Cloud Risk & Compliance Management Flashcards

What is the primary goal of a Business Impact Analysis (BIA) in cloud risk management?

Answer: To determine the criticality of business functions and acceptable recovery timeframes

A BIA identifies critical business functions, their dependencies, and acceptable RTO/RPO to prioritize recovery efforts after a disruption.

A cloud security engineer discovers that a third-party SaaS vendor has suffered a data breach affecting shared customer data. Under GDPR, what is the maximum time the data controller has to notify the supervisory authority?

Answer: 72 hours

GDPR Article 33 requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.

Which cloud risk management practice involves simulating the failure of cloud dependencies to evaluate resilience before an actual incident occurs?

Answer: Chaos engineering

Chaos engineering deliberately injects failures into cloud systems to identify weaknesses in resilience and recovery capabilities before real incidents occur.

When evaluating a new cloud vendor's compliance posture, which document provides the most direct evidence of their control environment without requiring a full audit?

Answer: SOC 2 Type II report

A SOC 2 Type II report is an independent auditor's assessment of a vendor's security controls over time, providing credible third-party evidence.

In cloud risk management, what does the term 'concentration risk' refer to?

Answer: Over-reliance on a single cloud provider for critical business functions

Concentration risk arises when an organization becomes overly dependent on a single cloud provider, creating systemic vulnerability if that provider experiences an outage or failure.

Which metric measures the maximum acceptable amount of data loss, expressed as a time period, following a cloud service disruption?

Answer: Recovery Point Objective (RPO)

Recovery Point Objective (RPO) defines the maximum acceptable age of data that can be recovered after a disruption, expressed as a time period.

A CCSE is reviewing a multi-tenant cloud environment where one tenant's misconfigured storage bucket exposes another tenant's data. This scenario is an example of which cloud-specific risk?

Answer: Tenant isolation failure

Tenant isolation failure occurs when security boundaries between cloud tenants break down, allowing one tenant's actions or data to affect another.