Cloud Security Standards CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security architect is designing a cloud governance program and needs to select a set of standards that provide both a controls framework and implementation guidance. The architect wants to use a framework that is cloud-specific and can be mapped to multiple compliance regimes. Which combination of standards best meets this need?

   • AISO/IEC 27001 and ISO/IEC 27002
   • BFedRAMP and HIPAA
   • CCSA CCM and NIST SP 800-144
   • DSOC 2 and PCI DSS
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is planning to process credit card transactions in a public cloud. The company's compliance team is reviewing the PCI DSS requirements and is confused about which responsibilities belong to the cloud provider and which belong to the company. The provider has a PCI DSS AoC and offers a managed database service. The company will store cardholder data in that database. Which of the following is the company's responsibility?

   • AObtaining a PCI DSS AoC for the entire cloud environment
   • BEnsuring the physical security of the data center
   • CConfiguring database access controls and encryption settings
   • DPatching the database software
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a framework that provides a set of security controls and best practices specifically for cloud computing, developed by a consortium of industry experts?

   • ACSA Cloud Controls Matrix (CCM)
   • BCOBIT 2019
   • CNIST Cybersecurity Framework
   • DITIL 4
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a widely recognized cloud-specific security standard that provides guidance on information security controls for cloud service providers and customers?

   • AISO/IEC 27001
   • BISO/IEC 27002
   • CISO/IEC 27005
   • DISO/IEC 27017
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of mapping cloud security standards to organizational controls?

   • ATo eliminate the need for audits
   • BTo automatically enforce all security controls
   • CTo replace all internal security policies with external standards
   • DTo identify gaps and ensure compliance with multiple frameworks
   Reveal Solution Discussion Select an answer first