Cloud Engineer Risk Assessment & Management 4

Question 1

A cloud team is conducting a risk assessment for a new AI/ML workload that processes PII. Which privacy regulation is most directly relevant for a US-based healthcare dataset?

Accepted Answer

HIPAA

Answer

HIPAA governs Protected Health Information (PHI) in the US, making it the primary compliance framework for healthcare PII on cloud workloads.

Question 2

An organization runs critical workloads on AWS. Leadership wants to understand what risks remain after all current security controls are applied. This is called:

Accepted Answer

Residual risk

Answer

Residual risk is the exposure that remains after compensating controls have been implemented—it must stay within the organization's risk appetite.

Question 3

A cloud engineer discovers that a critical security patch cannot be applied because it breaks a legacy application. The team documents the vulnerability and monitors it closely instead. This approach is an example of:

Accepted Answer

Compensating control / risk acceptance with monitoring

Answer

When patching isn't feasible, applying compensating controls and increasing monitoring is a structured form of informed risk acceptance.

Question 4

Which AWS service provides a continuous risk and compliance assessment by checking resource configurations against security best practices?

Accepted Answer

AWS Config with Conformance Packs

Answer

AWS Config with Conformance Packs evaluates resource configurations against compliance frameworks (CIS, PCI, NIST) on a continuous basis.

Question 5

During risk prioritization, which scoring model uses five factors—Damage, Reproducibility, Exploitability, Affected users, and Discoverability—to rate vulnerabilities?

Accepted Answer

DREAD

Answer

DREAD is a Microsoft-originated vulnerability scoring model using five factors to produce a numeric risk score for prioritization.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Risk Assessment & Management 4