Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A multinational company processes personal data of EU residents and stores it in a public cloud region located in the United States. The company's legal team is concerned about GDPR compliance, specifically regarding international data transfers. The company is considering using the cloud provider's EU data residency option, but the provider's US-based support team has remote access to the data for troubleshooting. Which action best addresses the GDPR transfer concern?

   • AEncrypt all data at rest and in transit, and argue that encryption eliminates the need for a transfer mechanism.
   • BImplement technical controls to prevent US-based support staff from accessing the data, and sign Standard Contractual Clauses (SCCs) with the provider.
   • CMove the data to an EU region and rely on the provider's EU data residency commitment to ensure GDPR compliance.
   • DObtain explicit consent from each data subject for the transfer to the US.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A global company stores personal data of EU citizens in a cloud region located in the United States. The company is subject to GDPR. What is the primary legal requirement they must address?

   • AMove all data to an EU region immediately
   • BEnsure that appropriate safeguards are in place for international data transfers
   • CDelete all personal data of EU citizens
   • DObtain consent from each data subject for storage in the US
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A cloud security team is implementing a continuous compliance monitoring solution for their AWS environment. They need to automatically detect misconfigurations, such as S3 buckets with public read access, and generate reports for the compliance team. The team wants to use native AWS services and minimize custom scripting. Which combination of services should they use?

   • AAWS Config with managed rules and AWS Security Hub to aggregate findings and generate compliance reports.
   • BAmazon Inspector to scan S3 buckets for public access and publish findings to an S3 bucket.
   • CAWS CloudTrail with a custom Lambda function that scans S3 bucket policies and sends alerts to Amazon SNS.
   • DAWS Trusted Advisor to check S3 bucket permissions and email a monthly report to the compliance team.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A SaaS company that hosts customer data in multiple cloud regions is preparing for its annual SOC 2 Type II audit. The auditor requires evidence that the company's cloud provider has appropriate controls over the physical data centers. The company's security team must provide this evidence without conducting its own physical site visit. Which action should the team take?

   • APerform a virtual walkthrough of the provider's data center using a live video feed arranged by the provider.
   • BRequest the cloud provider's SOC 2 Type II report and map its controls to the company's SOC 2 trust services criteria.
   • CExclude physical controls from the SOC 2 audit scope because they are the provider's responsibility.
   • DRely on the provider's ISO 27001 certificate as sufficient evidence for all SOC 2 physical control requirements.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which compliance framework is specifically designed to protect the personal data of individuals in the European Union?

   • AHIPAA
   • BGDPR
   • CPCI DSS
   • DISO 27001
   Reveal Solution Discussion Select an answer first