A security architect is evaluating a cloud service provider for a financial services client. The client requires that the provider's controls be mapped to multiple compliance frameworks, including SOC 2 and ISO/IEC 27001, to streamline audit processes. The architect needs a tool that provides a comprehensive set of cloud-specific controls that can be cross-referenced with these frameworks. Which resource should the architect use?

CSA Cloud Controls Matrix (CCM)

What is the main focus of ISO/IEC 27018?

Protection of personally identifiable information (PII) in public cloud environments

Guidelines for cloud service level agreements

General information security management for all organizations

Security controls for cloud service providers only

When a healthcare organization uses a cloud service provider to store ePHI, what is typically required before the provider can access or process the data?

A data processing agreement under GDPR

A memorandum of understanding with the Department of Health and Human Services

A business associate agreement (BAA)

Which of the following is a key benefit of FedRAMP for cloud service providers?

It eliminates the need for continuous monitoring

A single authorization can be reused by multiple federal agencies

It provides a certification for commercial cloud services

It guarantees compliance with all international regulations

When developing a control mapping for cloud compliance, which of the following is a best practice?

Focus only on technical controls

Involve stakeholders from security, legal, and cloud operations

Map controls only to one primary framework

Create the mapping once and never update it

EC-CouncilCloud Security Essentials

Domain 8Objective 2

Cloud Security Standards CSE Practice Questions (Page 4)

Part of the Cloud Compliance and Governance domain, which makes up ~13% of our current practice bank.

46questions here

10free pages

12concepts

12 Concepts in This Objective

Cloud security standards overview
ISO/IEC 27017
ISO/IEC 27018
CSA Cloud Controls Matrix (CCM)
NIST cloud security standards
SOC 2 for cloud services
PCI DSS in cloud environments
HIPAA and cloud compliance
GDPR and cloud data protection
FedRAMP for government clouds
Shared responsibility model in standards
Mapping standards to organizational controls

Questions 16–20

16application · medium
A security architect is evaluating a cloud service provider for a financial services client. The client requires that the provider's controls be mapped to multiple compliance frameworks, including SOC 2 and ISO/IEC 27001, to streamline audit processes. The architect needs a tool that provides a comprehensive set of cloud-specific controls that can be cross-referenced with these frameworks. Which resource should the architect use?
Select an answer first
17foundation · easy
What is the main focus of ISO/IEC 27018?
Select an answer first
18foundation · easy
When a healthcare organization uses a cloud service provider to store ePHI, what is typically required before the provider can access or process the data?
Select an answer first
19foundation · easy
Which of the following is a key benefit of FedRAMP for cloud service providers?
Select an answer first
20foundation · easy
When developing a control mapping for cloud compliance, which of the following is a best practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.