Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which compliance framework is mandatory for organizations that handle credit card data and includes requirements for network security, access control, and regular monitoring that apply to cloud environments?

   • AGDPR
   • BSOC 2
   • CPCI DSS
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A global company stores customer data in a cloud provider that has data centers in multiple countries. The company receives a legal request from a foreign government for access to data stored in that country. The company's legal team is concerned about jurisdiction and data sovereignty. Which action is most appropriate?

   • AEvaluate the legal basis of the request and consult with legal counsel to determine the appropriate response, considering the laws of all relevant jurisdictions.
   • BImmediately provide the data to the foreign government to avoid legal consequences.
   • CDelete the data to avoid the request.
   • DRefuse to provide the data without any legal review.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational company with operations in the EU and the US uses a cloud provider that stores data in both regions. The company's DPO is concerned about GDPR compliance for EU user data. The cloud provider offers a Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) for transfers to the US. What is the most appropriate action to ensure GDPR compliance for EU user data?

   • AAnonymize EU user data before storing it in the cloud.
   • BEncrypt all EU user data with keys held by the EU subsidiary.
   • CConfigure the cloud service to store EU user data only in EU regions and rely on the DPA with SCCs for any necessary transfers.
   • DStore all data in the US and rely on the DPA's SCCs to legitimize the transfer.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's cloud application stores user profiles, including email addresses and browsing history. The company's privacy policy states that user data will only be used for the purpose for which it was collected. The marketing team wants to use the browsing history to create targeted advertisements. Which action should the security team take?

   • ADelete the browsing history and only use email addresses for marketing
   • BAnonymize the browsing history before using it for targeted ads
   • CAllow the use of browsing history for targeted ads because it is part of the user profile
   • DRequire the marketing team to obtain explicit consent from users before using browsing history for targeted ads
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is developing a cloud security policy that must address governance, risk management, and compliance. The policy should align with the organization's objectives. Which element is most important to include in the policy?

   • AA detailed list of all cloud services the organization uses.
   • BA copy of the organization's financial budget.
   • CA statement of the organization's risk appetite and the process for making risk-based decisions.
   • DA description of the organization's IT architecture.
   Reveal Solution Discussion Select an answer first