Evaluate Cloud Service Providers (CSP) CCSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A cloud provider is offering a new database service that includes encryption at rest. The provider claims that the encryption module is FIPS 140-2 Level 2 validated and the database software is Common Criteria EAL4 certified. A customer requires that the encryption module provide tamper-evident physical security. Does the provider's claim meet this requirement?

   • ANo, because FIPS 140-2 Level 2 does not include physical security
   • BYes, because FIPS 140-2 Level 2 includes tamper-evident physical security
   • CNo, because the customer requires Level 3
   • DYes, because Common Criteria EAL4 provides tamper-evident physical security
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A cloud provider is implementing a new hardware security module (HSM) to protect encryption keys for its customers. The provider must ensure the HSM meets federal standards for cryptographic modules. Which certification should the provider require for the HSM?

   • AFIPS 140-2
   • BSOC 2 Type II
   • CCommon Criteria EAL4
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a common method for verifying a cloud service provider's compliance?

   • AAssuming compliance based on the provider's size
   • BReviewing the provider's certification reports
   • CAccepting the provider's verbal assurances
   • DUsing the provider's own self-assessment without review
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary focus of FIPS 140-2?

   • AData residency requirements for cloud providers
   • BNetwork security protocols for internet communication
   • CPerformance benchmarks for cloud storage systems
   • DSecurity requirements for cryptographic modules
   Reveal Solution Discussion Select an answer first
6. 10expert · hard · select all that apply

   A company is evaluating cloud providers for a new analytics platform that will process sensitive financial data. The company has the following requirements: (1) compliance with SOX, (2) high availability with a 99.95% uptime SLA, and (3) the ability to perform regular security assessments. Which criteria should be included in the evaluation? (Select all that apply.)

   • ASOC 1 Type II report
   • BProvider's ability to support third-party penetration testing
   • CProvider's marketing materials
   • DSLA with a 99.95% uptime guarantee
   • ENumber of data centers in the provider's portfolio
   Check answers Discussion Select an answer first