Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which practice is most effective for continuous compliance monitoring in a cloud environment?

   • APerforming a compliance audit once a year
   • BRelying solely on the cloud provider's certifications
   • CAutomated scanning of cloud resources against compliance policies on a recurring basis
   • DReviewing compliance manually on a quarterly basis
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is planning to use a public cloud provider to store personal data of customers in multiple countries. The company's legal team is concerned about the legal implications of data being stored in a foreign country. Which action should the company take to address these concerns?

   • AStore all data in the company's home country to avoid any legal issues.
   • BEncrypt all data to avoid legal obligations related to data protection.
   • CRely on the cloud provider's compliance certifications to ensure legal compliance.
   • DReview the data protection laws of each country where data is stored and ensure that appropriate transfer mechanisms are in place.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multinational company is considering using a cloud provider that has data centers in several countries. The company's legal team is concerned about data sovereignty. Which factor is most important to evaluate?

   • AThe specific country where the data will be stored and the local laws that apply
   • BThe cloud provider's global network performance
   • CThe cloud provider's marketing materials
   • DThe cost of the cloud services
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization is migrating its patient records system to a public cloud. The compliance officer requires evidence that the cloud provider's security controls are independently validated. Which compliance framework or attestation should the organization prioritize?

   • AThe provider's self-assessment questionnaire
   • BISO 27001 certification of the organization itself
   • CSOC 2 Type II report
   • DPCI DSS compliance of the cloud provider
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is adopting a cloud governance model that uses a centralized team to define policies and a decentralized approach for business units to implement those policies. The company wants to ensure that security policies are consistently applied across all cloud accounts. Which mechanism should the company use to enforce this?

   • AAllow each business unit to create its own security policies and share them informally.
   • BUse organization-level policies and guardrails that are automatically applied to all accounts.
   • CConduct quarterly reviews of each account's security configuration.
   • DRely on the cloud provider's default security settings to enforce policies.
   Reveal Solution Discussion Select an answer first