Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company operates in the healthcare sector and uses a public cloud to store patient data. The company is subject to HIPAA and also processes data of EU residents, making it subject to GDPR. The company wants to ensure compliance with both regulations. Which approach is most appropriate?

   • AComply only with GDPR because it is more comprehensive.
   • BImplement a compliance program that maps controls to both HIPAA and GDPR, and use a cloud provider that offers a BAA and supports data residency.
   • CStore all data on-premises to avoid cloud compliance issues.
   • DComply only with HIPAA because it is more stringent.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is developing a cloud security policy that must align with GDPR. The policy must address data subject rights, including the right to erasure. The company uses multiple cloud services that store customer data. Which process should the policy define?

   • AA process for identifying all cloud services that store personal data and a procedure for deleting data upon request
   • BA process for notifying data subjects that their data will be retained for a specified period
   • CA process for anonymizing data instead of deleting it upon request
   • DA process for transferring data to a third country upon request
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which element is essential for a cloud security policy to be effective in aligning with organizational objectives?

   • AIt must include every possible technical control
   • BIt must be approved by the cloud service provider
   • CIt must be reviewed and approved by senior management and communicated to all relevant stakeholders
   • DIt must be updated annually without exception
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's cloud application collects user location data. The company's privacy policy states that users must be informed about data collection and must provide explicit consent. The development team wants to collect location data in the background without user interaction. Which action should the security team take?

   • ARequire the application to display a consent prompt before collecting location data
   • BAnonymize location data before storing it
   • CCollect location data only when the application is actively in use
   • DAllow background collection but add a note in the privacy policy
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's cloud application collects user data and must comply with GDPR. The company wants to implement a process for user consent. Which practice is most aligned with GDPR requirements?

   • AUse pre-checked boxes to obtain consent.
   • BObtain consent once and never ask again.
   • CAssume consent is given if users do not opt out.
   • DObtain explicit, informed, and unambiguous consent from users before processing their data, and allow them to withdraw consent at any time.
   Reveal Solution Discussion Select an answer first