CLO-002 Governance Risk Compliance And Security — All Questions With Answers

Question 1mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization wants to prevent users from creating resources in regions other than the ones approved by corporate policy. What should be used to enforce this?

Question 2mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company needs to ensure that only authorized devices can access internal cloud applications. Which mechanism verifies device posture before granting access?

Question 3mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A developer is writing code that accesses an API key. Instead of hardcoding the key, which service should they use to retrieve it securely at runtime?

Question 4hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following scenarios represent a breach of the Shared Responsibility Model?

Question 5mediummultiple choice

Study the full ACL explanation →

A healthcare company stores patient records in a public cloud object storage bucket. The security team needs to detect and automatically alert on any changes to the bucket's access control list (ACL) or bucket policy in near real-time. Which cloud-native service or feature should they use to achieve this?

Question 6hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation is using a hybrid cloud model. The security team needs to ensure that data transferred between the on-premises data center and the public cloud is encrypted and that the encryption keys are managed by the corporation, not the cloud provider. Which solution should they implement?

Question 7mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating its customer relationship management (CRM) system to a public cloud. The legal team requires that the cloud provider's data processing agreement (DPA) includes specific data protection clauses and that the provider complies with the EU-U.S. Privacy Shield framework. Which action should the company take first to ensure compliance?

Question 8hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Question 9mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Question 10mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

Question 11easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Question 12mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Question 13hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

Question 14mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Question 15easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

Question 16mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Question 17mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Question 18easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Question 19hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Question 20hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Question 21easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?

Question 22mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Question 23mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

Question 24hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

Question 25easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?

Question 26hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?

Question 27mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Question 28mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Question 29easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

Question 30mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is using a SaaS application for email. Which part of the security responsibility remains with the company?

Question 31mediummultiple choice

Review the full subnetting walkthrough →

An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?

Question 32hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Question 33mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

What is the primary risk mitigation strategy when storing data in a single availability zone?

Question 34hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?

Question 35mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are common benefits of adopting a Cloud Governance framework?

Question 36easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

When a data breach occurs in a cloud environment, who is responsible for notifying the regulatory authorities?

Question 37mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are essential components of a Cloud Security Policy?

Question 38mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are key responsibilities of a Cloud Governance Committee?

Question 39hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following represent common compliance risks in a cloud environment?

Question 40mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Question 41mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Question 42hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are key steps in a Cloud Incident Response process?

Question 43mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?

Question 44hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are common threats to cloud-based data integrity?

Question 45mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are cloud security best practices?

Question 46mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are benefits of using Infrastructure as Code (IaC) for compliance?

Question 47hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are characteristics of a 'Defense in Depth' security strategy?

Question 48mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. An internal audit finds that a developer copied a production database snapshot to a personal cloud storage bucket to test a reporting script. The organization must demonstrate to auditors that such data handling is prevented and detectable going forward. Which control should be implemented FIRST to directly address this governance and compliance gap?

Question 49mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team must ensure that only authorized users can access the data and that all access is logged for audit purposes. Which cloud security control should be implemented to meet these requirements?

Question 50mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare company is migrating patient records to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company generates and controls, and that the cloud provider cannot access these keys. Which cloud service model should the company implement?

Question 51hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is migrating its on-premises application to a public cloud. The security team must ensure that the cloud provider's employees cannot access the company's data, even though the provider manages the underlying infrastructure. Which cloud security mechanism should be implemented to achieve this?

Question 52mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team wants to continuously verify that the cloud provider's controls meet HIPAA requirements without conducting a new audit each quarter. Which action should the team take?

Question 53hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services firm is using a public cloud provider. An auditor requests evidence that the provider's physical data centers have adequate controls for access, environmental monitoring, and power redundancy. Which document should the firm provide to the auditor?

Question 54easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a public cloud model and needs to ensure that its data is stored only in specific geographic regions to comply with local data protection laws. Which cloud governance practice should the company implement?

