Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's cloud application collects user data and must comply with GDPR. The company wants to implement data protection principles. Which practice is most aligned with GDPR's data minimization principle?

   • ACollect only the personal data necessary for the stated purpose and configure the application to request consent for any additional processing.
   • BAnonymize user data immediately after collection, regardless of the purpose.
   • CStore user data indefinitely in case of future legal requests.
   • DCollect all available user data to enable future marketing opportunities.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of a data processing addendum (DPA) in a cloud service contract?

   • ATo list the hardware specifications of the provider's data centers
   • BTo specify the fees and payment terms for the cloud service
   • CTo define the technical architecture of the cloud service
   • DTo establish the roles and responsibilities of the data controller and data processor regarding the processing of personal data
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A US-based healthcare SaaS provider stores protected health information (PHI) in a public cloud. The provider signs a Business Associate Agreement (BAA) with the cloud vendor, but the vendor's standard terms state that data may be replicated to any global region. The provider's compliance officer insists that PHI must remain within US borders. Which contractual change is most critical to enforce this requirement?

   • AMandate that the vendor undergo an annual SOC 2 Type II audit.
   • BInclude a right-to-audit clause allowing the provider to inspect vendor data centers.
   • CAdd a data residency clause that restricts storage and replication to US regions only.
   • DRequire the vendor to encrypt all PHI with customer-managed keys.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which compliance framework is specifically designed to protect the privacy and personal data of individuals in the European Union and applies to any organization, including cloud providers, that processes such data?

   • APCI DSS
   • BSOX
   • CHIPAA
   • DGDPR
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which component of a cloud service agreement typically specifies the level of availability and performance the provider guarantees?

   • AAcceptable use policy (AUP)
   • BData processing addendum (DPA)
   • CService level agreement (SLA)
   • DNon-disclosure agreement (NDA)
   Reveal Solution Discussion Select an answer first