Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Under GDPR, what is the role of 'consent' in the processing of personal data?

   • AConsent must be freely given, specific, informed, and unambiguous, and can be withdrawn at any time
   • BConsent is only required for sensitive data categories
   • CConsent must be obtained from the data controller, not the data subject
   • DConsent is required for all processing of personal data
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security auditor is planning a cloud security audit for a client that uses a hybrid cloud environment. The client has ISO/IEC 27001 certification and uses a cloud provider with CSA STAR certification. The auditor must verify that the client's controls are effective and that the provider's controls are adequate. Which approach should the auditor take?

   • AReview the certifications but also conduct independent testing of the client's controls and review the provider's audit reports
   • BRely solely on the client's ISO/IEC 27001 certification and the provider's CSA STAR certification without additional testing
   • CUse the client's ISO/IEC 27001 certification as the sole basis for the audit and ignore the provider's controls
   • DPerform a full audit of the provider's infrastructure without relying on any existing certifications
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is negotiating a cloud service agreement with a provider whose data centers are located in a foreign jurisdiction. The company's legal counsel requires that the provider notify the company within 24 hours of any government request for access to the company's data. The provider's standard SLA only offers a 72-hour notification window and states that it may be legally prohibited from disclosing certain requests. The company's security team must balance legal requirements with operational feasibility. What is the most appropriate contractual approach?

   • AReject the provider and select one that can guarantee 24-hour notification without exception
   • BAccept the 72-hour SLA but require the provider to use best efforts to notify sooner and to disclose all requests unless legally prohibited
   • CRequire the provider to store all data in the company's home country to avoid foreign government access
   • DDemand that the provider waive all rights to comply with local laws in favor of the company's contractual terms
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is developing a cloud data classification policy. The policy must align with GDPR and the company's risk management strategy. Which element is most important to include in the policy?

   • AA copy of the company's incident response plan.
   • BA list of all cloud providers the company uses.
   • CA description of the company's organizational structure.
   • DA classification scheme that defines data categories and specifies handling requirements for each category.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of audit report provides a detailed description of a service organization's controls and whether they are suitably designed and operating effectively, often used by cloud customers to assess a provider's security?

   • AVulnerability scan report
   • BSOC 2 report
   • CPenetration test report
   • DISO/IEC 27001 certificate
   Reveal Solution Discussion Select an answer first