Cloud Governance 17-18

What does the process of managing risks to organizational operations, assets, or individuals resulting from the operation of an information system include?

• Conducting a financial audit
• Implementing a risk mitigation strategy
• Developing marketing strategies
• Creating employee training programs

Which of the following is the primary goal of the process designed to produce a comprehensive population of risks for achieving cloud objectives?

• To reduce the cost of cloud services
• To improve cloud service performance metrics
• To identify and categorize risks such as strategy, compliance, and security risks
• To enhance user experience with cloud applications

The process of identifying risks in achieving cloud objectives involves organizing and reporting risks by categories such as strategy, compliance, and security risks.

• True
• False

What is the main purpose of the process designed to assess and prioritize each risk identified in an organization?

• To estimate the cost of new technologies
• To develop employee engagement programs
• To streamline organizational communication channels
• To determine the likelihood and potential impact of risks, and prioritize them based on these factors

What is the primary focus of the process where management plans responses to identified and assessed risks?

• Evaluating the financial impact of new projects
• Determining how to respond if the risk occurs, including options such as avoiding, ignoring, reducing, or transferring the risk
• Enhancing employee productivity
• Developing new marketing strategies

Which of the following statements are true about identifying specific cloud risks in the risk management process? (Select all that apply)

• A variety of techniques are available to assist with the risk identification process.
• Defining cloud objectives is unrelated to identifying specific cloud risks.
• The European Network and Information Security Agency (ENISA) provides techniques for identifying potential risks.
• The risk identification process can be complex and iterative.

According to the International Organization for Standardization (ISO), how is risk defined in the context of cloud computing?

• The potential for financial loss due to cloud service downtime
• The inability to scale cloud resources quickly
• The probability of a security breach occurring in the cloud
• The effect of uncertainty on achieving strategic objectives such as cost savings, innovation, efficiency, and improved decision-making

NIST recommends that after identifying risks in the cloud, management should solely use qualitative techniques, such as assigning risks as high, medium, or low, to assess the impact and likelihood of each risk event.

• True
• False

After identifying risks, the organization prioritizes them based on their severity and potential impact, aiming to allocate resources equally to all identified risks.

• True
• False

What is the primary purpose of risk mitigation activities in the risk management process?

• To increase the complexity of organizational procedures
• To eliminate all identified risks completely
• To prioritize, evaluate, and implement appropriate risk-reducing controls/countermeasures
• To shift all risks to external parties