Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SaaS provider wants to assess its security posture against industry best practices and also prepare for a customer audit. They need a framework that provides a comprehensive set of cloud-specific controls and can be used to demonstrate compliance to customers. Which framework should they adopt?

   • ANIST RMF
   • BCSA Cloud Controls Matrix (CCM)
   • CISO/IEC 27005
   • DFAIR model
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which activity is essential for integrating a risk assessment framework into a continuous cloud risk management lifecycle?

   • AConducting periodic monitoring and review of risks and controls
   • BFocusing only on compliance audits
   • CDelegating all risk management to the cloud provider
   • DPerforming a one-time risk assessment at deployment
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In the FAIR model, what does 'Loss Magnitude' represent?

   • AThe number of controls implemented to mitigate a risk
   • BThe potential financial impact if a risk materializes
   • CThe probability that a threat event will occur
   • DThe likelihood that a vulnerability will be exploited
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company is migrating a critical application to a public cloud PaaS environment. The security team is conducting a risk assessment using ISO/IEC 27005 and needs to assign risk ownership for various risks. The team is unsure which risks are the provider's responsibility and which are the customer's. What is the most effective way to clarify risk ownership?

   • AMap each identified risk to the shared responsibility model, considering the PaaS service layer and the specific controls involved.
   • BUse the FAIR model to assign risk ownership based on financial impact.
   • CAssign all risks to the cloud provider because they own the platform.
   • DAssign all risks to the customer because they are using the service.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following best describes the role of continuous monitoring in an integrated cloud risk management process?

   • AIt is only required for compliance with ISO 27001
   • BIt replaces the need for periodic risk assessments
   • CIt provides real-time visibility into the effectiveness of security controls
   • DIt eliminates all residual risk
   Reveal Solution Discussion Select an answer first