The most effective practice in protecting personally identifiable information (PII) from unauthorized access in a cloud environment is to utilize encryption with logical access controls. Encryption is a technique that transforms the data into an unreadable or unintelligible form, making it inaccessible or unusable by unauthorized parties. Logical access controls are the mechanisms or rules that regulate who can access, view, modify, or delete the data, based on their identity, role, or privilege. By utilizing encryption with logical access controls, the PII can be protected from unauthorized access, disclosure, or theft, both in transit and at rest, in a cloud environment. The other options are not as effective as utilizing encryption with logical access controls, as they are related to the classification, separation, or audit of the data, not the protection or security of the data. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

According to the CRISC Review Manual, formal approval of the account by the user's manager is the best evidence that a user account has been properly authorized, because it ensures that the user's role and access rights are consistent with the business needs and the principle of least privilege. The user's manager is responsible for verifying the user's identity, job function, and access requirements, and for approving or rejecting the account request. The other options are not the best evidence of proper authorization, because they do not involve the user's manager's approval. An email from the user accepting the account is a confirmation of the account creation, but it does not indicate that the account was authorized by the user's manager. Notification from human resources that the account is active is an administrative process that does not verify the user's access rights and role. User privileges matching the request form is a verification of the account configuration, but it does not ensure that the request form was approved by the user's manager. References = CRISC Review Manual, 7th Edition, Chapter 4, Section 4.1.2, page 163.

Organizational risk culture is the term describing the values, beliefs, knowledge, attitudes and understanding about risk shared by a group of people with a common purpose. Organizational risk culture influences how the organization identifies, assesses, and manages risks, and how it aligns its risk appetite and tolerance with its objectives and strategies1.
The best indication of a mature organizational risk culture is that risk owners understand and accept accountability for risk, because it means that the organization:
Clearly defines and assigns the roles and responsibilities of the risk owners, who are the individuals or groups who have the authority and ability to manage the risks within their scope or domain Empowers and supports the risk owners to perform their risk management duties, such as identifying, assessing, responding, monitoring, and reporting the risks Holds the risk owners accountable for the outcomes and consequences of the risks, and evaluates their performance and compliance with the risk policies, standards, and procedures Encourages and rewards the risk owners for demonstrating risk awareness and competence, and for contributing to the risk management improvement and learning23 The other options are not the best indications of a mature organizational risk culture, but rather some of the elements or aspects of it. Corporate risk appetite is the amount and type of risk that the organization is willing to accept in order to achieve its objectives. Corporate risk appetite is communicated to staff members to guide their risk decision making and behavior, and to ensure the consistency and alignment of the risk taking and tolerance across the organization. Risk policy is the document that establishes the principles, framework, and process for managing the risks within the organization. Risk policy is published and acknowledged by employees to ensure their awareness and compliance with the risk management expectations and requirements. Management is the group of individuals who have the authority and responsibility to direct and control the organization's activities and resources. Management encourages the reporting of policy breaches to ensure the transparency and accountability of the risk management performance and outcomes, and to identify and address the risk management issues and gaps4. References = Risk culture - Institute of Risk Management Risk Owner - ISACA Taking control of organizational risk culture | McKinsey
[CRISC Review Manual, 7th Edition]

Segregation of duties is a key control for preventing and detecting fraudulent transactions, especially in a large organization where there are many employees and transactions involved. Segregation of duties means that no single person has the authority or ability to initiate, approve, execute, and record a transaction without the involvement or oversight of another person. This reduces the opportunity and incentive for fraud, as well as the risk of errors or omissions. Segregation of duties also facilitates the detection of fraud by creating an audit trail and increasing the likelihood of whistleblowing.
The other options are not as effective as segregation of duties for mitigating risk related to fraudulent transactions. Monetary approval limits (B) are useful for controlling the amount and frequency of transactions, but they do not prevent unauthorized or fraudulent transactions from occurring. Clear roles and responsibilities are important for defining the expectations and accountabilities of employees, but they do not ensure that employees comply with them or that their actions are monitored and verified. Password policies (D) are essential for securing access to systems and data, but they do not prevent fraudsters from exploiting weak or compromised passwords or from using legitimate passwords for fraudulent purposes.

The primary reason for periodic penetration testing of Internet-facing applications is to identify vulnerabilities in the system, because this will help to improve the security and resilience of the applications and the data they process. A penetration test is a simulated cyberattack that aims to exploit the weaknesses and gaps in the security of an application or a system. A penetration test can reveal the vulnerabilities that may not be detected by other methods, such as automated scanning or code review. A penetration test can also measure the impact and severity of the vulnerabilities, as well as the effectiveness of the existing controls and defenses. A penetration test can also provide recommendations and solutions to remediate the vulnerabilities and prevent future attacks. Internet-facing applications are programs and services that are accessible from the internet, such as web applications, APIs, cloud services, or VPN gateways. Internet-facing applications are exposed to a variety of cyber threats, such as denial-of-service attacks, SQL injection attacks, cross-site scripting attacks, or credential stuffing attacks. These threats can compromise the confidentiality, integrity, and availability of the applications and the data they handle. Therefore, periodic penetration testing of Internet- facing applications is essential to identify vulnerabilities in the system and to protect the applications and the data from cyberattacks. References = Web Application Penetration Testing: A Practical Guide - BrightSecurity1, The Basics of Web Application Penetration Testing | Turing2, Periodic Penetration Testing:
What is the best pentesting frequency ...