Cloud Engineer Risk Assessment & Management 5 — Questions and Answers
Question 1: A cloud architect is designing a risk treatment plan for a DDoS threat against a public-facing API. Selecting AWS Shield Advanced transfers some financial risk because:
- Shield Advanced patches all API vulnerabilities automatically
- It includes Cost Protection that reimburses scaling costs incurred during a DDoS attack (Correct answer)
- It eliminates all network-layer threats
- It moves the workload to a private subnet
Correct answer: It includes Cost Protection that reimburses scaling costs incurred during a DDoS attack
AWS Shield Advanced Cost Protection reimburses EC2, CloudFront, and Route 53 scaling charges triggered by a DDoS event, financially transferring that risk to AWS.
Question 2: A secondary risk is best described as:
- A risk that existed before controls were applied
- A new risk introduced by implementing a risk treatment (Correct answer)
- A risk shared between two organizations
- A risk discovered during a penetration test
Correct answer: A new risk introduced by implementing a risk treatment
Secondary risks emerge as side effects of treatment actions—for example, a new vulnerability created by installing a third-party patch management tool.
Question 3: Which cloud security framework maps controls to risk categories and provides a Cloud Controls Matrix (CCM) specifically for cloud providers and customers?
- NIST CSF
- CIS Controls
- CSA STAR / CCM (Correct answer)
- ISO 27001
Correct answer: CSA STAR / CCM
The Cloud Security Alliance (CSA) Cloud Controls Matrix is purpose-built for cloud environments, mapping security domains to compliance requirements.
Question 4: An organization uses a risk heat map to visualize its risk portfolio. A risk plotted in the upper-right quadrant indicates:
- Low likelihood and low impact
- High likelihood and high impact (Correct answer)
- Low likelihood and high impact
- High likelihood and low impact
Correct answer: High likelihood and high impact
Heat maps plot likelihood on one axis and impact on the other; the upper-right quadrant represents risks that are both highly likely and severely impactful.
Question 5: When performing a cloud vendor risk assessment, which artifact best demonstrates that a cloud provider's security controls have been independently verified?
- The vendor's marketing whitepaper
- A SOC 2 Type II audit report (Correct answer)
- The vendor's internal policy documents
- An NDA with the vendor
Correct answer: A SOC 2 Type II audit report
A SOC 2 Type II report is issued by an independent auditor and attests that the vendor's controls were operating effectively over an audit period.
Question 6: Which technique uses probability distributions and thousands of simulated scenarios to model the range of possible financial outcomes from a cloud risk?
- Delphi technique
- Monte Carlo simulation (Correct answer)
- Bowtie analysis
- STRIDE modeling
Correct answer: Monte Carlo simulation
Monte Carlo simulation runs thousands of random iterations across probability distributions to produce a range of likely financial outcomes, supporting quantitative risk decisions.
Question 7: A cloud governance board reviews a risk that has been accepted for 18 months without re-evaluation. What risk management principle does this violate?
- Separation of duties
- Continuous risk monitoring and periodic reassessment (Correct answer)
- Defense in depth
- Least privilege
Correct answer: Continuous risk monitoring and periodic reassessment
Risk management requires periodic reassessment because threat landscapes, asset values, and control effectiveness change over time; stale accepted risks must be reviewed.
Cloud Engineer Risk Assessment & Management 5
A cloud architect is designing a risk treatment plan for a DDoS threat against a public-facing API.
Selecting AWS Shield Advanced transfers some financial risk because: