Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A cloud service provider wants to use the CSA CCM to map its controls to multiple compliance frameworks, including PCI DSS and ISO 27001. What is the primary benefit of using the CCM for this purpose?

   • AIt replaces the need for any other risk assessment framework.
   • BIt is the only framework recognized by all cloud providers.
   • CIt provides a single set of controls that can be mapped to multiple compliance standards, reducing duplication of effort.
   • DIt automatically generates compliance certificates for all mapped standards.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A cloud security consultant is helping a client map the CSA CCM controls to the shared responsibility model for a SaaS application. The client wants to ensure that all controls are properly assigned and that no gaps exist. Which approach is most effective?

   • ACreate a responsibility matrix that lists each CSA CCM control and identifies whether the provider, customer, or both are responsible, based on the SaaS service model.
   • BAssign all controls to the provider because they own the SaaS platform.
   • CAssign all controls to the customer because they are using the service.
   • DUse the NIST RMF to assign controls without considering the shared responsibility model.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team has implemented NIST RMF for a cloud environment and is now in the Monitor step. They have discovered that a new vulnerability in the cloud provider's service could affect their system. According to NIST RMF, what should the team do?

   • ASwitch to a different risk assessment framework to handle the vulnerability.
   • BAssess the impact of the vulnerability on the system, update the risk assessment, and implement necessary controls or mitigations.
   • CWait until the next scheduled risk assessment to address the vulnerability.
   • DImmediately re-categorize the system to a higher impact level.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A risk analyst is using the FAIR model to quantify the risk of a ransomware attack on a cloud-based file storage service. The analyst has estimated the threat event frequency and the loss magnitude. What is the next step in the FAIR model to calculate the risk?

   • ADivide the loss magnitude by the loss event frequency to obtain the risk probability.
   • BMultiply the loss event frequency by the loss magnitude to derive the annualized loss exposure.
   • CAdd the loss event frequency to the loss magnitude to determine the risk score.
   • DSubtract the loss event frequency from the loss magnitude to find the residual risk.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which framework is specifically designed to help organizations assess and manage risks associated with cloud computing?

   • AISO/IEC 27005
   • BCSA Cloud Controls Matrix (CCM)
   • CCOBIT 2019
   • DNIST SP 800-30
   Reveal Solution Discussion Select an answer first