls based on the financial impact of each risk, ignoring the NIST baseline controls.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A government agency is using NIST RMF to authorize a cloud system. During the 'Authorize' step, the authorizing official must decide whether to accept the residual risk. The system has a high-impact level, and the cloud provider has implemented many controls, but some residual risk remains. What should the authorizing official do?

   • AReject the system because any residual risk is unacceptable.
   • BReview the risk assessment report and the system security plan, and make an informed decision to authorize the system or not, based on the residual risk.
   • CAutomatically authorize the system because the cloud provider has implemented many controls.
   • DTransfer all residual risk to the cloud provider without further review.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is applying the NIST RMF to a new cloud application. During the 'Authorize' step, the authorizing official needs to make a risk-based decision. What information is most critical for this decision?

   • AThe cloud provider's marketing materials.
   • BThe number of controls implemented.
   • CThe results of the risk assessment, including the identified risks and the effectiveness of the implemented controls.
   • DThe total cost of the cloud services.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A cloud customer wants to use the CSA CCM to assess the security of a SaaS provider they are considering. What is the most effective way to use the CCM in this scenario?

   • AUse the CCM to replace the provider's own security assessments.
   • BUse the CCM to automatically enforce security controls on the provider.
   • CUse the CCM controls as a checklist to evaluate the provider's security posture and identify gaps.
   • DUse the CCM to calculate the financial risk of the provider.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational corporation operates in a region with strict data residency requirements and must also comply with international standards. They are evaluating risk frameworks for their cloud environment. They need a framework that is internationally recognized and can be adapted to local regulatory requirements. Which framework is most suitable?

   • ACSA CCM
   • BFAIR model
   • CNIST RMF
   • DISO/IEC 27005
   Reveal Solution Discussion Select an answer first