A risk analyst is using the FAIR model to compare two cloud security investments. Investment A reduces the likelihood of a breach by 50%, while Investment B reduces the impact by 50%. The current annualized loss expectancy (ALE) is $1,000,000. Which investment should be prioritized if the goal is to minimize the ALE?

Either investment, because both reduce the ALE by the same amount.

The investment that results in the lower ALE, which depends on the current loss event frequency and loss magnitude.

Investment A, because reducing likelihood is always more effective than reducing impact.

Investment B, because reducing impact is always more effective than reducing likelihood.

EC-CouncilCloud Security Essentials

Domain 7Objective 2

Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 8)

Part of the Cloud Security Risk Assessment and Management domain, which makes up ~13% of our current practice bank.

52questions here

11free pages

8concepts

8 Concepts in This Objective

Cloud Risk Assessment Frameworks Overview
NIST Risk Management Framework (RMF) for Cloud
ISO/IEC 27005 Risk Management in Cloud
CSA Cloud Controls Matrix (CCM) as Risk Framework
FAIR Model for Cloud Risk Quantification
Selecting an Appropriate Framework
Mapping Frameworks to Cloud Shared Responsibility
Integrating Frameworks with Cloud Risk Management Process

Questions 36–40

36foundation · easy
Which factor in the FAIR model represents the probability that a threat event will occur?
Select an answer first
37expert · hard
A risk analyst is using the FAIR model to compare two cloud security investments. Investment A reduces the likelihood of a breach by 50%, while Investment B reduces the impact by 50%. The current annualized loss expectancy (ALE) is $1,000,000. Which investment should be prioritized if the goal is to minimize the ALE?
Select an answer first
38application · medium
A government contractor is moving a workload to a public cloud and must comply with FedRAMP requirements. The organization needs a risk assessment framework that is already mapped to FedRAMP and can help demonstrate compliance to the Joint Authorization Board. Which framework is the best choice?
Select an answer first
39foundation · easy
An organization operating in a highly regulated industry needs to demonstrate compliance with multiple standards. Which framework would be most suitable for mapping cloud controls to various compliance requirements?
Select an answer first
40foundation · easy
Which NIST RMF step is primarily concerned with determining the impact level of a cloud system based on confidentiality, integrity, and availability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 8)

Questions 36–40

Which factor in the FAIR model represents the probability that a threat event will occur?

A government contractor is moving a workload to a public cloud and must comply with FedRAMP requirements. The organization needs a risk assessment framework that is already mapped to FedRAMP and can help demonstrate compliance to the Joint Authorization Board. Which framework is the best choice?

An organization operating in a highly regulated industry needs to demonstrate compliance with multiple standards. Which framework would be most suitable for mapping cloud controls to various compliance requirements?

Which NIST RMF step is primarily concerned with determining the impact level of a cloud system based on confidentiality, integrity, and availability?

Keep studying — Cloud Security Risk Assessment and Management