Cloud Security Standards CSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A cloud service provider is implementing ISO/IEC 27017 and needs to define the responsibilities for implementing specific controls. The provider and a customer are negotiating a contract. The customer wants the provider to be responsible for implementing all controls related to the customer's data, including access controls and encryption. The provider argues that some controls are the customer's responsibility. Which of the following controls is most likely the customer's responsibility under ISO/IEC 27017?

   • AImplementing network security controls for the provider's infrastructure
   • BImplementing user access management for the customer's own users
   • CImplementing logging and monitoring for the provider's cloud platform
   • DImplementing physical security controls in the provider's data centers
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which NIST publication provides guidelines on security and privacy in public cloud computing?

   • ANIST SP 800-53
   • BNIST SP 800-145
   • CNIST SP 800-144
   • DNIST SP 800-30
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is using a public cloud SaaS application to process customer PII. The SaaS provider is ISO/IEC 27017 and ISO/IEC 27018 certified. The company's compliance officer wants to know which security controls the company is still responsible for implementing. Which of the following is the company's responsibility?

   • AManaging user access and authentication policies for its employees using the SaaS application
   • BConfiguring the network firewalls for the application
   • CEnsuring physical security of the data center
   • DPatching the underlying application software
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a trust service criterion that focuses on the protection of information from unauthorized disclosure?

   • AConfidentiality
   • BProcessing Integrity
   • CPrivacy
   • DAvailability
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A U.S.-based health app startup stores electronic protected health information (ePHI) in a public cloud. The startup has signed a Business Associate Agreement (BAA) with the cloud provider. The startup's compliance officer wants to ensure that all ePHI is encrypted at rest and in transit, and that access is logged. The cloud provider offers encryption by default and logging, but the startup must configure its own database to use encryption. What is the most accurate statement regarding the startup's compliance with HIPAA?

   • AThe provider's default encryption and logging satisfy all HIPAA requirements without further action
   • BHIPAA does not require encryption if the data is stored in a certified cloud
   • CThe startup is responsible for configuring encryption on its database and ensuring that access logs are enabled and reviewed
   • DThe BAA transfers all HIPAA security responsibilities to the cloud provider
   Reveal Solution Discussion Select an answer first