A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The organization must comply with HIPAA. The cloud provider offers a HIPAA-eligible infrastructure but does not sign a business associate agreement (BAA). The organization's compliance officer asks the cloud architect to ensure the deployment is compliant. What should the architect do first?

Configure encryption for the EHR data at rest and in transit.

Implement access controls and audit logging on the cloud resources.

Sign the provider's standard cloud agreement and rely on the provider's security certifications.

Select a different cloud provider that is willing to sign a BAA.

A company is creating an acceptable use policy (AUP) for its cloud services. The policy must prevent employees from uploading sensitive data to unsanctioned cloud applications. Which control is most effective to enforce this policy?

Implement a cloud access security broker (CASB) that monitors and blocks unauthorized data uploads.

Disable all cloud storage services for employees.

Require employees to sign the AUP annually.

Rely on the cloud provider to block unauthorized uploads.

EC-CouncilCloud Security Essentials

Domain 8Objective 3

Cloud Security Governance and Risk Management CSE Practice Questions (Page 10)

Part of the Cloud Compliance and Governance domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

8 Concepts in This Objective

Cloud Security Governance Framework
Cloud Risk Management Process
Cloud Compliance Standards and Regulations
Shared Responsibility Model in Governance
Cloud Policy and Procedure Development
Risk Assessment Methods for Cloud
Cloud Risk Mitigation Strategies
Continuous Monitoring and Improvement

Questions 46–49

46application · medium
A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The organization must comply with HIPAA. The cloud provider offers a HIPAA-eligible infrastructure but does not sign a business associate agreement (BAA). The organization's compliance officer asks the cloud architect to ensure the deployment is compliant. What should the architect do first?
Select an answer first
47application · medium
A company is creating an acceptable use policy (AUP) for its cloud services. The policy must prevent employees from uploading sensitive data to unsanctioned cloud applications. Which control is most effective to enforce this policy?
Select an answer first
48foundation · easy
Which regulation specifically addresses the protection of personal data of individuals in the European Union?
Select an answer first
49foundation · easy
Which risk mitigation strategy involves transferring the financial impact of a risk to another party?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud Security Governance and Risk Management CSE Practice Questions (Page 10)

Questions 46–49

A company is creating an acceptable use policy (AUP) for its cloud services. The policy must prevent employees from uploading sensitive data to unsanctioned cloud applications. Which control is most effective to enforce this policy?

Which regulation specifically addresses the protection of personal data of individuals in the European Union?

Which risk mitigation strategy involves transferring the financial impact of a risk to another party?

Keep studying — Cloud Compliance and Governance