Exam Bundle

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Trident Finance: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Trident Finance: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Trident Finance: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Seabright Municipal Works: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Seabright Municipal Works: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Seabright Municipal Works: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. The relevant corrective control for this case is: Enforce customer-owned access controls, encryption choices, and bucket exposure policies.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: An unauthorized principal cannot read the data even though the underlying storage service is managed.

Use an appropriate cloud security posture management and findings process. That action fits another problem: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. It does not directly remediate the current finding at Prairie Health Network: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

Standardize identity and workload policy-as-code with approval and drift detection. That action fits another problem: Cloud access policies are written independently by each product team and contradict enterprise identity requirements. It does not directly remediate the current finding at Prairie Health Network: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

Choose deployment locations and retention controls based on data residency and compliance policy. That action fits another problem: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region. It does not directly remediate the current finding at Prairie Health Network: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

The same access test produces consistent authorized results across accounts. This would be relevant evidence for a different failure: Cloud access policies are written independently by each product team and contradict enterprise identity requirements, usually addressed by Standardize identity and workload policy-as-code with approval and drift detection. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

A log location audit confirms regulated events remain in authorized processing regions. This would be relevant evidence for a different failure: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region, usually addressed by Choose deployment locations and retention controls based on data residency and compliance policy. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

A newly introduced insecure resource is detected within the agreed monitoring interval. This would be relevant evidence for a different failure: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist, usually addressed by Use an appropriate cloud security posture management and findings process. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

Use an appropriate cloud security posture management and findings process. That action fits another problem: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. It does not directly remediate the current finding at Boreal Foods: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. That action fits another problem: A cloud team has no inventory of publicly exposed services before selecting a defense tool. It does not directly remediate the current finding at Boreal Foods: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

Map risks to capabilities using an established cloud security framework before product selection. That action fits another problem: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. It does not directly remediate the current finding at Boreal Foods: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. The relevant corrective control for this case is: Define centralized baseline policies and continuously assess deviations across supported cloud accounts.

A documented control matrix justifies coverage of identity, network, logging, workload, and data risks. This would be relevant evidence for a different failure: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives, usually addressed by Map risks to capabilities using an established cloud security framework before product selection. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

A newly introduced insecure resource is detected within the agreed monitoring interval. This would be relevant evidence for a different failure: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist, usually addressed by Use an appropriate cloud security posture management and findings process. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

The inventory lists Internet-reachable assets with assigned remediation owners and deadlines. This would be relevant evidence for a different failure: A cloud team has no inventory of publicly exposed services before selecting a defense tool, usually addressed by Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A deliberate overbroad rule is detected and remediated without overriding approved exceptions.

Standardize identity and workload policy-as-code with approval and drift detection. That action fits another problem: Cloud access policies are written independently by each product team and contradict enterprise identity requirements. It does not directly remediate the current finding at Willowbrook Education: A cloud team has no inventory of publicly exposed services before selecting a defense tool. The relevant corrective control for this case is: Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities.

Map risks to capabilities using an established cloud security framework before product selection. That action fits another problem: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. It does not directly remediate the current finding at Willowbrook Education: A cloud team has no inventory of publicly exposed services before selecting a defense tool. The relevant corrective control for this case is: Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities.

Use an appropriate cloud security posture management and findings process. That action fits another problem: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. It does not directly remediate the current finding at Willowbrook Education: A cloud team has no inventory of publicly exposed services before selecting a defense tool. The relevant corrective control for this case is: Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities.

The same access test produces consistent authorized results across accounts. This would be relevant evidence for a different failure: Cloud access policies are written independently by each product team and contradict enterprise identity requirements, usually addressed by Standardize identity and workload policy-as-code with approval and drift detection. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The inventory lists Internet-reachable assets with assigned remediation owners and deadlines.

A newly introduced insecure resource is detected within the agreed monitoring interval. This would be relevant evidence for a different failure: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist, usually addressed by Use an appropriate cloud security posture management and findings process. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The inventory lists Internet-reachable assets with assigned remediation owners and deadlines.

A documented control matrix justifies coverage of identity, network, logging, workload, and data risks. This would be relevant evidence for a different failure: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives, usually addressed by Map risks to capabilities using an established cloud security framework before product selection. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: The inventory lists Internet-reachable assets with assigned remediation owners and deadlines.