Cloud Engineer Risk Assessment & Management 3

Question 1

Which formula correctly calculates Annualized Loss Expectancy (ALE)?

Accepted Answer

ALE = SLE × ARO

Answer

ALE = SLE (Single Loss Expectancy) × ARO (Annualized Rate of Occurrence), giving the expected annual financial loss from a specific risk.

Question 2

A cloud governance team wants to ensure that residual risk after applying controls stays below the organization's risk appetite. What term describes this acceptable level of remaining risk?

Accepted Answer

Risk appetite

Answer

Risk appetite is the total amount of risk an organization is willing to accept in pursuit of its objectives, setting the boundary for residual risk.

Question 3

During a cloud security review, a risk is identified as having low likelihood but catastrophic impact. How should this risk be prioritized on a risk matrix?

Accepted Answer

Moderate to high priority — impact drives significance for low-frequency/high-consequence events

Answer

Risks with catastrophic impact demand elevated prioritization even at low likelihood because the consequences of a single occurrence can be devastating.

Question 4

Which NIST document provides a risk management framework widely used for cloud environments in U.S. federal agencies?

Accepted Answer

NIST SP 800-37 (RMF)

Answer

NIST SP 800-37 defines the Risk Management Framework (RMF), a six-step process for selecting, implementing, and monitoring security controls.

Question 5

A cloud engineer is assessing risk for a multi-tenant Kubernetes cluster. Which threat modeling approach focuses on attacker goals rather than system assets?

Accepted Answer

PASTA

Answer

PASTA (Process for Attack Simulation and Threat Analysis) is attacker-centric, simulating adversary goals and correlating them with business impact.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Risk Assessment & Management 3