Cloud Security Standards CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A hospital is moving its electronic health records (EHR) system to a cloud provider. The hospital must comply with HIPAA. The hospital's compliance officer is reviewing the Business Associate Agreement (BAA) with the cloud provider. What is the primary purpose of the BAA in this context?

   • ATo allow the cloud provider to use PHI for its own marketing purposes
   • BTo transfer all liability for HIPAA violations to the cloud provider
   • CTo ensure the cloud provider agrees to safeguard protected health information (PHI) and use it only as permitted by the hospital
   • DTo certify that the cloud provider is compliant with all HIPAA requirements
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A cloud architect is designing a system for a government agency that must comply with NIST SP 800-210. The system will use a public cloud provider. The architect needs to ensure that access control policies are implemented correctly. The architect is considering using attribute-based access control (ABAC) to meet the NIST requirements. What is a key consideration when implementing ABAC in a public cloud environment?

   • AABAC policies are only applicable to on-premises systems.
   • BABAC policies do not need to be tested for effectiveness.
   • CABAC policies must be consistently enforced across all cloud services and resources.
   • DABAC policies are automatically enforced by the cloud provider without customer configuration.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following standards explicitly incorporates the shared responsibility model in its guidance?

   • AISO/IEC 27001
   • BISO/IEC 27017
   • CGDPR
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A U.S. federal agency is evaluating a cloud service for storing sensitive but unclassified data. The agency requires a standardized security assessment that is recognized across federal agencies and that includes continuous monitoring. Which framework or program should the cloud service provider use to meet this requirement?

   • ASOC 2 Type I
   • BFedRAMP
   • CISO/IEC 27017
   • DCSA CCM
   Reveal Solution Discussion Select an answer first
6. 15expert · hard · select all that apply

   A compliance team is developing a control mapping for a cloud-based system that processes both cardholder data and EU personal data. The team needs to align its controls with PCI DSS, GDPR, and SOC 2. Which of the following actions are appropriate for the control mapping process? (Select all that apply.)

   • ARely solely on the cloud provider's SOC 2 report to cover all customer controls
   • BIgnore GDPR because PCI DSS already covers data protection
   • CDocument the mapping in a matrix that shows the relationship between each control and the framework requirements
   • DUse the CSA CCM to identify cloud-specific controls that map to PCI DSS and GDPR
   • ECreate a single control that satisfies requirements from all three frameworks
   Check answers Discussion Select an answer first