Cloud Engineer Risk Assessment & Management 5

Question 1

A cloud architect is designing a risk treatment plan for a DDoS threat against a public-facing API. Selecting AWS Shield Advanced transfers some financial risk because:

Accepted Answer

It includes Cost Protection that reimburses scaling costs incurred during a DDoS attack

Answer

AWS Shield Advanced Cost Protection reimburses EC2, CloudFront, and Route 53 scaling charges triggered by a DDoS event, financially transferring that risk to AWS.

Question 2

A secondary risk is best described as:

Accepted Answer

A new risk introduced by implementing a risk treatment

Answer

Secondary risks emerge as side effects of treatment actions—for example, a new vulnerability created by installing a third-party patch management tool.

Question 3

Which cloud security framework maps controls to risk categories and provides a Cloud Controls Matrix (CCM) specifically for cloud providers and customers?

Accepted Answer

CSA STAR / CCM

Answer

The Cloud Security Alliance (CSA) Cloud Controls Matrix is purpose-built for cloud environments, mapping security domains to compliance requirements.

Question 4

An organization uses a risk heat map to visualize its risk portfolio. A risk plotted in the upper-right quadrant indicates:

Accepted Answer

High likelihood and high impact

Answer

Heat maps plot likelihood on one axis and impact on the other; the upper-right quadrant represents risks that are both highly likely and severely impactful.

Question 5

When performing a cloud vendor risk assessment, which artifact best demonstrates that a cloud provider's security controls have been independently verified?

Accepted Answer

A SOC 2 Type II audit report

Answer

A SOC 2 Type II report is issued by an independent auditor and attests that the vendor's controls were operating effectively over an audit period.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Risk Assessment & Management 5