A company is negotiating a cloud SLA with a provider that will host its customer database. The company requires 99.99% availability and needs to ensure that the provider will notify them of any data breaches within 24 hours. The provider's standard SLA offers 99.9% availability and 72-hour breach notification. Which action is most appropriate?

Choose a different provider that offers 99.99% availability, even if breach notification remains 72 hours.

Sign the standard SLA and implement technical controls to detect breaches internally.

Negotiate a custom SLA that includes a higher availability commitment and a shorter breach notification timeframe, with penalties for non-compliance.

Accept the standard SLA and rely on the provider's goodwill for breach notification.

Which organization publishes the ISO/IEC 27001 standard, which is widely used as the basis for cloud security management systems?

European Telecommunications Standards Institute (ETSI)

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

National Institute of Standards and Technology (NIST)

In cloud computing, what is the primary legal concern with cross-border data transfers?

Obtaining consent from the cloud provider

Ensuring the cloud provider has a local office in the destination country

Ensuring data is encrypted during transit

Complying with data protection regulations that may restrict or condition the transfer of personal data to other countries

What is the primary purpose of the CSA STAR (Security, Trust, Assurance, and Risk) program?

To provide a set of controls specifically for protecting PII in cloud environments

To define a standard for cloud service level agreements (SLAs)

To offer a publicly accessible registry and certification framework that helps cloud customers assess the security posture of cloud providers

To establish a set of legal requirements for cross-border data transfers

Which cloud standards body is known for publishing the Cloud Controls Matrix (CCM) and the Security, Trust, Assurance, and Risk (STAR) registry?

Internet Engineering Task Force (IETF)

International Organization for Standardization (ISO)

International Telecommunication Union (ITU)

EC-CouncilCertified Cloud Security Engineer

Domain 1Objective 3

Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 4)

Part of the Cloud Security Fundamentals and Governance domain, which makes up ~25% of our current practice bank.

44questions here

9free pages

8concepts

Questions 16–20

16expert · hard
A company is negotiating a cloud SLA with a provider that will host its customer database. The company requires 99.99% availability and needs to ensure that the provider will notify them of any data breaches within 24 hours. The provider's standard SLA offers 99.9% availability and 72-hour breach notification. Which action is most appropriate?
Select an answer first
17foundation · easy
Which organization publishes the ISO/IEC 27001 standard, which is widely used as the basis for cloud security management systems?
Select an answer first
18foundation · easy
In cloud computing, what is the primary legal concern with cross-border data transfers?
Select an answer first
19foundation · easy
What is the primary purpose of the CSA STAR (Security, Trust, Assurance, and Risk) program?
Select an answer first
20foundation · easy
Which cloud standards body is known for publishing the Cloud Controls Matrix (CCM) and the Security, Trust, Assurance, and Risk (STAR) registry?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCSE” is a trademark of its owner, used for identification only.