Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Risk & Compliance · Question Set
Cloud Risk interview questions for placements and exams.
Questions
14
Included in this set
Subject
Risk & Compliance
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Risk & Compliance .
Misconfigured cloud storage is one of the most frequent causes of breaches. When public access is mistakenly enabled or permissions are too broad, sensitive data becomes accessible to anyone. Regular configuration checks and automated policy enforcement help prevent such exposures.
For complete preparation, combine this set with full subject-wise practice for Risk & Compliance . You can also explore other subjects and sets from the links below.
SOC 2 Type II reports evaluate how effectively a service provider’s security, availability, confidentiality, and privacy controls operate over time. It gives customers assurance that the provider maintains strong and consistent controls for sensitive data.
Due diligence evaluates a vendor’s technical and operational controls before establishing a partnership. It ensures that the third party follows sound security practices, meets regulatory expectations, and will not introduce unmanaged risk to the organization’s ecosystem.
Data residency ensures that information is stored and handled according to the privacy laws of the country where it originates. Some regions restrict cross-border data transfers or require local storage. Understanding these rules prevents regulatory violations and protects user trust.
Providers undergo external audits to validate compliance with standards such as ISO 27001 or SOC 2. These reports are shared with customers as assurance that key controls are tested and verified by accredited auditors.
After onboarding, organizations should track vendor performance, review compliance certificates, and conduct periodic audits. Continuous monitoring includes checking security questionnaires, incident reports, and service changes. If issues arise, corrective actions or contract updates are required to maintain compliance.
Cloud governance defines policies, roles, and controls for managing cloud usage securely and efficiently. It ensures compliance with internal and regulatory requirements, prevents cost and security sprawl, and maintains visibility over cloud operations. Strong governance reduces misconfigurations and enforces accountability across teams.
Contracts should specify data protection requirements, breach notification obligations, audit rights, and incident response cooperation. They should also define liability limits, termination clauses, and compliance with laws like GDPR or DPDP. Clear contractual terms ensure both sides understand and uphold security responsibilities.
Misconfigurations can be avoided by enforcing least-privilege access, using automated compliance checks, and applying Infrastructure as Code templates. Regular audits and monitoring for public exposure reduce the chance of human error. Security baselines and alerts ensure consistent configuration across environments.
An exit strategy ensures that data, systems, and operations can be safely transferred or terminated if a vendor relationship ends. It covers secure data return, deletion procedures, and transition support. Planning ahead prevents vendor lock-in and protects sensitive information when contracts close.
Organizations use native tools like AWS Config, Azure Policy, or Google Security Command Center to track compliance. These tools continuously compare configurations against standards such as CIS benchmarks or ISO 27001. They provide alerts and automated remediation to maintain compliance posture.
The Shared Responsibility Model defines who secures which parts of the cloud environment. The cloud provider handles the physical and core infrastructure, while the customer is responsible for securing their data, configurations, access, and workloads. This model helps clarify accountability and avoid coverage gaps.
Third-party vendors often handle sensitive information or perform critical functions. However, organizations may not have full insight into their security posture. Without continuous oversight and clear contractual obligations, these external relationships can become major risk points.
A strong SLA should include security requirements like encryption standards, access control expectations, and incident response timelines. It sets measurable obligations for the provider and creates accountability for compliance and service continuity.