Risk Management and Compliance GCLD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best describes the shift in security responsibility when moving from IaaS to SaaS?

   • AThe provider's responsibility decreases because the customer manages the application
   • BThe customer becomes responsible for patching the underlying infrastructure
   • CThe provider assumes more responsibility for the application and underlying infrastructure
   • DThe customer gains more control over the operating system and middleware
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is using a cloud provider's platform-as-a-service (PaaS) offering to host a web application. The provider publishes a HIPAA attestation. What does this attestation indicate?

   • AThe provider is responsible for all HIPAA compliance
   • BThe provider's infrastructure is HIPAA compliant
   • CThe attestation is valid only for on-premises deployments
   • DThe customer is automatically HIPAA compliant
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is moving a critical application to the cloud. The risk assessment identifies that the provider's region could experience a prolonged outage. What is the best risk mitigation strategy?

   • AMove the application back on-premises
   • BAccept the risk because outages are rare
   • CDeploy the application across multiple availability zones
   • DPurchase additional cloud credits
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of a risk mitigation strategy in a cloud environment?

   • AConducting periodic risk assessments
   • BReviewing cloud provider compliance reports
   • CDocumenting all identified risks in a risk register
   • DImplementing encryption for data at rest and in transit
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is using a cloud provider's IaaS to host a web server. The provider offers a compliance certification for its data centers. The company's security team wants to use this certification to support their own compliance. What should they do?

   • AIgnore the provider's certification because it is not applicable to IaaS
   • BRely solely on the provider's certification to meet all compliance requirements
   • CMap the provider's certified controls to their own compliance requirements and identify gaps
   • DRequest a custom audit of the provider's entire infrastructure
   Reveal Solution Discussion Select an answer first