Explain how governance and compliance controls are implemented in cloud environments (policies, standards, audits).

• A. Governance relies on manual auditing with no automation.
• B. Compliance is achieved through legalese and ignoring logs.
• C. Governance uses policies and standards; compliance includes audits, automated checks, logging, and reporting; enforce via IAM, tagging, and config rules.
• D. Compliance is optional in cloud environments.

Answer: (C)

Governance in the cloud is about setting the rules for how resources are used and ensuring those rules are consistently applied. This is implemented through policies and standards that define acceptable configurations, access controls, tagging conventions, and naming schemes. When policy is treated as code, you can enforce these rules automatically during provisioning and continuously monitor for any drift from the standards.

Compliance goes beyond setting rules by providing evidence that those rules are followed. It involves audits, automated checks, logging, and reporting on the configuration and security posture. Enforcement mechanisms—such as IAM to control who can do what, tagging to organize resources and apply controls, and config rules to continuously evaluate configurations and remediate issues—connect the policy framework to real-world behavior and evidence.

So the described approach, where governance relies on policies and standards, and compliance includes audits, automated checks, logging, and reporting with enforcement through IAM, tagging, and config rules, best reflects how governance and compliance controls are implemented in cloud environments. Manual auditing alone isn’t scalable, ignoring logs leaves no trace for audits, and treating compliance as optional is not tenable in practice.