Question 55hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

Question 56mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare company is migrating its patient portal to a public cloud. The compliance team requires that the cloud provider's data centers be independently audited against SOC 2 Type II and ISO 27001. Which action should the company take FIRST to meet this requirement?

Question 57mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare startup stores patient records in a public cloud. The security team wants to ensure that data cannot be read if the underlying storage media is physically stolen from the provider's data center. Which control should they verify is enabled?

Question 58hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must ensure that its cloud-based financial application complies with GDPR. The application processes personal data of EU citizens. The company wants to verify that the cloud provider's data processing agreement (DPA) includes the required GDPR clauses. Which document should the company request from the cloud provider to confirm compliance with GDPR data processing requirements?

Question 59hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

Question 60mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services firm is adopting a public cloud and must decide how to handle privileged access to the cloud management console. The security policy requires that no single administrator can both modify production workloads and delete audit logs. Which approach best satisfies this requirement?

Question 61mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization is migrating patient records to a public cloud. The security team must ensure that only authorized applications can access the storage buckets containing this data, and that access is logged for audit purposes. Which combination of AWS features should they implement to meet these requirements?

Question 62mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is using a cloud provider's infrastructure as a service (IaaS) offering. The security team must ensure that the operating system and applications on the virtual machines are patched and configured securely. According to the shared responsibility model, which party is responsible for these tasks?

Question 63easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

Question 64mediummulti select

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a multi-cloud strategy and needs to implement identity and access management (IAM) consistently across AWS, Azure, and Google Cloud. The security team wants to centralize user authentication and authorization to reduce administrative overhead and enforce uniform security policies. Which two approaches should they use to achieve centralized IAM across multiple clouds? (Choose two.)

Question 65hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is migrating to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company controls and can revoke at any time. Which key management approach should they implement?

Question 66hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud governance team is drafting controls to reduce the risk of misconfiguration in a multi-account environment. Which two practices best support continuous compliance monitoring? (Choose two.)

Question 67mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must ensure that customer data stored in its cloud environment remains within the borders of the country where it was collected, in accordance with local data sovereignty laws. Which cloud governance control should the corporation implement?

Question 68hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A financial services company is moving its transaction processing system to a public cloud. The compliance team requires that the cloud provider's security controls are independently validated, and that the company can continuously monitor the compliance status of its cloud resources. Which two actions should the company take to meet these requirements? (Choose two.)

Question 69easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

Question 70easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company wants to ensure that its cloud resources are tagged correctly for cost allocation and compliance. Which cloud governance practice should they implement to enforce tagging standards?

Question 71easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A startup wants to reduce the risk of losing data stored in a cloud object storage bucket. The team needs a governance control that protects against accidental deletion by an authorized user. Which action should the team take?

Question 72easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is deploying a new cloud-native application that must comply with GDPR. The application will process personal data of EU citizens. Which cloud governance practice is most important to implement to ensure data protection and privacy?

Question 73hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization's security team wants to detect and respond to suspicious activities in its cloud environment, such as unusual API calls or unauthorized configuration changes. Which cloud-native capability should the team use to meet this requirement?

Question 74hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is using a public cloud to host a web application. The security team wants to ensure that all data stored in the cloud is encrypted at rest using keys that the company controls and can rotate independently. Which cloud service or feature should they implement to meet this requirement?

Question 75mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must comply with GDPR, which requires that personal data of EU citizens not be transferred outside the EU without adequate safeguards. The company is using a cloud provider with data centers worldwide. Which cloud feature should they use to ensure compliance?

Question 76hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a cloud governance framework to manage risk and compliance. Which TWO of the following are primary objectives of a cloud governance framework? (Choose two.)

Question 77mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A retail company is migrating its e-commerce platform to a public cloud. The security team must decide how to handle encryption keys for data at rest in the cloud provider's object storage. The compliance officer requires that the company retain full control over key lifecycle management, including rotation and revocation, without the cloud provider being able to access the keys. Which approach BEST meets these requirements?

