Exam Bundle

The inventory lists Internet-reachable assets with assigned remediation owners and deadlines. This would be relevant evidence for a different failure: A cloud team has no inventory of publicly exposed services before selecting a defense tool, usually addressed by Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same access test produces consistent authorized results across accounts.

A log location audit confirms regulated events remain in authorized processing regions. This would be relevant evidence for a different failure: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region, usually addressed by Choose deployment locations and retention controls based on data residency and compliance policy. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same access test produces consistent authorized results across accounts.

A newly introduced insecure resource is detected within the agreed monitoring interval. This would be relevant evidence for a different failure: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist, usually addressed by Use an appropriate cloud security posture management and findings process. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: The same access test produces consistent authorized results across accounts.

Choose deployment locations and retention controls based on data residency and compliance policy. That action fits another problem: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region. It does not directly remediate the current finding at Evermere Health: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

Define centralized baseline policies and continuously assess deviations across supported cloud accounts. That action fits another problem: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. It does not directly remediate the current finding at Evermere Health: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. That action fits another problem: A cloud team has no inventory of publicly exposed services before selecting a defense tool. It does not directly remediate the current finding at Evermere Health: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

A log location audit confirms regulated events remain in authorized processing regions. This would be relevant evidence for a different failure: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region, usually addressed by Choose deployment locations and retention controls based on data residency and compliance policy. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

A deliberate overbroad rule is detected and remediated without overriding approved exceptions. This would be relevant evidence for a different failure: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists, usually addressed by Define centralized baseline policies and continuously assess deviations across supported cloud accounts. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

The inventory lists Internet-reachable assets with assigned remediation owners and deadlines. This would be relevant evidence for a different failure: A cloud team has no inventory of publicly exposed services before selecting a defense tool, usually addressed by Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

Standardize identity and workload policy-as-code with approval and drift detection. That action fits another problem: Cloud access policies are written independently by each product team and contradict enterprise identity requirements. It does not directly remediate the current finding at Brightstone Legal: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

Choose deployment locations and retention controls based on data residency and compliance policy. That action fits another problem: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region. It does not directly remediate the current finding at Brightstone Legal: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

Map risks to capabilities using an established cloud security framework before product selection. That action fits another problem: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. It does not directly remediate the current finding at Brightstone Legal: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. The relevant corrective control for this case is: Use an appropriate cloud security posture management and findings process.

The same access test produces consistent authorized results across accounts. This would be relevant evidence for a different failure: Cloud access policies are written independently by each product team and contradict enterprise identity requirements, usually addressed by Standardize identity and workload policy-as-code with approval and drift detection. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

A log location audit confirms regulated events remain in authorized processing regions. This would be relevant evidence for a different failure: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region, usually addressed by Choose deployment locations and retention controls based on data residency and compliance policy. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

A documented control matrix justifies coverage of identity, network, logging, workload, and data risks. This would be relevant evidence for a different failure: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives, usually addressed by Map risks to capabilities using an established cloud security framework before product selection. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: A newly introduced insecure resource is detected within the agreed monitoring interval.

Choose deployment locations and retention controls based on data residency and compliance policy. That action fits another problem: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region. It does not directly remediate the current finding at Vantage Travel: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. That action fits another problem: A cloud team has no inventory of publicly exposed services before selecting a defense tool. It does not directly remediate the current finding at Vantage Travel: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

Standardize identity and workload policy-as-code with approval and drift detection. That action fits another problem: Cloud access policies are written independently by each product team and contradict enterprise identity requirements. It does not directly remediate the current finding at Vantage Travel: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

A log location audit confirms regulated events remain in authorized processing regions. This would be relevant evidence for a different failure: An organization operates in three countries but configures all sensitive cloud logs in one prohibited region, usually addressed by Choose deployment locations and retention controls based on data residency and compliance policy. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

The same access test produces consistent authorized results across accounts. This would be relevant evidence for a different failure: Cloud access policies are written independently by each product team and contradict enterprise identity requirements, usually addressed by Standardize identity and workload policy-as-code with approval and drift detection. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

