Articulate Legal Requirements and Unique Risks Within the Cloud Environment CCSP Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A security incident occurs in a cloud environment, and the organization needs to conduct a forensic investigation. The data is stored across multiple regions, and the organization must ensure the investigation is legally defensible. Which of the following is the most important consideration when collecting forensic evidence from the cloud?

   • ARely on the cloud provider to conduct the forensic investigation on behalf of the organization.
   • BEnsure the collection process follows a documented, repeatable methodology that preserves the integrity and chain of custody of the evidence.
   • CUse the cloud provider's built-in logging and monitoring tools as the sole source of evidence.
   • DCollect evidence as quickly as possible, even if it means disrupting the availability of the service.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is planning to use a cloud provider to process personal data of EU citizens. The company's legal team wants to ensure compliance with GDPR. Which of the following is a key requirement that the company must fulfill?

   • AThe company must sign a data processing agreement (DPA) with the cloud provider.
   • BThe company must obtain explicit consent from each data subject before using a cloud provider.
   • CThe company must ensure that the cloud provider is located in the EU.
   • DThe company must ensure that the cloud provider is certified under ISO/IEC 27001.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A multinational company stores customer data in a cloud region located in Country A. The company's headquarters in Country B receives a lawful request from Country B's authorities to access that data. Country A's laws prohibit the transfer of such data outside its borders. What is the primary compliance challenge illustrated by this scenario?

   • AThe cloud provider is solely responsible for resolving the conflict because it controls the infrastructure.
   • BThe cloud provider must immediately comply with the request from Country B because the customer is headquartered there.
   • CThe company faces conflicting legal obligations because the laws of Country A and Country B impose contradictory requirements on the same data.
   • DThe company can avoid the conflict by moving the data to a different cloud region within Country B.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational company uses a cloud provider that stores data in multiple jurisdictions. The company is subject to a data protection law in one country that requires data to be stored locally, and a law in another country that requires data to be accessible for law enforcement. The company is considering a new service that would replicate data across regions. What is the most significant legal challenge the company must address?

   • AThe company must delete all data after a certain period to avoid legal conflicts.
   • BThe company must store all replicated data in the same country to avoid legal conflicts.
   • CThe company must ensure that replication does not violate the data localization law while also complying with the law enforcement access requirement.
   • DThe company must obtain consent from all data subjects before replicating data.
   Reveal Solution Discussion Select an answer first