Articulate Legal Requirements and Unique Risks Within the Cloud Environment CCSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which legal framework is specifically designed to protect the personal data of individuals within the European Union and regulates the transfer of personal data outside the EU?

   • ACSA Security Guidance
   • BGDPR
   • CISO/IEC 27001
   • DHIPAA
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A cloud service provider (CSP) operates data centers in multiple countries. A customer's data is stored in a country that has enacted a data localization law requiring that certain data remain within its borders. The customer is a global company subject to the GDPR. The CSP is considering offering a new service that would replicate data across regions for disaster recovery. What is the most significant legal challenge the CSP must address?

   • AThe CSP must obtain explicit consent from every data subject before replicating data across borders.
   • BThe CSP must ensure that replication does not violate the data localization law while also complying with GDPR's requirements for cross-border transfers.
   • CThe CSP must delete all data after a certain period to avoid legal conflicts.
   • DThe CSP must store all replicated data in the same country to avoid GDPR penalties.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is evaluating a cloud provider for a new application that will process personal data of EU citizens. The provider offers data centers in the EU, but the company's headquarters is in a non-EU country. Which of the following is a key legal requirement the company must address?

   • AThe company must sign a data processing agreement (DPA) with the cloud provider, and ensure that any transfer of personal data outside the EU is covered by an appropriate mechanism.
   • BThe company must obtain consent from each data subject before using a cloud provider.
   • CThe company must store all personal data on-premises to avoid GDPR obligations.
   • DThe company must ensure that the cloud provider is certified under the EU-US Data Privacy Framework.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a legal risk that is particularly associated with multi-tenancy in a public cloud environment?

   • AThe cloud provider may accidentally delete all tenant data during a routine backup.
   • BMulti-tenancy eliminates the need for the customer to comply with data protection laws.
   • CMulti-tenancy automatically makes the cloud provider the legal owner of all tenant data.
   • DOne tenant's legal obligation to produce data in a lawsuit may require the provider to access shared infrastructure that also holds another tenant's data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational corporation with headquarters in Germany and a subsidiary in the United States uses a cloud provider that stores data in both the EU and the US. A US court issues a subpoena for data stored in the EU region. The company's legal team is concerned about conflicting obligations under the GDPR and US law. What is the most appropriate first step for the company to take?

   • AComply with the US subpoena immediately to avoid contempt of court, as the data is accessible from the US.
   • BSeek legal advice to evaluate the conflict, consider available legal mechanisms (e.g., mutual legal assistance treaties), and determine if a valid legal basis exists for the transfer.
   • CTransfer the data to the US immediately but pseudonymize it to reduce GDPR risk.
   • DRefuse to comply with the US subpoena entirely, citing GDPR as an absolute bar to any data transfer.
   Reveal Solution Discussion Select an answer first