The inventory lists Internet-reachable assets with assigned remediation owners and deadlines. This would be relevant evidence for a different failure: A cloud team has no inventory of publicly exposed services before selecting a defense tool, usually addressed by Perform cloud asset discovery and exposure assessment to prioritize the necessary security capabilities. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

Standardize identity and workload policy-as-code with approval and drift detection. That action fits another problem: Cloud access policies are written independently by each product team and contradict enterprise identity requirements. It does not directly remediate the current finding at Evergreen Hospital: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

Define centralized baseline policies and continuously assess deviations across supported cloud accounts. That action fits another problem: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists. It does not directly remediate the current finding at Evergreen Hospital: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

Use an appropriate cloud security posture management and findings process. That action fits another problem: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist. It does not directly remediate the current finding at Evergreen Hospital: A cloud design team selects a product solely from its dashboard without validating the architecture and control objectives. The relevant corrective control for this case is: Map risks to capabilities using an established cloud security framework before product selection.

The same access test produces consistent authorized results across accounts. This would be relevant evidence for a different failure: Cloud access policies are written independently by each product team and contradict enterprise identity requirements, usually addressed by Standardize identity and workload policy-as-code with approval and drift detection. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

A newly introduced insecure resource is detected within the agreed monitoring interval. This would be relevant evidence for a different failure: A public cloud deployment misses basic continuous configuration scanning and relies on one annual manual checklist, usually addressed by Use an appropriate cloud security posture management and findings process. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

A deliberate overbroad rule is detected and remediated without overriding approved exceptions. This would be relevant evidence for a different failure: Two cloud subscriptions use different permissive firewall policies because no common security baseline exists, usually addressed by Define centralized baseline policies and continuously assess deviations across supported cloud accounts. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: A documented control matrix justifies coverage of identity, network, logging, workload, and data risks.

Design a hybrid cloud model with controlled private connectivity and segmentation. That action fits another problem: A manufacturer must connect on-premises production systems with public-cloud analytics without exposing the plant network. It does not directly remediate the current finding at Aspen Digital: An enterprise needs to discover unsanctioned SaaS use and apply policy to sanctioned and unsanctioned services. The relevant corrective control for this case is: Select a cloud access security broker capability suited to visibility and policy enforcement.

Evaluate a private cloud deployment against isolation, governance, and operational requirements. That action fits another problem: An agency must keep restricted workloads on a dedicated internal environment with organizational control. It does not directly remediate the current finding at Aspen Digital: An enterprise needs to discover unsanctioned SaaS use and apply policy to sanctioned and unsanctioned services. The relevant corrective control for this case is: Select a cloud access security broker capability suited to visibility and policy enforcement.

Evaluate a community cloud deployment with defined shared governance and tenant isolation. That action fits another problem: Two organizations share a regulated sector platform under a common governance agreement but need separation from public tenants. It does not directly remediate the current finding at Aspen Digital: An enterprise needs to discover unsanctioned SaaS use and apply policy to sanctioned and unsanctioned services. The relevant corrective control for this case is: Select a cloud access security broker capability suited to visibility and policy enforcement.

Audit evidence confirms contractual shared controls and effective isolation among members. This would be relevant evidence for a different failure: Two organizations share a regulated sector platform under a common governance agreement but need separation from public tenants, usually addressed by Evaluate a community cloud deployment with defined shared governance and tenant isolation. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A test unsanctioned application is identified and receives the configured access decision.

Only permitted data flows between environments and production-control traffic remains protected. This would be relevant evidence for a different failure: A manufacturer must connect on-premises production systems with public-cloud analytics without exposing the plant network, usually addressed by Design a hybrid cloud model with controlled private connectivity and segmentation. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A test unsanctioned application is identified and receives the configured access decision.

The workload is provisioned inside the required trust boundary and passes internal compliance checks. This would be relevant evidence for a different failure: An agency must keep restricted workloads on a dedicated internal environment with organizational control, usually addressed by Evaluate a private cloud deployment against isolation, governance, and operational requirements. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A test unsanctioned application is identified and receives the configured access decision.