Governance, Risk Management, and Compliance (GRC) in Cloud CCSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is a key jurisdictional challenge when using a global cloud provider?

   • AThe customer loses all legal rights to their data
   • BThe provider cannot store data in multiple regions
   • CThe provider is exempt from local laws
   • DThe provider may be subject to laws of multiple countries, potentially conflicting with the customer's local regulations
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In the shared responsibility model for cloud services, which party is typically responsible for patching the operating system of an IaaS virtual machine?

   • AThe customer
   • BA third-party auditor
   • CThe cloud service provider
   • DBoth the provider and customer equally
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key benefit of implementing continuous compliance monitoring in cloud infrastructure?

   • AIt allows for the immediate detection and remediation of compliance drift
   • BIt guarantees that the organization will pass all future audits
   • CIt eliminates the need for any manual security reviews
   • DIt removes the need for compliance reporting to stakeholders
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A financial services company is migrating its core banking application to a public cloud. The company must comply with PCI DSS and is required to provide evidence of compliance to its acquiring bank. The security team needs to demonstrate that the cloud environment is configured according to PCI DSS requirements. Which approach should they take?

   • APerform a self-assessment questionnaire (SAQ) and submit it without reviewing the provider's compliance documentation.
   • BUse the cloud provider's PCI DSS attestation of compliance (AOC) and map it to the company's own PCI DSS responsibilities.
   • CRequest the provider's SOC 2 Type II report and submit it to the acquiring bank as evidence of PCI DSS compliance.
   • DRely on the provider's ISO 27001 certification as proof of PCI DSS compliance for the entire environment.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A financial services company must comply with both GDPR and PCI DSS. They are evaluating a cloud provider that offers a SOC 2 Type II report and ISO 27001 certification. The compliance team needs to determine if these attestations are sufficient. What is the most appropriate action?

   • ARequire the provider to obtain GDPR and PCI DSS certifications
   • BAccept the SOC 2 and ISO 27001 as full compliance for GDPR and PCI DSS
   • CSwitch to a provider that has explicit GDPR and PCI DSS compliance statements
   • DMap the provider's attestations to the specific GDPR and PCI DSS requirements and identify gaps
   Reveal Solution Discussion Select an answer first