Evaluate Cloud Service Providers (CSP) CCSP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A government agency is evaluating a cloud-based email encryption product. The product has a Common Criteria certificate at EAL4. The agency also requires that the cryptographic module used for encryption be validated at FIPS 140-2 Level 2. The product's documentation shows that the cryptographic module is FIPS 140-2 Level 1 validated. What should the agency do?

   • AAccept the product because FIPS 140-2 Level 1 is sufficient for email encryption
   • BRequest a new Common Criteria evaluation at a higher EAL
   • CReject the product because it does not meet the FIPS 140-2 Level 2 requirement
   • DAccept the product because EAL4 is higher than FIPS 140-2 Level 2
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which certification report provides assurance about a service provider's controls relevant to security, availability, processing integrity, confidentiality, or privacy?

   • ACommon Criteria
   • BISO 27001
   • CSOC 2
   • DFedRAMP
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of evaluating a cloud service provider against predefined criteria?

   • ATo guarantee that the provider will never experience a security breach
   • BTo ensure the provider's services meet the organization's security, compliance, performance, and cost requirements
   • CTo comply with a legal requirement that all cloud providers be evaluated annually
   • DTo select the provider with the lowest possible cost regardless of other factors
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is part of verifying a cloud service provider against predefined criteria?

   • AAssuming the provider is secure because it is a large, well-known company
   • BReviewing the provider's security certifications and audit reports
   • CDeferring the evaluation to the provider's own self-assessment without review
   • DSelecting the provider based solely on marketing materials
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is evaluating a cloud provider that has an ISO 27001 certificate and a SOC 2 Type II report. The company's security team wants to verify that the provider's controls are effective for the specific services they plan to use. The SOC 2 report includes a description of the system and the trust services criteria. What should the company do to ensure the report is applicable to their intended use?

   • ARequest a new SOC 2 report from the provider
   • BReview the system description in the SOC 2 report to confirm it covers the services they plan to use
   • CAccept the report without review because it is a Type II report
   • DRely on the ISO 27001 certificate because it covers all services
   Reveal Solution Discussion Select an answer first