Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which data protection principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?

   • AIntegrity and confidentiality
   • BStorage limitation
   • CPurpose limitation
   • DData minimization
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is evaluating a cloud provider's SLA for a critical application. The SLA offers a 99.9% uptime guarantee but includes a clause that excludes downtime caused by 'scheduled maintenance' and 'force majeure events'. The company's application requires high availability. What should the security team do?

   • ANegotiate for a definition of 'scheduled maintenance' that requires advance notice and limits its frequency
   • BAccept the SLA as-is because 99.9% uptime is sufficient for most applications
   • CRequire the provider to eliminate all exclusions from the SLA
   • DSelect a different provider that offers a higher uptime guarantee without exclusions
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is negotiating a cloud service agreement with a provider. The provider's SLA includes a clause that limits the provider's liability to the amount paid by the company in the preceding 12 months. The company's legal team wants to increase the liability limit. Which approach is most effective?

   • ASelect a different provider that offers a higher liability limit without negotiation
   • BNegotiate for a higher liability limit or an exception for breaches caused by the provider's gross negligence
   • CPurchase cyber insurance to cover potential losses beyond the liability limit
   • DAccept the liability limit because it is standard in the industry
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is considering a cloud provider that stores data in a country with different data protection laws. The company wants to ensure that its data is protected according to its own legal obligations. Which action is most appropriate?

   • AReview the provider's data processing agreements and ensure they include appropriate safeguards for cross-border data transfers.
   • BEncrypt all data and ignore legal requirements.
   • CStore all data in the provider's home country only.
   • DAssume that the provider's local laws will protect the data.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of a cloud security audit?

   • ATo negotiate contract terms with the cloud provider
   • BTo design the cloud architecture for a new application
   • CTo provide training to cloud administrators
   • DTo identify security vulnerabilities and verify compliance with applicable standards and policies
   Reveal Solution Discussion Select an answer first