Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security auditor is conducting a compliance audit for a company that uses a cloud provider. The company has a contract with the provider that includes a right-to-audit clause. The provider's data centers are located in multiple countries. The auditor needs to verify the provider's security controls. Which action should the auditor take?

   • APerform a penetration test on the provider's infrastructure
   • BRely solely on the provider's ISO/IEC 27001 certification
   • CRequest the provider's SOC 2 Type II report and review it for relevant controls
   • DConduct an on-site audit of all the provider's data centers
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A cloud customer is planning an audit of a SaaS provider that hosts customer data. The provider has ISO/IEC 27017 certification and offers a shared responsibility matrix. The customer's audit team wants to verify that the provider's controls are effective and that the customer's own responsibilities are clearly defined. Which audit approach is most appropriate?

   • ARely solely on the provider's SOC 2 report without reviewing the shared responsibility matrix.
   • BPerform a full on-site audit of the provider's data centers without relying on any certifications.
   • CReview the provider's ISO/IEC 27017 certification and conduct a controls mapping to the shared responsibility matrix.
   • DAsk the provider to sign a new SLA that includes audit rights, then skip the audit.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A cloud customer is evaluating a new SaaS provider that will process personal data on behalf of the customer. The customer wants to verify that the provider has implemented cloud-specific security controls and also provides transparency about data processing. Which combination of certifications/attestations would best address both concerns?

   • APCI DSS and HIPAA
   • BISO/IEC 27017 and CSA STAR attestation
   • CGDPR and CCPA
   • DISO/IEC 27001 and SOC 2 Type II
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which legal concept refers to the requirement that data is subject to the laws of the country or region where it is physically stored or processed?

   • AData retention
   • BData residency
   • CData classification
   • DData sovereignty
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A cloud customer is planning an audit of its own use of a cloud provider. The customer wants to verify that its data handling practices comply with GDPR. Which audit activity is most appropriate?

   • AReview the customer's data processing records and verify that data protection impact assessments (DPIAs) have been conducted for high-risk processing.
   • BReview the provider's marketing materials.
   • CAudit the provider's physical data center security.
   • DTest the provider's application code for vulnerabilities.
   Reveal Solution Discussion Select an answer first