CCSE Cloud Risk & Compliance Management 2

Question 1

Which risk treatment option involves transferring cloud security risk to a third party such as a cyber insurance provider?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial impact of a risk to a third party, such as purchasing cyber liability insurance.

Question 2

An organization discovers that its cloud provider stores backups in a jurisdiction with weak privacy laws. Which compliance concern does this primarily raise?

Accepted Answer

Data residency and sovereignty

Answer

Data residency and sovereignty laws require data to remain within specific geographic boundaries with appropriate legal protections.

Question 3

What is the primary purpose of a Cloud Security Alliance (CSA) STAR certification for a cloud provider?

Accepted Answer

Transparent assurance of cloud security controls

Answer

CSA STAR certification provides transparent, publicly accessible assurance of a cloud provider's security controls based on the Cloud Controls Matrix.

Question 4

Under the shared responsibility model, which security function remains ALWAYS the customer's responsibility regardless of service model (IaaS, PaaS, SaaS)?

Accepted Answer

Identity and access management for user accounts

Answer

Identity and access management for end-user accounts is always the customer's responsibility across all cloud service models.

Question 5

A risk register entry shows a vulnerability with high likelihood but low impact. What is the recommended initial response?

Accepted Answer

Monitor and implement low-cost controls

Answer

High-likelihood, low-impact risks are typically managed with cost-effective monitoring and lightweight controls rather than escalation or full transfer.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Risk & Compliance Management 2