Introduction to Cloud Security CCSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is required to comply with the General Data Protection Regulation (GDPR) for its cloud-stored personal data. The security team is designing a governance framework to ensure data protection. Which control is most directly required by GDPR?

   • AImplementing data minimization and purpose limitation
   • BDeleting all data after one year
   • CEnsuring that all data is stored in the same country as the company headquarters
   • DUsing only private cloud infrastructure
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A global enterprise is adopting cloud services and must comply with GDPR. The security team is developing a governance framework. Which governance element is MOST critical to include to ensure GDPR compliance?

   • AA policy that requires all cloud services to have ISO 27001 certification.
   • BA data classification policy that identifies personal data and defines handling requirements across all cloud services.
   • CA policy that requires all personal data to be stored only in the organization's on-premises data center.
   • DA policy that mandates the use of a single cloud provider to simplify compliance.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is adopting a multi-cloud strategy and must comply with ISO 27001. The security team is designing a governance framework that includes policies, standards, and procedures. Which approach best ensures that the framework is effective across all cloud providers?

   • ACreating a separate governance framework for each cloud provider to address unique features
   • BDelegating governance to each business unit to ensure local compliance
   • CUsing only one cloud provider to simplify governance
   • DDeveloping a single set of policies and standards that are provider-agnostic and mapping them to each provider's controls
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise is migrating a legacy application to a public cloud. The application has a hard dependency on a specific hardware security module (HSM) for cryptographic operations. The security team must maintain compliance with a regulation that requires cryptographic keys to be stored in FIPS 140-2 validated hardware. The cloud provider offers a managed HSM service, but the enterprise's security policy requires that the organization retain exclusive control over the root of trust. Which option best satisfies both the regulatory requirement and the security policy?

   • AUse a multi-tenant HSM service and rely on logical separation
   • BUse the cloud provider's managed HSM service and rely on the provider's compliance certifications
   • CUse a cloud provider's dedicated HSM that is physically isolated and customer-managed
   • DUse a software-based key management service and store keys in an encrypted database
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is moving to a public cloud and must comply with both GDPR and PCI DSS. The security team is designing a governance framework. The company wants to minimize the cost of compliance. Which approach is MOST effective?

   • ARely on the cloud provider's compliance certifications for both GDPR and PCI DSS.
   • BImplement a single set of security controls that satisfies the most stringent requirements of both GDPR and PCI DSS.
   • CImplement separate control sets for GDPR and PCI DSS to ensure each is fully addressed.
   • DFocus on PCI DSS controls because they are more prescriptive and will likely cover GDPR.
   Reveal Solution Discussion Select an answer first