Cloud Engineer Risk Assessment & Management 3 — Questions and Answers
Question 1: Which formula correctly calculates Annualized Loss Expectancy (ALE)?
- ALE = Asset Value × Exposure Factor
- ALE = SLE × ARO (Correct answer)
- ALE = MTTR × Threat Probability
- ALE = RTO × Recovery Cost
Correct answer: ALE = SLE × ARO
ALE = SLE (Single Loss Expectancy) × ARO (Annualized Rate of Occurrence), giving the expected annual financial loss from a specific risk.
Question 2: A cloud governance team wants to ensure that residual risk after applying controls stays below the organization's risk appetite. What term describes this acceptable level of remaining risk?
- Inherent risk
- Risk tolerance
- Risk threshold
- Risk appetite (Correct answer)
Correct answer: Risk appetite
Risk appetite is the total amount of risk an organization is willing to accept in pursuit of its objectives, setting the boundary for residual risk.
Question 3: During a cloud security review, a risk is identified as having low likelihood but catastrophic impact. How should this risk be prioritized on a risk matrix?
- Low priority — likelihood is the primary factor
- Moderate to high priority — impact drives significance for low-frequency/high-consequence events (Correct answer)
- Ignore it — catastrophic events are too rare to plan for
- Transfer it immediately without further analysis
Correct answer: Moderate to high priority — impact drives significance for low-frequency/high-consequence events
Risks with catastrophic impact demand elevated prioritization even at low likelihood because the consequences of a single occurrence can be devastating.
Question 4: Which NIST document provides a risk management framework widely used for cloud environments in U.S. federal agencies?
- NIST SP 800-53
- NIST SP 800-37 (RMF) (Correct answer)
- NIST CSF 2.0
- NIST SP 800-145
Correct answer: NIST SP 800-37 (RMF)
NIST SP 800-37 defines the Risk Management Framework (RMF), a six-step process for selecting, implementing, and monitoring security controls.
Question 5: A cloud engineer is assessing risk for a multi-tenant Kubernetes cluster. Which threat modeling approach focuses on attacker goals rather than system assets?
- STRIDE
- PASTA (Correct answer)
- DREAD
- VAST
Correct answer: PASTA
PASTA (Process for Attack Simulation and Threat Analysis) is attacker-centric, simulating adversary goals and correlating them with business impact.
Question 6: What is the purpose of a Business Impact Analysis (BIA) in cloud risk management?
- Identify all possible threat actors
- Determine the criticality of systems and the financial/operational effect of their disruption (Correct answer)
- Define firewall rule sets for cloud workloads
- Calculate the cost of penetration testing
Correct answer: Determine the criticality of systems and the financial/operational effect of their disruption
A BIA quantifies the operational and financial consequences of losing specific cloud services, driving RTO and RPO targets.
Question 7: Which control type is designed to detect risk events after they have occurred rather than prevent them?
- Preventive control
- Detective control (Correct answer)
- Corrective control
- Deterrent control
Correct answer: Detective control
Detective controls—such as CloudTrail logs and SIEM alerts—identify when a risk event has occurred so it can be investigated and remediated.
Cloud Engineer Risk Assessment & Management 3
Which formula correctly calculates Annualized Loss Expectancy (ALE)?