CCNA Governance Risk Compliance And Security Questions

Cloud governance frameworks define policies and controls to ensure that cloud usage aligns with business objectives and complies with regulations. This is a primary objective, as it mitigates risk and ensures accountability. It encompasses areas such as data protection, access management, and cost control. Without this, organizations face compliance breaches and financial losses.

Data sovereignty requires that data remain within a specific legal jurisdiction. Choosing in-country regions and preventing replication outside them ensures storage and processing occur only where permitted. This control directly addresses the legal requirement and is enforceable through region selection and replication policies in the cloud platform.

The SLA is the contractually binding document in which a provider states its uptime commitment, typically as a percentage with defined remedies. It directly answers the risk assessment's need to quantify outage impact, since the guaranteed availability figure and service credits establish the provider's formal obligation.

The SQL Injection Managed Rule Set provides preconfigured signatures that inspect incoming HTTP requests and block known injection patterns before they reach the application, directly satisfying the requirement to defend a public-facing app against common SQL injection attacks.

Under the shared responsibility model for IaaS, the customer is responsible for securing everything they deploy on the infrastructure, including the guest operating system, applications, and data. Patching and secure configuration of the OS and applications are customer responsibilities, not the provider's.

Elasticity matches the stem's requirement to add and remove resources automatically as traffic demands change. Unlike scalability, which describes capacity growth, elasticity covers both expansion and contraction, provisioning and deprovisioning resources dynamically to sustain performance while controlling cost during fluctuating demand.

A risk register records identified cloud risks alongside their mitigation strategies, owners and residual status, directly evidencing risk management to an auditor. It is the primary artefact demonstrating that mitigation decisions are documented and tracked, unlike policies or audit logs.

A cloud-native DLP policy is the most direct control because it inspects data content and enforces where ePHI may be stored. In this scenario, it would detect the ePHI pattern in the copied snapshot and block the write to the personal bucket, while generating an auditable alert. That directly prevents recurrence and produces evidence auditors can review, satisfying both prevention and detection requirements.

Separation of Duties splits critical tasks across multiple administrators, so no single account holds end-to-end control. This directly satisfies the stem's constraint that no one administrator has full control, enforcing checks and balances through distinct role assignments rather than concentrating privileged permissions in one identity.

Customer-managed keys give the organization full control over key lifecycle, including revocation. Storing them in an HSM provides strong protection against key extraction. This approach satisfies the compliance requirement for customer control and revocability. It is the standard method for meeting strict data sovereignty and encryption mandates.

Client-side encryption with customer-managed keys ensures that data is encrypted before it is sent to the cloud, and the keys are generated and controlled by the company. The cloud provider only stores encrypted data and never has access to the keys, satisfying the strict compliance requirement.

Compliance Mode enforces a write-once-read-many (WORM) retention policy that no user, including the root account, can override or shorten until the seven-year period expires. This satisfies the read-only immutability constraint, unlike Governance Mode, which privileged users can bypass.

The shared responsibility model defines which security tasks are handled by the cloud provider and which are the customer's responsibility. It varies by service model (IaaS, PaaS, SaaS). Reviewing this model helps the business understand what it must secure, such as data, access management, and applications, and what the provider secures, such as physical infrastructure.

AWS CloudTrail records every API call in the account, capturing the IAM user identity, timestamp, source IP and request parameters for each action. This event history directly satisfies the scenario's requirement to attribute unauthorised infrastructure changes to a specific IAM user, which CloudWatch metrics or configuration snapshots cannot provide.

Periodic penetration tests actively uncover exploitable vulnerabilities in cloud workloads, satisfying the stem's demand for risk mitigation rather than mere detection. Testing validates that security controls, patched configurations and identity boundaries around Microsoft Entra ID actually resist real attack techniques, closing gaps that static assessments miss.

S3 Block Public Access applies account-level and bucket-level controls that override any bucket policy or ACL granting public access, directly satisfying the requirement to prevent future public exposure. Unlike bucket policies alone, which can be misconfigured, these settings enforce a hard deny on public access regardless of individual object permissions.

Automating security configuration audits continuously enforces baselines across cloud resources, satisfying the stem's requirement for proactive, scalable security. Unlike manual reviews, scheduled tooling detects drift and misconfiguration immediately, aligning with Microsoft Entra ID and broader cloud governance guidance. This makes it a recognised best practice.

Multiple layers of security controls is the defining characteristic of defence in depth: an attacker must defeat several independent controls rather than a single point of failure. Each layer assumes the preceding one may be breached.

