Standards, Policies, and Legal Issues in Cloud CCSE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A retail company uses a cloud-based marketing platform to send promotional emails. The platform stores customer email addresses and purchase history. The company's privacy policy states that customer data will be retained for no longer than 24 months after the last purchase. The marketing team wants to keep data indefinitely for future campaigns. The security team must enforce the retention policy. Which control should the security team implement?

   • ARequest that the marketing team manually delete records older than 24 months on a quarterly basis
   • BAnonymize customer data after 24 months instead of deleting it
   • CConfigure the cloud platform's data lifecycle management to automatically delete customer records 24 months after the last purchase
   • DEncrypt all customer data and store encryption keys separately
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A healthcare organization uses a cloud-based electronic health record (EHR) system. The organization is subject to HIPAA and must sign a Business Associate Agreement (BAA) with the cloud provider. The provider's standard BAA includes a clause that limits the provider's liability to the amount paid by the organization in the preceding 12 months. The organization's legal team believes this limitation is too low. What is the most appropriate action?

   • ASign the BAA but purchase cyber insurance to cover potential losses
   • BAccept the BAA because HIPAA requires the provider to sign a BAA, and the liability limit is standard
   • CSelect a different provider that does not require a BAA
   • DNegotiate for a higher liability limit or an exception for breaches caused by the provider's negligence
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A cloud-based SaaS application processes credit card payments for an e-commerce company. The company is subject to PCI DSS. The SaaS provider handles the payment processing but the company retains control over the application configuration and access. Which party is responsible for the security of the cardholder data environment in this shared responsibility model?

   • AThe SaaS provider is responsible for all PCI DSS requirements because it processes the payments
   • BThe payment card brands are responsible for enforcing PCI DSS compliance
   • CBoth the company and the SaaS provider share responsibility based on their control over the cardholder data environment
   • DThe company is responsible for all PCI DSS requirements because it owns the business relationship with its customers
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is developing a cloud security policy for a new multi-cloud environment. The policy must align with the organization's risk appetite and comply with GDPR and PCI DSS. Which approach is most effective for developing this policy?

   • ADelegate policy development entirely to the cloud service provider.
   • BAdopt a generic cloud security policy template from a standards body without modification.
   • CStart with a risk assessment to identify cloud-specific risks, then draft policies that address those risks and map to relevant compliance requirements.
   • DFocus only on technical controls and ignore legal and regulatory requirements.
   Reveal Solution Discussion Select an answer first