Federal agencies in the U.S. rely onNIST SP 800-37, Risk Management Framework (RMF), to manage enterprise risk. RMF provides a structured process for categorizing systems, selecting controls, implementing safeguards, assessing effectiveness, authorizing operations, and continuous monitoring.
ISO 37500 deals with outsourcing governance, SSAE 18 governs service provider audits, and COSO is a corporate governance framework but not specific to federal agencies.
NIST RMF is integrated with the Federal Information Security Modernization Act (FISMA) requirements, ensuring agencies manage cybersecurity risks consistently. Its adoption is expanding beyond government into industries seeking comprehensive, repeatable risk management processes.

During the create phase of the cloud data life cycle, data is first generated or collected by an organization. At this stage, it is essential to apply security controls before the data is transferred to the cloud environment.
The most effective control during this phase is encryption. Encrypting data ensures that the information is transformed into an unreadable format, protecting it from unauthorized access while it is being transmitted and stored in the cloud.
Managing Cloud principles emphasize that security must be applied as early as possible in the data life cycle to minimize exposure and reduce risk. If data is encrypted prior to upload, even if interception or unauthorized access occurs, the data remains protected and unusable without the appropriate decryption keys.
This approach also supports data confidentiality requirements and aligns with security best practices for handling sensitive and regulated information.
The other options do not provide adequate protection during the create phase. Storing or archiving data refers to later life cycle stages, while sharing data increases exposure rather than securing it. Therefore, encrypting data before uploading it to the cloud is a critical safeguard that ensures data confidentiality, supports compliance requirements, and strengthens overall cloud security posture.

Rapid elasticity is the cloud computing characteristic that allows consumers to automatically expand or contract resources based on demand. Managing Cloud documentation explains that rapid elasticity enables scaling of computing resources in near real time.
This capability allows organizations to handle variable workloads efficiently without manual intervention.
Resources can be provisioned when demand increases and released when demand decreases, optimizing performance and cost.
Measured service focuses on usage tracking, resource pooling shares infrastructure, and on-demand self- service enables user provisioning. Therefore, rapid elasticity is the correct answer.

Pausing the virtual machine is the correct action to preserve forensic evidence for collection. Managing Cloud guidance explains that pausing a VM maintains its current memory and disk state, preventing changes that could alter or destroy evidence.
This approach allows investigators to capture volatile data, analyze system state, and perform forensic imaging without introducing new activity. Preserving the environment is critical for maintaining chain of custody and ensuring the integrity of evidence.
The other options do not preserve evidence. Serverless architectures reduce server management, threat modeling is a design activity, and mutable servers increase configuration changes. Therefore, pausing the virtual machine is the correct answer.

The Management component contains both a remotely accessible application programming interface (API) and a web-based graphical user interface. Managing Cloud documentation explains that the management layer is responsible for provisioning, monitoring, configuration, and administration of cloud resources.
This component enables administrators and automation tools to interact with cloud services programmatically through APIs, while also providing human-accessible web consoles for operational management. The dual- interface design supports scalability, automation, and ease of use.
Infrastructure provides raw compute, storage, and networking. Applistructure refers to deployed applications and services, while metastructure supports orchestration and abstraction. Therefore, the management component is the correct answer.