A company is considering a cloud provider that offers data residency options in multiple countries. The company has customers in the EU and Asia. They need to comply with GDPR and local data protection laws in Asia. Which approach best addresses these requirements?

Use a single global region and rely on the provider's certifications

Select data residency regions that align with the applicable legal requirements and implement transfer safeguards

Store all data in the EU region to simplify compliance

Avoid cloud storage and keep all data on-premises

A company is establishing a GRC framework for its cloud environment. The CISO wants to ensure that risk management decisions are aligned with business objectives and that compliance obligations are tracked. Which component is most critical to integrate into the framework?

A compliance checklist that is updated annually

A set of technical security controls without business alignment

A cloud provider's shared responsibility model document

A risk register that is reviewed by executive leadership quarterly

In the risk management process for cloud, what is the primary purpose of risk mitigation?

To document risks for compliance purposes only

To transfer all risks to the cloud provider

To eliminate all identified risks

To reduce the likelihood or impact of risks to an acceptable level

EC-CouncilCertified Cloud Security Engineer

Domain 1Objective 2

Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 1)

Part of the Cloud Security Fundamentals and Governance domain, which makes up ~25% of our current practice bank.

54questions here

11free pages

8concepts

Questions 1–5

1expert · hard
A company is considering a cloud provider that offers data residency options in multiple countries. The company has customers in the EU and Asia. They need to comply with GDPR and local data protection laws in Asia. Which approach best addresses these requirements?
Select an answer first
2application · medium
A company is establishing a GRC framework for its cloud environment. The CISO wants to ensure that risk management decisions are aligned with business objectives and that compliance obligations are tracked. Which component is most critical to integrate into the framework?
Select an answer first
3foundation · easy
Which cloud governance model component defines who has the authority to approve changes to a cloud environment?
Select an answer first
4application · medium
A SaaS company is seeking a compliance framework that demonstrates to enterprise customers that its security controls are effective over time. The company does not process payment card data. Which framework is most appropriate?
Select an answer first
5foundation · easy
In the risk management process for cloud, what is the primary purpose of risk mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCSE” is a trademark of its owner, used for identification only.

Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

A company is considering a cloud provider that offers data residency options in multiple countries. The company has customers in the EU and Asia. They need to comply with GDPR and local data protection laws in Asia. Which approach best addresses these requirements?

A company is establishing a GRC framework for its cloud environment. The CISO wants to ensure that risk management decisions are aligned with business objectives and that compliance obligations are tracked. Which component is most critical to integrate into the framework?

Which cloud governance model component defines who has the authority to approve changes to a cloud environment?

A SaaS company is seeking a compliance framework that demonstrates to enterprise customers that its security controls are effective over time. The company does not process payment card data. Which framework is most appropriate?

In the risk management process for cloud, what is the primary purpose of risk mitigation?

Keep studying — Cloud Security Fundamentals and Governance