Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to ensure that its cloud environment remains compliant with internal policies after a major configuration change. What is the most effective way to verify compliance?

   • AReview the change documentation manually
   • BAsk the cloud provider to confirm compliance
   • CRun an automated compliance scan immediately after the change
   • DWait for the next scheduled audit
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare startup is migrating a patient-facing web application to a public cloud. The compliance officer requires that the organization formally document the security responsibilities of both the cloud provider and the startup, and that the startup implement a process to periodically reassess the risk of the migration. The startup has limited security staff and wants to avoid building a custom risk-management platform. Which approach best satisfies both requirements?

   • ACreate a shared responsibility matrix that maps each control to the provider or the startup, and schedule quarterly risk reviews using a cloud-native assessment tool.
   • BDelegate all security responsibilities to the cloud provider by signing an enhanced business associate agreement, and perform a one-time risk assessment at migration completion.
   • CAdopt the cloud provider's shared responsibility model as the sole governance document and rely on the provider's published compliance certifications for ongoing risk assurance.
   • DPurchase a third-party GRC platform that automatically maps all cloud controls to the startup, eliminating the need for internal risk reviews.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of an audit of a cloud environment?

   • ATo provide real-time threat intelligence
   • BTo design new cloud architectures
   • CTo evaluate the effectiveness of security controls and compliance with requirements
   • DTo market the cloud provider's services
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is comparing ISO 27001 and SOC 2 to determine which framework to use for its cloud service. The company's customers are primarily enterprises that require assurance about the service's security controls. The company also wants to demonstrate compliance with international standards. Which statement accurately reflects a key difference between the two frameworks?

   • ASOC 2 is required by law for all cloud providers, while ISO 27001 is voluntary.
   • BSOC 2 is a certification that is recognized globally, while ISO 27001 is only recognized in Europe.
   • CISO 27001 focuses exclusively on technical controls, while SOC 2 focuses on organizational policies.
   • DISO 27001 is a certification that requires a formal management system, while SOC 2 is an attestation report based on trust services criteria.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is required to comply with the Health Insurance Portability and Accountability Act (HIPAA) for its cloud-hosted healthcare application. The company uses a public cloud provider that offers a HIPAA-eligible service. The company must ensure that its use of the service meets HIPAA requirements. Which action is essential?

   • AUse a cloud provider that is not HIPAA-eligible to avoid compliance obligations.
   • BRely on the provider's HIPAA-eligible designation to ensure compliance without further action.
   • CSign a business associate agreement (BAA) with the cloud provider and implement the required safeguards.
   • DEncrypt all data and assume HIPAA compliance is achieved.
   Reveal Solution Discussion Select an answer first