Advanced Data Security bundles vulnerability assessment and Advanced Threat Protection, scanning Azure SQL Database for misconfigurations and anomalous access patterns. This satisfies the GDPR requirement to identify potential vulnerabilities and anomalies affecting stored personal data.

Cloud audit logging records API calls and configuration changes across the environment. By configuring alerts on anomalous patterns, the security team gains the detection and response capability required. This is the native mechanism for monitoring control plane activity and is essential for security operations in the cloud.

Region-specific storage ensures data remains within a chosen geographic boundary. Geo-fencing policies can enforce that data is not replicated or moved outside that region. This directly addresses GDPR's data residency requirements. It is the correct approach for compliance with data sovereignty laws.

A Site-to-Site VPN creates an IPsec-encrypted tunnel between the on-premises gateway and the cloud virtual network, encrypting data in transit across the public internet. This directly satisfies the hybrid requirement that traffic between the data centre and provider stays encrypted.

A SOC 2 report or ISO 27001 certification report is an independent auditor's attestation that the provider's controls meet recognised standards. This third-party evidence satisfies the audit requirement, unlike a self-issued statement or marketing whitepaper, which carry no independent assurance.

IAM policies define granular permissions for who can access S3 buckets and what actions they can perform, while CloudTrail logs all API activity, including access to S3 objects. Together, they enforce least privilege and provide an audit trail, directly satisfying the requirement for authorized access and logging.

Federated identity with SAML or OIDC allows a central identity provider to authenticate users and issue tokens that each cloud provider trusts. This centralizes authentication and enables consistent authorization policies. If one cloud's credentials are compromised, the attacker does not automatically gain access to the other cloud because access is governed by the central IdP and separate trust relationships, reducing lateral movement risk.

A data classification scheme is essential because it defines sensitivity tiers that determine handling, storage and protection requirements. Without it, cloud controls cannot be mapped to data sensitivity, so the policy would lack the basis for proportionate safeguarding.

In IaaS the provider secures the physical hosts, hypervisor and network fabric, while the customer owns everything from the guest operating system upward. Patching the guest OS, including its kernel and installed components, therefore remains the customer's responsibility under the Shared Responsibility Model.

Federating cloud IAM with a central IdP allows users to authenticate once and access multiple clouds with the same credentials. It centralizes user management and enables uniform policy enforcement through the IdP. This is a standard approach for multi-cloud IAM. It reduces administrative overhead and improves security.

CSPM tools continuously monitor cloud environments for misconfigurations and compliance violations against standards like CIS, PCI DSS, or HIPAA. This provides the ongoing compliance monitoring required, ensuring that resources remain compliant and alerting on drift, which is critical for a financial services company.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of controls over a period, which can be mapped to HIPAA Security Rule safeguards. It gives continuous assurance without the organization performing its own audit each quarter, and it is the standard evidence cloud providers supply to customers for compliance verification.

Regional resource placement confines the database to a specific AWS Region, whose facilities reside within defined national borders. This satisfies data sovereignty by ensuring storage and processing never replicate outside the required country, unlike global or multi-region architectures.

The customer is always responsible for its own data, user identities, access permissions, and application-level configuration, regardless of the service model. For a CRM system, this means the retail company must enforce least privilege, manage user accounts, and configure the application to satisfy applicable regulations. The provider secures the underlying infrastructure, but not the customer's use of it.

RASP integrates with the application runtime and can detect and block attacks by analyzing behavior and input in real time. It complements perimeter defenses like WAFs and can protect against zero-day attacks. PCI DSS does not mandate RASP, but it is an effective control for protecting web applications and meeting the intent of requirement 6.6.

A network ACL is a stateless, subnet-level filter that evaluates inbound and outbound rules before traffic reaches any instance, making it the outermost boundary for a private subnet. Security groups operate at the instance level, so they cannot act as the subnet's first line of defence.

Security Hub cross-account aggregation consolidates findings from member accounts into a single administrator account, giving one central view of security logs. This satisfies the stem's requirement to aggregate security logs from multiple cloud accounts into one security account.

A SOC 2 Type II report provides an independent auditor's opinion on the effectiveness of a service organization's controls over a period of time, including security, availability, and confidentiality. It covers physical security controls such as data center access, environmental monitoring, and power redundancy, making it the appropriate evidence for the auditor.