Question 78hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation is deploying a multi-cloud strategy with workloads on two different cloud providers. The security team must ensure that identity and access management (IAM) policies are consistently enforced across both environments, and that a single compromise of one cloud's credentials does not grant access to the other. Which solution BEST addresses these requirements?

Question 79mediummulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud operations team is reviewing its security posture for a newly deployed web application in a public cloud. The team must implement measures to protect the application from common web-based attacks and ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO of the following are the MOST appropriate security controls to implement? (Choose two.)

Question 80easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small business is adopting a public cloud for the first time. The owner wants to ensure that the cloud provider's security responsibilities are clearly understood and that the business knows what it must secure. Which document should the business review to understand the division of security responsibilities between the provider and the customer?

Question 81mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A retail company is moving its customer relationship management (CRM) system to a public cloud provider under a shared responsibility model. The company's legal team needs to understand which compliance-related responsibility remains with the company rather than the cloud provider. Which of the following is the company's responsibility?

Question 82easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small marketing firm wants to verify that a cloud provider's security controls are independently validated before signing a contract. The firm's auditor requests evidence that the provider has undergone an independent examination of its controls relevant to security, availability, and confidentiality. Which of the following should the firm request from the provider?

Question 83hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation stores personal data of European Union residents in a public cloud. The legal team must ensure the company can lawfully transfer that data to a cloud region outside the EU while meeting GDPR requirements. Which of the following is the most appropriate mechanism to rely on?

Question 84mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A software company is evaluating a cloud provider for a new application that will process payment card data. The security team must confirm that the provider's environment supports the company's PCI DSS obligations. Which of the following should the team verify first?

Question 85hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud operations team is implementing a governance strategy to manage risk across multiple business units using different public cloud providers. The governance board wants to establish controls that provide centralized visibility and consistent policy enforcement. Which two of the following should the team implement? (Choose two.)

Question 1mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization wants to prevent users from creating resources in regions other than the ones approved by corporate policy. What should be used to enforce this?

Question 2mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company needs to ensure that only authorized devices can access internal cloud applications. Which mechanism verifies device posture before granting access?

Question 3mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A developer is writing code that accesses an API key. Instead of hardcoding the key, which service should they use to retrieve it securely at runtime?

Question 4hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following scenarios represent a breach of the Shared Responsibility Model?

Question 5mediummultiple choice

Study the full ACL explanation →

A healthcare company stores patient records in a public cloud object storage bucket. The security team needs to detect and automatically alert on any changes to the bucket's access control list (ACL) or bucket policy in near real-time. Which cloud-native service or feature should they use to achieve this?

Question 6hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation is using a hybrid cloud model. The security team needs to ensure that data transferred between the on-premises data center and the public cloud is encrypted and that the encryption keys are managed by the corporation, not the cloud provider. Which solution should they implement?

Question 7mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating its customer relationship management (CRM) system to a public cloud. The legal team requires that the cloud provider's data processing agreement (DPA) includes specific data protection clauses and that the provider complies with the EU-U.S. Privacy Shield framework. Which action should the company take first to ensure compliance?

Question 8hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An enterprise is deploying a hybrid cloud model and must ensure that data moving between the on-premises data center and the cloud provider is encrypted. Which mechanism is most appropriate?

Question 9mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A security analyst notices unauthorized changes to cloud infrastructure. Which service should be analyzed to identify which IAM user made the changes?

Question 10mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that all virtual machines in a cloud environment comply with corporate security standards (e.g., specific OS versions), which tool should be used to enforce configuration policies automatically?

Question 11easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A project manager is reviewing cloud resource usage to ensure compliance with a budget governance policy. Which cloud service dashboard provides the most direct view of current resource costs and budget alerts?

Question 12mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating sensitive financial data to AWS and needs to ensure that all data is encrypted at rest using customer-managed keys. Which service should the administrator configure to manage these keys while maintaining audit logs for compliance?

Question 13hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization is subject to GDPR and needs to ensure that personal data stored in an Azure SQL Database is protected against unauthorized access. Which feature should be enabled to identify potential vulnerabilities and anomalies?

