Cloud Security Standards CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Under the GDPR, what is the primary mechanism for transferring personal data from the EU to a cloud provider in a third country without an adequacy decision?

   • AA memorandum of understanding
   • BA data processing agreement
   • CStandard contractual clauses (SCCs)
   • DA business associate agreement
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary role of FedRAMP?

   • ATo certify cloud service providers for commercial use
   • BTo define cloud computing terminology for the U.S. government
   • CTo standardize the security assessment, authorization, and continuous monitoring of cloud services used by U.S. federal agencies
   • DTo provide a framework for cloud service level agreements
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A cloud-based telehealth platform stores electronic protected health information (ePHI) for U.S. patients. The platform uses a public cloud provider that offers a HIPAA-compliant environment. The platform's security team wants to ensure that ePHI is protected according to HIPAA requirements. Which of the following is a required action for the platform?

   • AEnsure the provider has a SOC 2 Type II report
   • BConfigure the platform to store ePHI only in the United States
   • CObtain ISO/IEC 27018 certification for the platform
   • DSign a Business Associate Agreement (BAA) with the cloud provider
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A retail company is planning to process credit card payments using a cloud-based payment gateway. The company must comply with PCI DSS. The company's security team is defining the responsibilities for securing the cardholder data environment (CDE) in the cloud. Which of the following is a responsibility of the company (the customer) under the shared responsibility model for PCI DSS compliance?

   • AManaging the hardware lifecycle of the cloud servers
   • BPatching the hypervisor that hosts the virtual machines
   • CConfiguring network firewalls and access controls within the cloud environment
   • DPhysically securing the data centers where the cloud infrastructure is hosted
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is moving its cardholder data environment (CDE) to a public cloud IaaS platform. The cloud provider is PCI DSS compliant and provides a firewall service, but the company must ensure that its own configuration meets PCI DSS requirements. The company's security team is small and wants to minimize the risk of misconfiguration while maintaining control over the CDE. What is the most appropriate approach?

   • ARely on the provider's PCI DSS compliance to cover all firewall requirements
   • BAsk the provider to manage the firewall rules on behalf of the company
   • CUse the provider's managed firewall service and configure strict rules, while regularly reviewing firewall logs and change requests
   • DDeploy a third-party virtual firewall and disable the provider's firewall service to avoid overlapping rules
   Reveal Solution Discussion Select an answer first