Cloud Risk & Compliance Management Flashcards

Which risk treatment option involves transferring cloud security risk to a third party such as a cyber insurance provider?

Answer: Risk transference

Risk transference shifts the financial impact of a risk to a third party, such as purchasing cyber liability insurance.

An organization discovers that its cloud provider stores backups in a jurisdiction with weak privacy laws. Which compliance concern does this primarily raise?

Answer: Data residency and sovereignty

Data residency and sovereignty laws require data to remain within specific geographic boundaries with appropriate legal protections.

What is the primary purpose of a Cloud Security Alliance (CSA) STAR certification for a cloud provider?

Answer: Transparent assurance of cloud security controls

CSA STAR certification provides transparent, publicly accessible assurance of a cloud provider's security controls based on the Cloud Controls Matrix.

Under the shared responsibility model, which security function remains ALWAYS the customer's responsibility regardless of service model (IaaS, PaaS, SaaS)?

Answer: Identity and access management for user accounts

Identity and access management for end-user accounts is always the customer's responsibility across all cloud service models.

A risk register entry shows a vulnerability with high likelihood but low impact. What is the recommended initial response?

Answer: Monitor and implement low-cost controls

High-likelihood, low-impact risks are typically managed with cost-effective monitoring and lightweight controls rather than escalation or full transfer.

Which framework maps cloud security controls specifically to compliance requirements from PCI DSS, HIPAA, GDPR, and other regulations?

Answer: CSA Cloud Controls Matrix (CCM)

The CSA Cloud Controls Matrix maps cloud security controls to multiple compliance frameworks and industry standards in a single reference document.

What does a Residual Risk represent after security controls have been applied?

Answer: The risk level that remains after applying mitigation controls

Residual risk is the remaining level of risk after controls have been applied to reduce the inherent risk.