Question 14mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A cloud architect is defining a security group for a web server. To adhere to the principle of least privilege, which inbound rule should be configured to allow only standard HTTPS traffic?

Question 15easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

An auditor requests evidence that an organization is managing cloud risks. Which document should the IT team provide as the primary evidence of risk mitigation strategies?

Question 16mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To meet compliance requirements, a firm must store log files for seven years in a read-only state. Which storage configuration provides this level of immutability?

Question 17mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A cloud architect needs to ensure that all cloud resources are tagged with an 'Owner' and 'Environment' tag for governance. Which service helps automate the detection and remediation of non-compliant resources?

Question 18easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

Which cloud computing concept best describes the ability to add and remove resources based on traffic demands to maintain performance?

Question 19hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

After a security incident, it is discovered that a S3 bucket was publicly accessible. Which feature should be used to prevent this from happening in the future?

Question 20hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

To comply with data sovereignty laws, a database must remain within a specific country's borders. Which architectural strategy ensures this?

Question 21easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

When following the Shared Responsibility Model, which security aspect is the customer's responsibility in an IaaS environment?

Question 22mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that all data is encrypted before being sent to the cloud, which encryption method should the organization employ?

Question 23mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is conducting a risk assessment and needs to determine the impact of a potential cloud service provider outage. Which document provides the provider's commitment to uptime?

Question 24hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An administrator needs to implement a centralized logging solution for multiple cloud accounts. Which service allows for aggregating security logs into a single security account?

Question 25easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization wants to implement an Identity Provider (IdP) to allow employees to use their corporate credentials for cloud logins. Which protocol is typically used for this purpose?

Question 26hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A security engineer is setting up a Web Application Firewall (WAF) to protect a public-facing application. Which feature is most effective against common SQL injection attacks?

Question 27mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

Which IAM entity should be created to delegate temporary access to a third-party service provider without sharing long-term credentials?

Question 28mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

To ensure that no single administrator has full control over the environment, which security practice should be implemented?

Question 29easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is evaluating the risk of moving to the cloud. Which business driver is most relevant to 'Agility' in a cloud adoption context?

Question 30mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is using a SaaS application for email. Which part of the security responsibility remains with the company?

Question 31mediummultiple choice

Review the full subnetting walkthrough →

An administrator needs to ensure that only authorized traffic enters a private subnet. Which network component should be configured as a first line of defense?

Question 32hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A compliance officer needs to generate a report showing all instances that are not compliant with a standard CIS benchmark. Which service should be used?

Question 33mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

What is the primary risk mitigation strategy when storing data in a single availability zone?

Question 34hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A firm must perform a third-party security audit. What type of document should they obtain from the cloud provider to prove compliance with ISO 27001?

Question 35mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are common benefits of adopting a Cloud Governance framework?

Question 36easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

When a data breach occurs in a cloud environment, who is responsible for notifying the regulatory authorities?

Question 37mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are essential components of a Cloud Security Policy?

Question 38mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are key responsibilities of a Cloud Governance Committee?

Question 39hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following represent common compliance risks in a cloud environment?

Question 40mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following tools or methods are used to secure data in transit in the cloud?

Question 41mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are effective methods for mitigating risks associated with cloud adoption?

Question 42hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are key steps in a Cloud Incident Response process?

Question 43mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are valid reasons for establishing a Cloud Center of Excellence (CCoE)?

Question 44hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are common threats to cloud-based data integrity?

Question 45mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are cloud security best practices?

Question 46mediummulti select

Read the full Governance Risk Compliance And Security explanation →

Which TWO of the following are benefits of using Infrastructure as Code (IaC) for compliance?

Question 47hardmulti select

Read the full Governance Risk Compliance And Security explanation →

Which THREE of the following are characteristics of a 'Defense in Depth' security strategy?

Question 48mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. An internal audit finds that a developer copied a production database snapshot to a personal cloud storage bucket to test a reporting script. The organization must demonstrate to auditors that such data handling is prevented and detectable going forward. Which control should be implemented FIRST to directly address this governance and compliance gap?

