A company is evaluating a cloud provider's SLA. The company requires that the provider notify them of any security incidents within a specific timeframe. Which SLA clause is most important to review?

The service availability percentage.

The incident notification and response timeframe.

The data backup and recovery procedures.

What is the primary purpose of a cloud security policy?

To establish management direction and high-level principles for securing cloud use and protecting organizational assets

To define the technical configuration of cloud resources

To list all cloud service providers approved for use

To provide step-by-step instructions for incident response

A company's cloud provider stores data in a country that has enacted a law allowing government authorities to access data without notifying the data owner. The company's customers are located in the EU, and the company is subject to GDPR. The company's legal team is concerned about the legality of the data transfer. Which action is most appropriate?

Move all data to an on-premises data center to avoid GDPR obligations

Continue using the provider because GDPR does not apply to data stored outside the EU

Require the provider to sign a BAA or similar agreement to ensure data protection

Evaluate whether the provider's country has an adequacy decision from the EU or implement supplementary measures

EC-CouncilCertified Cloud Security Engineer

Domain 1Objective 3

Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 3)

Part of the Cloud Security Fundamentals and Governance domain, which makes up ~25% of our current practice bank.

44questions here

9free pages

8concepts

Questions 11–15

11application · medium
A cloud security team is researching standards to help them evaluate the security of a potential cloud provider. They want a standard that provides a framework for cloud-specific security controls and can be used for certification. Which standard is most appropriate?
Select an answer first
12application · medium
A company is evaluating a cloud provider's SLA. The company requires that the provider notify them of any security incidents within a specific timeframe. Which SLA clause is most important to review?
Select an answer first
13foundation · easy
What is the primary purpose of a cloud security policy?
Select an answer first
14foundation · easy
Which standard provides guidance specifically for cloud service providers on implementing controls for the protection of personally identifiable information (PII) in public clouds acting as PII processors?
Select an answer first
15expert · hard
A company's cloud provider stores data in a country that has enacted a law allowing government authorities to access data without notifying the data owner. The company's customers are located in the EU, and the company is subject to GDPR. The company's legal team is concerned about the legality of the data transfer. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCSE” is a trademark of its owner, used for identification only.

Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

A cloud security team is researching standards to help them evaluate the security of a potential cloud provider. They want a standard that provides a framework for cloud-specific security controls and can be used for certification. Which standard is most appropriate?

A company is evaluating a cloud provider's SLA. The company requires that the provider notify them of any security incidents within a specific timeframe. Which SLA clause is most important to review?

What is the primary purpose of a cloud security policy?

Which standard provides guidance specifically for cloud service providers on implementing controls for the protection of personally identifiable information (PII) in public clouds acting as PII processors?

Keep studying — Cloud Security Fundamentals and Governance