Cloud Security Standards CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A cloud service provider is seeking FedRAMP authorization for its SaaS offering. The provider has implemented security controls based on NIST SP 800-53. What is the primary purpose of the FedRAMP authorization process for the provider?

   • ATo replace the need for any other security certifications
   • BTo provide a marketing badge for the provider's website
   • CTo provide a standardized security assessment that can be reused by multiple federal agencies
   • DTo ensure the provider's cloud service is compliant with GDPR
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A cloud service provider wants to sell its SaaS offering to multiple U.S. federal agencies. To avoid each agency conducting its own separate security assessment, the provider wants a single authorization that can be reused. Which program should the provider pursue?

   • ASOC 2 Type II
   • BPCI DSS compliance
   • CFedRAMP
   • DISO/IEC 27001 certification
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes how the CSA CCM can be used?

   • ATo automatically enforce security controls in a cloud environment
   • BTo map security controls to compliance requirements and assess cloud provider capabilities
   • CTo replace an organization's internal security policies
   • DTo provide a certification for cloud service providers
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In a cloud environment, who is typically responsible for securing the hypervisor under the PCI DSS shared responsibility model?

   • AThe cloud service provider
   • BThe cloud customer
   • CBoth provider and customer equally
   • DA third-party auditor
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security auditor is using the CSA Cloud Controls Matrix (CCM) to assess a cloud provider's controls. The auditor needs to map the provider's controls to both SOC 2 Trust Services Criteria and ISO/IEC 27001. The auditor finds that a specific control in the CCM maps to multiple criteria in both frameworks. What is the most efficient way for the auditor to document this mapping?

   • ACreate a custom spreadsheet to manually map each control to both frameworks.
   • BUse ISO/IEC 27001 as the primary mapping and ignore SOC 2.
   • CUse the SOC 2 TSC as the primary mapping and ignore ISO/IEC 27001.
   • DUse the CCM's built-in cross-reference tables to document the mapping to both frameworks.
   Reveal Solution Discussion Select an answer first