Question 49mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team must ensure that only authorized users can access the data and that all access is logged for audit purposes. Which cloud security control should be implemented to meet these requirements?

Question 50mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare company is migrating patient records to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company generates and controls, and that the cloud provider cannot access these keys. Which cloud service model should the company implement?

Question 51hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is migrating its on-premises application to a public cloud. The security team must ensure that the cloud provider's employees cannot access the company's data, even though the provider manages the underlying infrastructure. Which cloud security mechanism should be implemented to achieve this?

Question 52mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization stores electronic protected health information (ePHI) in a public cloud. The security team wants to continuously verify that the cloud provider's controls meet HIPAA requirements without conducting a new audit each quarter. Which action should the team take?

Question 53hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services firm is using a public cloud provider. An auditor requests evidence that the provider's physical data centers have adequate controls for access, environmental monitoring, and power redundancy. Which document should the firm provide to the auditor?

Question 54easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a public cloud model and needs to ensure that its data is stored only in specific geographic regions to comply with local data protection laws. Which cloud governance practice should the company implement?

Question 55hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational retailer must keep customer records in the country where they were collected. The company uses a cloud provider with regions in North America, Europe, and Asia. Which configuration most directly enforces this data residency requirement?

Question 56mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare company is migrating its patient portal to a public cloud. The compliance team requires that the cloud provider's data centers be independently audited against SOC 2 Type II and ISO 27001. Which action should the company take FIRST to meet this requirement?

Question 57mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare startup stores patient records in a public cloud. The security team wants to ensure that data cannot be read if the underlying storage media is physically stolen from the provider's data center. Which control should they verify is enabled?

Question 58hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must ensure that its cloud-based financial application complies with GDPR. The application processes personal data of EU citizens. The company wants to verify that the cloud provider's data processing agreement (DPA) includes the required GDPR clauses. Which document should the company request from the cloud provider to confirm compliance with GDPR data processing requirements?

Question 59hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A company is preparing for a cloud migration and needs to ensure compliance with the General Data Protection Regulation (GDPR). The compliance team has identified several requirements. Which TWO of the following are the company's responsibilities under the shared responsibility model when using a public cloud? (Choose two.)

Question 60mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services firm is adopting a public cloud and must decide how to handle privileged access to the cloud management console. The security policy requires that no single administrator can both modify production workloads and delete audit logs. Which approach best satisfies this requirement?

Question 61mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A healthcare organization is migrating patient records to a public cloud. The security team must ensure that only authorized applications can access the storage buckets containing this data, and that access is logged for audit purposes. Which combination of AWS features should they implement to meet these requirements?

Question 62mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is using a cloud provider's infrastructure as a service (IaaS) offering. The security team must ensure that the operating system and applications on the virtual machines are patched and configured securely. According to the shared responsibility model, which party is responsible for these tasks?

Question 63easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small business wants to ensure that its cloud resources are tagged with cost center and owner information so that monthly invoices can be allocated correctly. Which cloud governance practice should the business implement?

Question 64mediummulti select

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a multi-cloud strategy and needs to implement identity and access management (IAM) consistently across AWS, Azure, and Google Cloud. The security team wants to centralize user authentication and authorization to reduce administrative overhead and enforce uniform security policies. Which two approaches should they use to achieve centralized IAM across multiple clouds? (Choose two.)

Question 65hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is migrating to a public cloud. The compliance team requires that all data stored in the cloud be encrypted with keys that the company controls and can revoke at any time. Which key management approach should they implement?

Question 66hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud governance team is drafting controls to reduce the risk of misconfiguration in a multi-account environment. Which two practices best support continuous compliance monitoring? (Choose two.)

Question 67mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must ensure that customer data stored in its cloud environment remains within the borders of the country where it was collected, in accordance with local data sovereignty laws. Which cloud governance control should the corporation implement?

Question 68hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A financial services company is moving its transaction processing system to a public cloud. The compliance team requires that the cloud provider's security controls are independently validated, and that the company can continuously monitor the compliance status of its cloud resources. Which two actions should the company take to meet these requirements? (Choose two.)

