Select Two (Multi-Select) Questions

Appoint a Data Protection Officer (DPO) for all organizations

Why wrong: DPO appointment is mandatory only for certain entities.

Store data only within the European Union

Why wrong: Data can be transferred outside EU with appropriate safeguards.

Use only ISO 27001 certified cloud service providers

Why wrong: GDPR does not require specific certification.

Ignorance

Why wrong: Ignorance is not a valid risk treatment strategy.

Deletion

Why wrong: Deletion is not a risk treatment option.

Acceptance

Why wrong: Acceptance is a treatment but not selected as correct for this question.

Strategy to avoid vendor lock-in with the CSP.

Why wrong: Vendor lock-in is a procurement concern, not a BCP requirement.

A detailed risk assessment for all cloud services.

Why wrong: Risk assessment is part of risk management, not BCP.

Network topology diagrams of the cloud environment.

Why wrong: While helpful, diagrams are not a required element of a BCP.

Enable detailed logging and monitoring of all data access events

Why wrong: Incorrect: Logging is detective, not preventive.

Encrypt all data at rest using provider-managed keys

Why wrong: Incorrect: Encryption does not prevent authorized users from exfiltration.

Use a cloud access security broker (CASB) to enforce data classification

Why wrong: Incorrect: CASB provides visibility but not direct prevention of exfiltration.

Conducting annual penetration tests on the provider's infrastructure

Why wrong: Testing provider infrastructure is the provider's responsibility.

Ensuring the cloud provider's physical security controls are adequate

Why wrong: Physical security is the provider's responsibility under the shared model.

Verifying the provider's compliance certifications are current

Why wrong: While advisable, it is a secondary due diligence activity, not a primary responsibility.

Performing continuous deployment

Why wrong: Continuous deployment is a DevOps practice, not a security objective.

Implementing a microservices architecture

Why wrong: Microservices is an architectural pattern, not a security objective.

Adopting Agile development practices

Why wrong: Agile is a development methodology, not a security objective.

Implement role-based access control (RBAC) to restrict who can push images to the registry.

Why wrong: RBAC controls who can push images but does not verify the content of the images or enforce deployment policies.

Use network policies to restrict pod-to-pod communication.

Why wrong: Network policies control traffic flow between pods, not which images are allowed to be deployed.

Scan all container images for vulnerabilities in the CI pipeline.

Why wrong: Vulnerability scanning is important but does not enforce that only approved images are deployed; it only identifies known vulnerabilities.

Change management procedures

Why wrong: Change management is not directly impacted by access termination.

Encryption of data at rest

Why wrong: Encryption is not directly related to access termination.

Physical access controls

Why wrong: Physical access controls are separate from logical access.

Use an active-passive configuration with both instances in the same availability zone.

Why wrong: Both instances in one zone share the same failure domain.

Configure the application to run in only one region to simplify management.

Why wrong: A single region is vulnerable to regional outages.

Use a single, large virtual machine instance to handle all traffic.

Why wrong: A single instance is a single point of failure.

Physical security of data centers.

Why wrong: Physical security is the responsibility of the CSP.

Patching the hypervisor.

Why wrong: The hypervisor is managed by the CSP.

Encryption key management procedures.

Why wrong: Key management is important but not a core component of incident response testing.

Backup and restore procedures.

Why wrong: Backups are part of disaster recovery, not specifically incident response testing.

Service level agreements (SLAs) with cloud provider.

Why wrong: SLAs are contractual, not tested as part of incident response.

Disabling encryption to reduce latency.

Why wrong: Disabling encryption reduces security.

Setting the storage bucket to public read access.

Why wrong: Public access increases risk.

Enabling access logging for the storage bucket.

Why wrong: Logging is for auditing, not encryption.

Location independence

Why wrong: While cloud offers location independence, it is not one of the five NIST essential characteristics; 'resource pooling' is the characteristic.

Dedicated hardware per tenant

Why wrong: Cloud computing uses shared resources, not dedicated hardware per tenant.

The key ID changes after each rotation.

Why wrong: Incorrect: The key ID typically remains the same; only the key material is rotated.

The old key is immediately destroyed after rotation.

Why wrong: Incorrect: The old key is retained to decrypt previously encrypted data.

All data encrypted with the old key must be re-encrypted.

Why wrong: Incorrect: Re-encryption is not required; the system uses the appropriate key version.

Manual penetration testing after every code commit.

Why wrong: Manual testing is not practical for every commit; automated testing is essential.

Security awareness training for all developers.

Why wrong: While important, training is not a technical component of the SSDLC process itself.

Data masking

Why wrong: Masking is a technique to protect sensitive data, not a governance component.

Data encryption at rest

Why wrong: Encryption is a security control, not a governance component.

Use SSL inspection to check for malicious payloads

Why wrong: SSL inspection does not prevent SSRF.

Block all outbound network traffic from the application

Why wrong: Blocking all outbound may break functionality.

Sanitize all user input for URL parameters

Why wrong: Input validation can be bypassed; defense in depth needed.

Reversible without a key vault

Why wrong: Tokenization requires a vault to reverse.

Eliminates the need for encryption

Why wrong: Tokenization and encryption serve different purposes.

Slows down database queries

Why wrong: Tokenization may add overhead but is not a benefit.

Encrypt all discovered data

Why wrong: Encryption is a subsequent action, not part of discovery.

Create backup copies of data

Why wrong: Backups are not part of discovery.

Business continuity plan.

Why wrong: BCP is part of business continuity management, not ISMS.

Annual penetration testing.

Why wrong: Penetration testing may be a control but is not a required component of ISMS.

Encryption of all data at rest.

Why wrong: Encryption is a security control, not a component of ISMS.