3.6 Identify and Describe Methods for Managing Custom and Out-Of-The-Box Compliance Standards / Controls, Assessments, and Reporting CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a compliance standard, what is the correct way to align the standard with an organization's specific policy that requires an additional check not present in the default controls?

   • AModify the platform's global settings to include the check for all standards.
   • BIgnore the requirement because only out-of-the-box controls can be used.
   • CAdd a new control to the standard that implements the required check.
   • DDelete the standard and create a new one from scratch.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   Your security team needs to ensure that the Azure environment is continuously evaluated against the 'CIS Microsoft Azure Foundations Benchmark' every week. They also want to receive an email notification with the results after each evaluation. What should you configure?

   • ACreate a custom standard with CIS controls and schedule an assessment against it.
   • BRun a one-time assessment against the CIS benchmark and manually email the results.
   • CSchedule a compliance assessment against the CIS benchmark and configure a scheduled report with email distribution.
   • DSchedule a compliance report against the CIS benchmark, but do not run an assessment.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What information is typically found in the results of a compliance assessment?

   • AA list of resources that are compliant and non-compliant, along with the controls they passed or failed.
   • BThe login credentials for all cloud accounts.
   • CThe network topology of the cloud environment.
   • DThe total cost of all cloud resources.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   Your executive team wants a quarterly report that highlights the top 5 non-compliant controls and the percentage of resources that are non-compliant for each. You need to produce this report and send it to the executives. What is the best way to create this report?

   • AUse the default compliance report without customization.
   • BRun an assessment and manually create a presentation with the data.
   • CGenerate a compliance report and customize it to show the required metrics, then schedule it quarterly.
   • DSend the raw assessment results to the executives.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   Your organization has multiple business units, each with different compliance requirements. The finance team needs a report on the 'PCI DSS' standard, while the healthcare team needs a report on 'HIPAA'. Both teams want their reports to be generated and sent automatically on the first of each month. What is the most efficient way to manage this?

   • ACreate two separate scheduled reports, one for each standard, and configure the appropriate email recipients.
   • BCreate a single report that includes both standards and send it to both teams.
   • CRun assessments for both standards and manually email the results to each team.
   • DCreate a custom standard that combines PCI DSS and HIPAA controls and schedule a single report.
   Reveal Solution Discussion Select an answer first