Governance Risk Compliance And Security

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?

A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

A company is using a SaaS application for email. Which part of the security responsibility remains with the company?

An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

What is the primary risk mitigation strategy when storing data in a single availability zone?

A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?

Which THREE of the following are common benefits of adopting a Cloud Governance framework?

When a data breach occurs in a cloud environment, who is responsible for notifying the regulatory authorities?

Which TWO of the following are essential components of a Cloud Security Policy?

Which TWO of the following are key responsibilities of a Cloud Governance Committee?

Which THREE of the following represent common compliance risks in a cloud environment?

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Which TWO of the following are key steps in a Cloud Incident Response process?

Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?

Which TWO of the following are common threats to cloud-based data integrity?

Which THREE of the following are cloud security best practices?

Which TWO of the following are benefits of using Infrastructure as Code (IaC) for compliance?

Which THREE of the following are characteristics of a 'Defense in Depth' security strategy?

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. An internal audit finds that a developer copied a production database snapshot to a personal cloud storage bucket to test a reporting script. The organization must demonstrate to auditors that such data handling is prevented and detectable going forward. Which control should be implemented FIRST to directly address this governance and compliance gap?

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team must ensure that only authorized users can access the data and that all access is logged for audit purposes. Which cloud security control should be implemented to meet these requirements?

A healthcare company is migrating patient records to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company generates and controls, and that the cloud provider cannot access these keys. Which cloud service model should the company implement?

A financial services company is migrating its on-premises application to a public cloud. The security team must ensure that the cloud provider's employees cannot access the company's data, even though the provider manages the underlying infrastructure. Which cloud security mechanism should be implemented to achieve this?

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team wants to continuously verify that the cloud provider's controls meet HIPAA requirements without conducting a new audit each quarter. Which action should the team take?

A financial services firm is using a public cloud provider. An auditor requests evidence that the provider's physical data centers have adequate controls for access, environmental monitoring, and power redundancy. Which document should the firm provide to the auditor?

A company is adopting a public cloud model and needs to ensure that its data is stored only in specific geographic regions to comply with local data protection laws. Which cloud governance practice should the company implement?

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

A healthcare company is migrating its patient portal to a public cloud. The compliance team requires that the cloud provider's data centers be independently audited against SOC 2 Type II and ISO 27001. Which action should the company take FIRST to meet this requirement?

A healthcare startup stores patient records in a public cloud. The security team wants to ensure that data cannot be read if the underlying storage media is physically stolen from the provider's data center. Which control should they verify is enabled?

A multinational corporation must ensure that its cloud-based financial application complies with GDPR. The application processes personal data of EU citizens. The company wants to verify that the cloud provider's data processing agreement (DPA) includes the required GDPR clauses. Which document should the company request from the cloud provider to confirm compliance with GDPR data processing requirements?

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

A financial services firm is adopting a public cloud and must decide how to handle privileged access to the cloud management console. The security policy requires that no single administrator can both modify production workloads and delete audit logs. Which approach best satisfies this requirement?

A healthcare organization is migrating patient records to a public cloud. The security team must ensure that only authorized applications can access the storage buckets containing this data, and that access is logged for audit purposes. Which combination of AWS features should they implement to meet these requirements?

A company is using a cloud provider's infrastructure as a service (IaaS) offering. The security team must ensure that the operating system and applications on the virtual machines are patched and configured securely. According to the shared responsibility model, which party is responsible for these tasks?

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

A company is adopting a multi-cloud strategy and needs to implement identity and access management (IAM) consistently across AWS, Azure, and Google Cloud. The security team wants to centralize user authentication and authorization to reduce administrative overhead and enforce uniform security policies. Which two approaches should they use to achieve centralized IAM across multiple clouds? (Choose two.)

A financial services company is migrating to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company controls and can revoke at any time. Which key management approach should they implement?

A cloud governance team is drafting controls to reduce the risk of misconfiguration in a multi-account environment. Which two practices best support continuous compliance monitoring? (Choose two.)

A multinational corporation must ensure that customer data stored in its cloud environment remains within the borders of the country where it was collected, in accordance with local data sovereignty laws. Which cloud governance control should the corporation implement?

A financial services company is moving its transaction processing system to a public cloud. The compliance team requires that the cloud provider's security controls are independently validated, and that the company can continuously monitor the compliance status of its cloud resources. Which two actions should the company take to meet these requirements? (Choose two.)

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

A company wants to ensure that its cloud resources are tagged correctly for cost allocation and compliance. Which cloud governance practice should they implement to enforce tagging standards?

A startup wants to reduce the risk of losing data stored in a cloud object storage bucket. The team needs a governance control that protects against accidental deletion by an authorized user. Which action should the team take?

A company is deploying a new cloud-native application that must comply with GDPR. The application will process personal data of EU citizens. Which cloud governance practice is most important to implement to ensure data protection and privacy?

An organization's security team wants to detect and respond to suspicious activities in its cloud environment, such as unusual API calls or unauthorized configuration changes. Which cloud-native capability should the team use to meet this requirement?

A financial services company is using a public cloud to host a web application. The security team wants to ensure that all data stored in the cloud is encrypted at rest using keys that the company controls and can rotate independently. Which cloud service or feature should they implement to meet this requirement?

A multinational corporation must comply with GDPR, which requires that personal data of EU citizens not be transferred outside the EU without adequate safeguards. The company is using a cloud provider with data centers worldwide. Which cloud feature should they use to ensure compliance?

A company is adopting a cloud governance framework to manage risk and compliance. Which TWO of the following are primary objectives of a cloud governance framework? (Choose two.)

A retail company is migrating its e-commerce platform to a public cloud. The security team must decide how to handle encryption keys for data at rest in the cloud provider's object storage. The compliance officer requires that the company retain full control over key lifecycle management, including rotation and revocation, without the cloud provider being able to access the keys. Which approach BEST meets these requirements?

A multinational corporation is deploying a multi-cloud strategy with workloads on two different cloud providers. The security team must ensure that identity and access management (IAM) policies are consistently enforced across both environments, and that a single compromise of one cloud's credentials does not grant access to the other. Which solution BEST addresses these requirements?

A cloud operations team is reviewing its security posture for a newly deployed web application in a public cloud. The team must implement measures to protect the application from common web-based attacks and ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO of the following are the MOST appropriate security controls to implement? (Choose two.)

A small business is adopting a public cloud for the first time. The owner wants to ensure that the cloud provider's security responsibilities are clearly understood and that the business knows what it must secure. Which document should the business review to understand the division of security responsibilities between the provider and the customer?

A retail company is moving its customer relationship management (CRM) system to a public cloud provider under a shared responsibility model. The company's legal team needs to understand which compliance-related responsibility remains with the company rather than the cloud provider. Which of the following is the company's responsibility?

A small marketing firm wants to verify that a cloud provider's security controls are independently validated before signing a contract. The firm's auditor requests evidence that the provider has undergone an independent examination of its controls relevant to security, availability, and confidentiality. Which of the following should the firm request from the provider?

A multinational corporation stores personal data of European Union residents in a public cloud. The legal team must ensure the company can lawfully transfer that data to a cloud region outside the EU while meeting GDPR requirements. Which of the following is the most appropriate mechanism to rely on?

A software company is evaluating a cloud provider for a new application that will process payment card data. The security team must confirm that the provider's environment supports the company's PCI DSS obligations. Which of the following should the team verify first?

A cloud operations team is implementing a governance strategy to manage risk across multiple business units using different public cloud providers. The governance board wants to establish controls that provide centralized visibility and consistent policy enforcement. Which two of the following should the team implement? (Choose two.)