Which of the following statements best reflects the responsibility of organizations regarding cloud security and data ownership?

• A. Cloud providers are responsible for everything under the 'limited O responsibilities clauses.' The customer and the provider have joint accountability.
• B. Organizations are accountable for the security and compliance of their data and systems, even though they may lack full visibility into their cloud provider's infrastructure.
• C. Data ownership rights are solely determined by the cloud provider, leaving organizations with no control or accountability over their data.
• D. Cloud providers assume full responsibility for the security obligations, and cloud customers are accountable for overall compliance.

How does Infrastructure as Code (IaC) facilitate rapid recovery in cybersecurity?

• A. IaC provides encryption and secure key management during recovery
• B. IaC is primarily used for designing network security policies
• C. IaC automates incident detection and alerting mechanisms
• D. IaC enables automated and consistent deployment of recovery environments

What type of logs record interactions with specific services in a system?

• A. Service and Application Logs
• B. Network Logs
• C. Debug Logs
• D. Security Logs

Which practice minimizes human error in long-running cloud workloads' security management?

• A. Restricting access to workload configurations
• B. Converting all workloads to ephemeral
• C. Increasing manual security audits frequency
• D. Implementing automated security and compliance checks

CCM: A hypothetical start-up company called "ABC" provides a cloud based IT management solution. They are growing rapidly and therefore need to put controls in place in order to manage any changes in their production environment. Which of the following Change Control & Configuration Management production environment specific control should they implement in this scenario?

• A. All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.
• B. Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally- owned ormanaged user end-point devices (e.g. issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.
• C. None of the above
• D. Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations, infrastructure network and systems components.