A cloud service provider (CSP) operates in a country that has enacted a law requiring government access to data stored within its borders. The CSP also serves customers in the EU, who are subject to GDPR. A customer's data is stored in the CSP's data center in the country with the access law. What is the most significant legal risk for the CSP?

The CSP may be forced to disclose data to the government, potentially violating GDPR's restrictions on transfers.

The CSP must delete all data after a certain period to avoid government access.

The CSP must ensure that all data is encrypted so that the government cannot access it.

The CSP must obtain consent from each customer before storing data in that country.

A company is considering moving its customer database to a public cloud. The database contains personal data of individuals from multiple countries. Which of the following is a legal risk specific to cloud computing that the company should evaluate?

The cloud provider is legally responsible for all compliance obligations of the customer.

The cloud provider may use the data for its own marketing purposes without restriction.

The company must obtain a court order before storing any personal data in the cloud.

The data may be subject to the laws of the country where the cloud servers are physically located, which may differ from the laws of the company's home country.

In cloud forensics, why is it important to follow standards such as ISO/IEC 27037 and the CSA guidance?

To ensure that digital evidence is collected and preserved in a way that maintains its integrity and admissibility in legal proceedings.

To ensure that the cloud provider deletes all logs after the investigation.

To allow investigators to access all data without any legal restrictions.

To guarantee that the cloud provider will be held liable for any security breach.

A forensic investigator is collecting evidence from a cloud-based application that is hosted in a multi-tenant environment. The investigator needs to ensure that the evidence is admissible in court. Which of the following is the most critical factor to consider?

The investigator must collect evidence from all tenants in the multi-tenant environment to ensure completeness.

The investigator must use the cloud provider's forensic tools to collect evidence.

The investigator must shut down the application before collecting evidence to prevent data loss.

The investigator must document the entire collection process and maintain a chain of custody.

Certified Cloud Security Professional

Domain 6Objective 1

Articulate Legal Requirements and Unique Risks Within the Cloud Environment CCSP Practice Questions (Page 1)

Part of the Legal, Risk and Compliance domain, which accounts for 13% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

13%of the exam

Questions 1–5

1application · medium
A cloud service provider (CSP) operates in a country that has enacted a law requiring government access to data stored within its borders. The CSP also serves customers in the EU, who are subject to GDPR. A customer's data is stored in the CSP's data center in the country with the access law. What is the most significant legal risk for the CSP?
Select an answer first
2foundation · easy
A company is considering moving its customer database to a public cloud. The database contains personal data of individuals from multiple countries. Which of the following is a legal risk specific to cloud computing that the company should evaluate?
Select an answer first
3foundation · easy
In cloud forensics, why is it important to follow standards such as ISO/IEC 27037 and the CSA guidance?
Select an answer first
4expert · hard
A forensic investigator is collecting evidence from a cloud-based application that is hosted in a multi-tenant environment. The investigator needs to ensure that the evidence is admissible in court. Which of the following is the most critical factor to consider?
Select an answer first
5foundation · easy
Which standard provides guidance for the identification, preservation, collection, processing, review, analysis, and production of electronically stored information (ESI) in legal proceedings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Articulate Legal Requirements and Unique Risks Within the Cloud Environment CCSP Practice Questions (Page 1)

Questions 1–5

A company is considering moving its customer database to a public cloud. The database contains personal data of individuals from multiple countries. Which of the following is a legal risk specific to cloud computing that the company should evaluate?

In cloud forensics, why is it important to follow standards such as ISO/IEC 27037 and the CSA guidance?

A forensic investigator is collecting evidence from a cloud-based application that is hosted in a multi-tenant environment. The investigator needs to ensure that the evidence is admissible in court. Which of the following is the most critical factor to consider?

Which standard provides guidance for the identification, preservation, collection, processing, review, analysis, and production of electronically stored information (ESI) in legal proceedings?

Keep studying — Legal, Risk and Compliance