Cloud Engineer Risk Assessment & Management 2 — Questions and Answers
Question 1: A cloud engineer must quantify the potential financial impact of a data breach affecting 50,000 customer records. Which metric best expresses this as a single dollar figure?
- Mean Time to Repair (MTTR)
- Single Loss Expectancy (SLE) (Correct answer)
- Recovery Point Objective (RPO)
- Annualized Rate of Occurrence (ARO)
Correct answer: Single Loss Expectancy (SLE)
Single Loss Expectancy (SLE) = Asset Value × Exposure Factor and represents the financial loss from one occurrence of a specific risk event.
Question 2: Which risk treatment option is most appropriate when the cost of mitigating a vulnerability exceeds the value of the asset it protects?
- Risk avoidance
- Risk acceptance (Correct answer)
- Risk transference
- Risk mitigation
Correct answer: Risk acceptance
Risk acceptance is used when the cost of controls exceeds the potential loss, making it economically rational to tolerate the risk.
Question 3: A company stores sensitive data in AWS S3. A penetration test reveals a misconfigured bucket policy that exposes data publicly. In the risk register, this misconfiguration is classified as:
- A threat
- A vulnerability (Correct answer)
- An impact
- A residual risk
Correct answer: A vulnerability
A vulnerability is a weakness in a system—here the misconfigured bucket policy—that can be exploited by a threat actor.
Question 4: During a cloud risk assessment, you discover that a third-party SaaS provider has access to your production database. Which risk category does this primarily represent?
- Operational risk
- Supply chain / third-party risk (Correct answer)
- Compliance risk
- Financial risk
Correct answer: Supply chain / third-party risk
Third-party vendor access introduces supply chain risk because the organization's security posture depends on the vendor's controls.
Question 5: Which document formally records identified risks, their likelihood, impact ratings, owners, and treatment plans for a cloud environment?
- Business Continuity Plan (BCP)
- Risk register (Correct answer)
- Security policy
- Disaster Recovery Plan (DRP)
Correct answer: Risk register
A risk register is the authoritative log that tracks all identified risks along with their assessments, owners, and mitigation status.
Question 6: An organization wants to transfer cloud infrastructure risk associated with hardware failure. Which mechanism most directly achieves this?
- Deploying across multiple availability zones
- Purchasing cyber liability insurance (Correct answer)
- Enabling AWS Shield Standard
- Implementing IAM least privilege
Correct answer: Purchasing cyber liability insurance
Cyber liability insurance transfers financial risk to an insurer, shifting the monetary burden of incidents away from the organization.
Question 7: A qualitative risk assessment rates risks using categories like High, Medium, and Low. What is the primary advantage of qualitative over quantitative assessment?
- It provides exact financial loss figures
- It is faster and requires less data to perform (Correct answer)
- It integrates directly with SLAs
- It automates remediation workflows
Correct answer: It is faster and requires less data to perform
Qualitative assessments use subjective scales and expert judgment, making them quicker to execute when precise financial data is unavailable.
Cloud Engineer Risk Assessment & Management 2
A cloud engineer must quantify the potential financial impact of a data breach affecting 50,000 customer records.
Which metric best expresses this as a single dollar figure?