In the event of a civil lawsuit resulting from inadequate security management, the organization must communicate with the board of directors. Managing Cloud guidance explains that the board of directors holds ultimate responsibility for governance, oversight, and risk management within an organization.
The board ensures that appropriate policies, controls, and management structures are in place to protect organizational assets and comply with legal obligations. In legal matters, the board must be informed to oversee response strategies, legal counsel engagement, and corrective actions.
The IT department manages technical controls but does not provide organizational oversight. High-level government agencies are regulators, not internal oversight bodies. Therefore, board members are the correct entity to contact.

Cloud providers typically manage multi-tenant infrastructure, where physical hardware is shared among customers. Therefore, drives are not destroyed for each customer unless explicitly required in the contract. If the customer's agreement specifies dedicated hardware disposal, then the provider must comply by physically destroying the drives.
Cryptographic erasure and degaussing are valid sanitization methods, but they may not meet the specific contractual requirement of physical destruction. Insurance clauses are unrelated to disposal.
This question underscores the importance of negotiating contractual terms in cloud agreements. Customers handling highly sensitive or regulated data may require physical destruction, while others may accept logical erasure. Clear agreements ensure both compliance and alignment of security responsibilities.

In the Software as a Service (SaaS) model, the cloud service provider bears the greatest responsibility for security. Managing Cloud documentation explains that in SaaS environments, the provider manages the application, operating system, middleware, infrastructure, and often many security controls.
Customers primarily focus on user access, data classification, and configuration of application-level settings, while the provider ensures platform availability, patching, vulnerability management, and infrastructure security. This shared responsibility model places the largest security burden on the provider in SaaS compared to other service models.
In PaaS and IaaS, customers assume increasing responsibility for securing operating systems, applications, and configurations. DBaaS still requires customer involvement in access control and data management.
Therefore, SaaS is the correct answer.

Tabletop testing is the disaster recovery testing method with the least impact on production systems.
Managing Cloud guidance explains that tabletop exercises are discussion-based scenarios where stakeholders walk through response procedures without executing actual system changes.
This approach allows teams to validate roles, responsibilities, communication paths, and decision-making processes. Tabletop testing is cost-effective, low-risk, and ideal for early validation of disaster recovery and business continuity plans.
Dry runs and full tests involve actual system actions and can impact production. Unit testing focuses on individual components. Therefore, tabletop testing is the correct answer.

A core goal of OS baseline compliance and monitoring is to ensure that virtual images and operating systems adhere to approved baseline configuration requirements. Managing Cloud documentation explains that baseline configurations define secure settings for operating systems, including disabled services, patch levels, access controls, and logging configurations.
Compliance monitoring continuously verifies that systems remain aligned with these baselines over time. This helps detect unauthorized changes, configuration drift, or misconfigurations that could introduce vulnerabilities. Ensuring that virtual images meet baseline standards before deployment also reduces risk across scaled cloud environments.
The other options relate to availability, network isolation, or data separation, which are addressed by different controls. Therefore, ensuring baseline configuration compliance is the primary goal of OS baseline monitoring.