Evaluate Cloud Service Providers (CSP) CCSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of product certifications for cloud systems and subsystems?

   • ATo validate that the product meets specific security and functionality requirements
   • BTo guarantee the product will be free from all vulnerabilities
   • CTo provide a marketing label without any technical basis
   • DTo replace the need for ongoing security monitoring
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm is evaluating a cloud provider for a new application that will process credit card transactions. The firm's compliance team requires evidence that the provider's controls have been independently assessed against the PCI DSS standard. The provider has provided a letter of attestation of compliance (AoC) from a Qualified Security Assessor (QSA), a SOC 1 report, and a copy of its internal audit plan. Which evidence should the firm accept as the primary proof of PCI DSS compliance?

   • ASOC 1 report
   • BSOC 1 report and internal audit plan together
   • CLetter of attestation of compliance (AoC) from a QSA
   • DInternal audit plan
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A cloud provider is offering a new virtual firewall product. The provider wants to obtain a certification that validates the product's security functions against a standardized set of requirements, including assurance that the product is resistant to tampering. Which certification is most appropriate for this product?

   • AFIPS 140-2
   • BISO 27001
   • CSOC 2
   • DCommon Criteria (CC) with a specific Evaluation Assurance Level (EAL)
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is evaluating two cloud providers for a new application that will process personal data of EU citizens. Provider A has ISO 27001 certification and a SOC 2 Type II report, but its data centers are located only in the US. Provider B has no certifications but offers data residency in the EU and provides a contractual commitment to GDPR compliance. Which provider is more likely to meet the company's GDPR compliance requirements?

   • AProvider A, because ISO 27001 and SOC 2 are strong certifications
   • BBoth are equally compliant because they both offer cloud services
   • CNeither can be compliant because GDPR requires on-premises processing
   • DProvider B, because data residency in the EU is a key GDPR requirement
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a type of criterion used to assess a cloud service provider?

   • AThe number of employees the provider has worldwide
   • BThe provider's marketing budget and advertising reach
   • CThe provider's stock price and financial market performance
   • DService level agreements (SLAs) that define performance and availability expectations
   Reveal Solution Discussion Select an answer first