Cloud providers publish independent audit reports such as SOC 2 Type II and ISO 27001 certifications in a trust center or compliance portal. Requesting these documents is the direct way to verify that the provider's data centers have been audited against the required standards. This satisfies the compliance team's requirement without duplicating audit effort or relying on unverified claims.

A CCoE consolidates cloud governance and security policy ownership into one function, so guardrails, identity controls and compliance checks are defined once and applied consistently. This directly satisfies the stem's requirement for a valid CCoE purpose by removing fragmented, team-by-team security decisions.

AWS Config continuously records resource configuration changes and evaluates them against rules, so it detects untagged resources and can trigger remediation through SSM Automation. This directly satisfies the governance requirement to automate detection and remediation of resources missing the 'Owner' and 'Environment' tags.

Under the shared responsibility model, the cloud customer owns their data and its regulatory obligations, so they must notify authorities after a breach. This satisfies the stem's question of who bears breach-notification responsibility in the cloud.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of a service organization's controls over a period of time, covering trust services criteria such as security, availability, and confidentiality. This directly satisfies the marketing firm's need for validated evidence. The report is the standard artifact customers request to assess a provider's control environment.

A governance framework codifies policies, controls and accountability, so risk identification, assessment and mitigation follow repeatable, auditable processes across every cloud service and team. That standardisation directly satisfies the stem's requirement for consistent risk management, eliminating ad-hoc, per-project decisions that leave gaps and duplicate effort.

AWS Cost Explorer gives the most direct view of current resource costs and budget alerts, satisfying the budget governance constraint. It visualises spend by service and time period, and surfaces AWS Budgets alerts when thresholds are breached, unlike broader monitoring dashboards that track performance metrics rather than cost.

TLS 1.2/1.3 encrypts data in transit using authenticated ciphersuites, protecting traffic between clients and cloud services from interception or tampering. It directly satisfies the in-transit constraint, unlike at-rest encryption or access controls, which secure stored data or identities rather than the wire.

A CASB sits between users and cloud services to enforce security policies such as data loss prevention, access control, and activity monitoring across multiple providers. For a governance board needing centralized visibility and consistent enforcement, a CASB provides a unified control point. It directly addresses the requirement to manage risk consistently across different cloud environments.

RBAC restricts data access to users based on their role, ensuring only authorized personnel can view ePHI. Enabling audit logging captures all access events, satisfying the requirement to log access for audits. Together, these controls address both the authorization and logging aspects of the scenario.

Establishing security and compliance standards is a governance function: the committee defines the policies, controls and regulatory baselines that cloud teams must follow. It satisfies the question's requirement for committee responsibilities, distinct from day-to-day operational tasks performed by engineering teams.

Encryption at rest ensures that data stored on physical media is unreadable without the decryption key. If the storage media is stolen, the ciphertext is useless without the key. Provider-managed keys are acceptable here because the threat is physical theft, not provider insider access. This control directly addresses the scenario's requirement.

Versioning preserves prior object versions, and object lock with a retention period prevents those versions from being deleted or overwritten for a set time, even by authorized users. This directly addresses accidental deletion by providing recoverability and an immutability guarantee, which is a recognized governance control for protecting stored data.

AWS Security Hub runs automated security checks against standards such as CIS AWS Foundations Benchmark, surfacing each failed control as a finding. This directly satisfies the compliance officer's need to report every non-compliant instance, since findings are aggregated per resource and filterable by compliance status.

Azure Policy evaluates resources against defined rules and enforces configuration automatically, denying or remediating non-compliant VMs. It directly satisfies the requirement to enforce corporate security standards such as approved OS versions across all virtual machines without manual review.

Automated configuration checks continuously evaluate deployed resources against a security benchmark and alert when drift occurs. This detects misconfigurations that appear after deployment, such as a storage bucket made public or a security group opened to the internet. Together with preventive controls, it closes the loop between prevention and detection for continuous compliance.

Data classification and tagging involves identifying and labeling data based on its sensitivity and regulatory requirements, such as GDPR. This enables proper handling, access controls, and encryption. It is foundational for compliance because it ensures that personal data is identified and protected according to its classification, directly supporting GDPR principles.

SAML is the XML-based federation standard in which an identity provider issues signed assertions that a service provider trusts, enabling employees to authenticate to cloud applications with corporate credentials without separate accounts, satisfying the IdP requirement.

A policy engine can enforce tagging by preventing the creation of resources that do not have required tags. This actively ensures compliance with tagging standards. It is a proactive governance control that aligns with compliance and cost management objectives. This is the most effective way to enforce tagging.

