Cloud Engineer Risk Assessment & Management 4 â Questions and Answers
Question 1: A cloud team is conducting a risk assessment for a new AI/ML workload that processes PII. Which privacy regulation is most directly relevant for a US-based healthcare dataset?
- GDPR
- HIPAA (Correct answer)
- PCI DSS
- SOC 2
Correct answer: HIPAA
HIPAA governs Protected Health Information (PHI) in the US, making it the primary compliance framework for healthcare PII on cloud workloads.
Question 2: An organization runs critical workloads on AWS. Leadership wants to understand what risks remain after all current security controls are applied. This is called:
- Inherent risk
- Residual risk (Correct answer)
- Secondary risk
- Control risk
Correct answer: Residual risk
Residual risk is the exposure that remains after compensating controls have been implementedâit must stay within the organization's risk appetite.
Question 3: A cloud engineer discovers that a critical security patch cannot be applied because it breaks a legacy application. The team documents the vulnerability and monitors it closely instead. This approach is an example of:
- Risk avoidance
- Risk transference
- Compensating control / risk acceptance with monitoring (Correct answer)
- Risk elimination
Correct answer: Compensating control / risk acceptance with monitoring
When patching isn't feasible, applying compensating controls and increasing monitoring is a structured form of informed risk acceptance.
Question 4: Which AWS service provides a continuous risk and compliance assessment by checking resource configurations against security best practices?
- Amazon Inspector
- AWS Config with Conformance Packs (Correct answer)
- AWS CloudTrail
- Amazon GuardDuty
Correct answer: AWS Config with Conformance Packs
AWS Config with Conformance Packs evaluates resource configurations against compliance frameworks (CIS, PCI, NIST) on a continuous basis.
Question 5: During risk prioritization, which scoring model uses five factorsâDamage, Reproducibility, Exploitability, Affected users, and Discoverabilityâto rate vulnerabilities?
- CVSS
- DREAD (Correct answer)
- STRIDE
- OWASP Risk Rating
Correct answer: DREAD
DREAD is a Microsoft-originated vulnerability scoring model using five factors to produce a numeric risk score for prioritization.
Question 6: A risk owner has been assigned to a critical cloud database risk. What is the primary responsibility of a risk owner?
- Perform penetration tests on the database
- Ensure that treatment plans are implemented and the risk is monitored over time (Correct answer)
- Write the database backup scripts
- Report the risk to regulators
Correct answer: Ensure that treatment plans are implemented and the risk is monitored over time
The risk owner is accountable for ensuring that the agreed treatment plan is executed and that residual risk stays within acceptable bounds.
Question 7: Which risk assessment technique involves gathering structured input from multiple subject matter experts through iterative anonymous questionnaires?
- Monte Carlo simulation
- Delphi technique (Correct answer)
- Fault tree analysis
- Bowtie analysis
Correct answer: Delphi technique
The Delphi technique uses anonymous expert rounds to reach consensus on risk likelihood and impact, reducing groupthink bias.
Cloud Engineer Risk Assessment & Management 4
A cloud team is conducting a risk assessment for a new AI/ML workload that processes PII.
Which privacy regulation is most directly relevant for a US-based healthcare dataset?