Risk Assessment Frameworks for Cloud Environments CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team is integrating ISO/IEC 27005 into their cloud risk management process. They have completed the initial risk assessment and implemented treatment plans. What should they do next to ensure the risk management process remains effective over time?

   • ADocument the results and archive them without further action.
   • BContinuously monitor risks and review the risk assessment periodically or when significant changes occur.
   • CStop the process until the next scheduled audit.
   • DOnly re-assess when a security incident occurs.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is using ISO/IEC 27005 to assess risks for a cloud-based HR system. They have identified that the risk of data leakage is high. They decide to accept the risk because the cost of mitigation exceeds the potential loss. What risk treatment option are they applying?

   • ARisk reduction
   • BRisk transfer
   • CRisk retention
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security team has implemented a risk management process based on NIST RMF and uses the CSA CCM as a control baseline. They now want to ensure that risks are continuously monitored and that new vulnerabilities are addressed promptly. Which approach best integrates these frameworks into a continuous risk management lifecycle?

   • AConduct a single comprehensive risk assessment and then only re-assess when a major incident occurs.
   • BSchedule periodic re-assessments and use automated monitoring tools to track control effectiveness and trigger reviews when deviations occur.
   • CRely solely on the cloud provider's security monitoring and alerts.
   • DReplace the NIST RMF with the CSA CCM to simplify the process.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is using a SaaS email service and wants to perform a risk assessment using the CSA CCM. The team needs to determine which controls are the responsibility of the SaaS provider and which are the customer's responsibility. Which approach is most appropriate?

   • AAssume the SaaS provider is responsible for all controls listed in the CSA CCM.
   • BUse the NIST RMF to assign all controls to the provider, ignoring the shared responsibility model.
   • CAssume the customer is responsible for all controls because they are using the service.
   • DMap the CSA CCM controls to the shared responsibility model, identifying provider-managed controls (e.g., physical security) and customer-managed controls (e.g., user access policies).
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which risk assessment framework is most appropriate when an organization needs to quantify cloud risks in monetary terms for executive decision-making?

   • AISO/IEC 27005
   • BCSA CCM
   • CNIST RMF
   • DFAIR
   Reveal Solution Discussion Select an answer first