Customer-managed keys allow the customer to create, manage, and rotate encryption keys independently. The cloud KMS provides secure key storage and audit logs. This meets the requirement for customer control and independent rotation. It is the correct solution for encrypting data at rest with customer-managed keys.

Agility in cloud adoption means provisioning resources on demand and releasing changes rapidly, so faster time-to-market for new features directly reflects that business driver. Cost, scalability and resilience are separate drivers, not the agility axis.

Declarative templates eliminate configuration drift by provisioning identical environments on every run, so compliance controls are applied uniformly rather than depending on manual steps. This directly satisfies the stem's requirement for repeatable, auditable infrastructure, giving assessors reproducible evidence that each deployment meets the same baseline.

A GDPR DPA is a legally binding document that outlines how the cloud provider processes personal data on behalf of the customer. It includes standard contractual clauses (SCCs) and other GDPR-mandated terms. This directly confirms the provider's commitment to GDPR data processing requirements. It is the specific document needed to verify compliance.

AWS KMS stores and manages customer-managed keys, integrates with CloudTrail to log every key use for compliance auditing, and encrypts data at rest across AWS services. This satisfies both the customer-managed key and audit log requirements.

A post-incident review captures root cause, response gaps and lessons learned after containment and recovery, feeding improvements back into the incident response plan. It satisfies the stem as the closing phase that distinguishes a complete cloud incident response process from mere firefighting.

A tagging policy ensures that resources carry the metadata needed for cost allocation, ownership, and reporting. By enforcing required tags at creation, the business prevents untagged resources that would break invoice allocation. This is a foundational governance control that supports financial accountability and is directly aligned with the goal of accurate cost center attribution.

This directly impacts the integrity of the data.

Data sovereignty violations arise when data is stored or processed in a jurisdiction whose laws conflict with the residency or regulatory obligations the organisation must satisfy. Because cloud providers replicate and host data across regions, workloads can breach local data-protection requirements without deliberate misconfiguration.

Separating permissions into distinct roles so that workload administrators cannot delete audit logs and log administrators cannot modify workloads enforces separation of duties technically. Combined with least privilege, this ensures no single identity holds both capabilities, directly meeting the security policy for privileged console access.

Multi-AZ deployment synchronously replicates data and resources across physically separate zones, so a single zone failure does not cause data loss or downtime. This directly mitigates the availability and durability risk inherent in single-zone storage.

The cloud provider is responsible for security of the cloud, which includes physical security of data centers, hardware, and the underlying network. This is a fundamental aspect of the shared responsibility model. The customer is not responsible for physical security. This option correctly identifies the provider's responsibility.

Data residency policies define where data can be stored and processed. By restricting resource deployment to approved regions, the company ensures compliance with local laws that mandate data stays within certain geographic boundaries. This is a direct governance control for data sovereignty.

Client-side encryption encrypts data within the organisation's own environment before transmission, so plaintext never leaves the premises and cloud providers receive only ciphertext. Server-side methods encrypt after arrival, failing the requirement that data be encrypted prior to being sent to the cloud.

Placing the primary database and its backups in the same in-country region and turning off cross-region replication ensures that records are written and retained only within that jurisdiction. This directly satisfies data residency because storage, backup copies, and recovery points all remain in the required country, which is the most enforceable configuration.

In SaaS, the provider secures the application, runtime and infrastructure, but the customer's users, credentials and permissions remain their own responsibility. Identity and access management therefore stays with the company, satisfying the stem's question about which security responsibility persists under the shared responsibility model.

Customer-managed keys give the company exclusive control over key generation, rotation, and revocation. When stored in an HSM or customer-controlled KMS, the provider cannot access the plaintext keys, satisfying the requirement that the provider be unable to decrypt data. This approach aligns with compliance mandates for data sovereignty and key custody.

The PCI Security Standards Council maintains a list of validated service providers, and checking it confirms the provider has undergone the required assessment for the services the company intends to use. This verification is a foundational due diligence step before architecting a cardholder data environment. It gives the software company documented assurance that the provider meets PCI DSS requirements for its portion of the shared responsibility.

An IAM role issues temporary, automatically expiring credentials via STS assume-role, so the third party never receives long-term access keys. This satisfies the requirement to delegate access without sharing persistent credentials, unlike IAM users with static keys.

Data classification is the customer's responsibility because only the customer knows the nature and sensitivity of its data. The cloud provider cannot determine which data is subject to GDPR; the customer must classify data to apply appropriate controls and ensure compliance with regulations like GDPR.