Question 69easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is migrating its on-premises workloads to a public cloud. The IT director is concerned about the security of data at rest and in transit. Which of the following is the cloud provider's responsibility under the shared responsibility model?

Question 70easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company wants to ensure that its cloud resources are tagged correctly for cost allocation and compliance. Which cloud governance practice should they implement to enforce tagging standards?

Question 71easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A startup wants to reduce the risk of losing data stored in a cloud object storage bucket. The team needs a governance control that protects against accidental deletion by an authorized user. Which action should the team take?

Question 72easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A company is deploying a new cloud-native application that must comply with GDPR. The application will process personal data of EU citizens. Which cloud governance practice is most important to implement to ensure data protection and privacy?

Question 73hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

An organization's security team wants to detect and respond to suspicious activities in its cloud environment, such as unusual API calls or unauthorized configuration changes. Which cloud-native capability should the team use to meet this requirement?

Question 74hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A financial services company is using a public cloud to host a web application. The security team wants to ensure that all data stored in the cloud is encrypted at rest using keys that the company controls and can rotate independently. Which cloud service or feature should they implement to meet this requirement?

Question 75mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation must comply with GDPR, which requires that personal data of EU citizens not be transferred outside the EU without adequate safeguards. The company is using a cloud provider with data centers worldwide. Which cloud feature should they use to ensure compliance?

Question 76hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A company is adopting a cloud governance framework to manage risk and compliance. Which TWO of the following are primary objectives of a cloud governance framework? (Choose two.)

Question 77mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A retail company is migrating its e-commerce platform to a public cloud. The security team must decide how to handle encryption keys for data at rest in the cloud provider's object storage. The compliance officer requires that the company retain full control over key lifecycle management, including rotation and revocation, without the cloud provider being able to access the keys. Which approach BEST meets these requirements?

Question 78hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation is deploying a multi-cloud strategy with workloads on two different cloud providers. The security team must ensure that identity and access management (IAM) policies are consistently enforced across both environments, and that a single compromise of one cloud's credentials does not grant access to the other. Which solution BEST addresses these requirements?

Question 79mediummulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud operations team is reviewing its security posture for a newly deployed web application in a public cloud. The team must implement measures to protect the application from common web-based attacks and ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO of the following are the MOST appropriate security controls to implement? (Choose two.)

Question 80easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small business is adopting a public cloud for the first time. The owner wants to ensure that the cloud provider's security responsibilities are clearly understood and that the business knows what it must secure. Which document should the business review to understand the division of security responsibilities between the provider and the customer?

Question 81mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A retail company is moving its customer relationship management (CRM) system to a public cloud provider under a shared responsibility model. The company's legal team needs to understand which compliance-related responsibility remains with the company rather than the cloud provider. Which of the following is the company's responsibility?

Question 82easymultiple choice

Read the full Governance Risk Compliance And Security explanation →

A small marketing firm wants to verify that a cloud provider's security controls are independently validated before signing a contract. The firm's auditor requests evidence that the provider has undergone an independent examination of its controls relevant to security, availability, and confidentiality. Which of the following should the firm request from the provider?

Question 83hardmultiple choice

Read the full Governance Risk Compliance And Security explanation →

A multinational corporation stores personal data of European Union residents in a public cloud. The legal team must ensure the company can lawfully transfer that data to a cloud region outside the EU while meeting GDPR requirements. Which of the following is the most appropriate mechanism to rely on?

Question 84mediummultiple choice

Read the full Governance Risk Compliance And Security explanation →

A software company is evaluating a cloud provider for a new application that will process payment card data. The security team must confirm that the provider's environment supports the company's PCI DSS obligations. Which of the following should the team verify first?

Question 85hardmulti select

Read the full Governance Risk Compliance And Security explanation →

A cloud operations team is implementing a governance strategy to manage risk across multiple business units using different public cloud providers. The governance board wants to establish controls that provide centralized visibility and consistent policy enforcement. Which two of the following should the team implement? (Choose two.)