Understand Implications of Cloud to Enterprise Risk Management CCSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which risk management framework is known for its integration with organizational governance and is often used to align risk management with business objectives?

   • AISO 31000
   • BITIL
   • CCOSO
   • DNIST RMF
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When assessing the risk environment in cloud computing, which dimension includes factors such as the cloud provider's financial stability and reputation?

   • ABusiness dimension
   • BVendor dimension
   • CInfrastructure dimension
   • DService dimension
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A company decides to stop using a cloud service that processes sensitive data because the provider cannot meet the required security standards. Which risk treatment strategy is being applied?

   • ATransfer
   • BAccept
   • CMitigate
   • DAvoid
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services firm is evaluating a cloud provider for hosting customer transaction data. The provider's risk management program documentation shows a risk appetite statement that accepts high-risk controls in favor of rapid feature deployment. The firm's own risk appetite is conservative, and it requires compensating controls for any high-risk area. What should the firm do first?

   • AAccept the provider's risk appetite as aligned with its own because the provider is responsible for its controls.
   • BTransfer the risk to the provider by signing a contract that holds the provider liable for any security incident.
   • CAssess the provider's controls and methodologies to determine if they meet the firm's risk tolerance, and consider requiring compensating controls or selecting another provider.
   • DReject the provider solely because its risk appetite differs from the firm's.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization uses a cloud SaaS provider to process patient records. The organization signs a contract defining the provider's responsibilities for data processing. A data breach occurs, and the organization must notify regulators. Who is primarily responsible for determining the breach notification requirements?

   • AThe data custodian, because it handles the day-to-day storage and protection of the records.
   • BThe data owner, because it has the authority to determine the purpose and means of processing and is accountable for compliance.
   • CThe cloud provider, because it manages the underlying infrastructure and detected the breach.
   • DThe data steward, because it ensures data quality and compliance with internal policies.
   Reveal Solution Discussion Select an answer first