Cloud Security Standards CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A cloud provider is seeking ISO/IEC 27018 certification. The provider's legal team is concerned about the requirement to disclose the use of subcontractors that may process PII. The provider uses a third-party analytics service that processes PII. The provider's contract with the customer states that the provider will not use subcontractors without the customer's consent. The provider's legal team wants to ensure compliance with ISO/IEC 27018. What should the provider do?

   • AUse the subcontractor without notifying the customer, as the provider is responsible for PII protection.
   • BInclude a clause in the contract that the provider is not responsible for subcontractor actions.
   • CTerminate the contract with the subcontractor and process all analytics in-house.
   • DObtain the customer's consent before engaging the subcontractor and ensure the subcontractor agrees to the same PII protection obligations.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A compliance team is mapping its cloud security controls to multiple frameworks for an upcoming audit. The team has implemented a control that requires quarterly access reviews of cloud administrators. This control is relevant to ISO/IEC 27001, SOC 2, and the CSA CCM. The team wants to document the mapping efficiently and ensure that the control is tested consistently. What is the best approach?

   • AMaintain separate control documentation for each framework to avoid confusion
   • BUse the CSA CCM as the only framework and ignore the others
   • CRely on the cloud provider's SOC 2 report to cover all access review requirements
   • DCreate a control mapping matrix that lists the control and its corresponding requirements in each framework
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational company processes personal data of EU residents in a public cloud. The company's cloud provider stores data in a region outside the EU. The company is considering using Standard Contractual Clauses (SCCs) to legitimize the data transfer. The company's legal team also wants to ensure that the provider's sub-processors are bound by similar obligations. What is the most important additional step the company should take to comply with GDPR?

   • AConduct a transfer impact assessment (TIA) to evaluate the legal protections in the destination country
   • BRely solely on the SCCs because they are approved by the European Commission
   • CEnsure that all sub-processors are listed in the contract
   • DMove the data to an EU-based region to avoid the need for SCCs
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is evaluating a cloud provider that has a SOC 2 Type II report. The company's security team wants to understand whether the provider's controls are effective for the entire period of the report. The SOC 2 Type II report covers a period of 12 months. What should the security team look for in the report to determine if the controls were effective throughout the entire period?

   • AThe auditor's opinion on the operating effectiveness of controls over the specified period.
   • BThe provider's self-assessment of its controls.
   • CThe provider's compliance with ISO/IEC 27001.
   • DThe provider's CSA CCM self-assessment.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key control area addressed by ISO/IEC 27017?

   • ASocial engineering awareness training
   • BCryptographic key management for blockchain
   • CPhysical security of on-premises data centers
   • DVirtualization security
   Reveal Solution Discussion Select an answer first