Evaluate Cloud Service Providers (CSP) CCSP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A defense contractor is evaluating a cloud-based virtual machine monitor (hypervisor) for a classified workload. The contractor requires a product certification that provides assurance that the hypervisor's security functions are correctly implemented and that the product has been evaluated against a specific Protection Profile. The contractor also needs to compare the level of assurance between two products. Which framework and concept should the contractor use?

   • ASOC 2 Type II report
   • BFIPS 140-2 security levels
   • CCommon Criteria with Evaluation Assurance Levels (EALs)
   • DISO 27001 certification
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which method is used to verify a cloud service provider's compliance with security standards?

   • AConducting an independent third-party audit
   • BRelying solely on the provider's marketing claims
   • CChecking the provider's website for security badges
   • DReviewing the provider's internal employee handbook
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A cloud provider is designing a new key management service (KMS) for a government customer. The customer requires that the cryptographic module protecting the master keys be validated at FIPS 140-2 Level 3 or higher. The provider is considering two modules: Module A is validated at Level 3, and Module B is validated at Level 2. The provider also has a Common Criteria EAL4 certificate for the KMS software. Which module should the provider use to meet the customer's requirement?

   • AModule B, because Level 2 is sufficient for most government workloads
   • BModule A, because it meets the Level 3 requirement
   • CEither module, because the Common Criteria EAL4 certificate overrides FIPS levels
   • DModule B, because Level 2 is more cost-effective
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is evaluating a cloud provider that has a SOC 2 Type II report with a qualified opinion. The qualification is due to a control deficiency in the area of access management. The company's application will handle sensitive customer data, and the company requires strong access controls. What should the company do?

   • AReject the provider because any qualification is unacceptable
   • BAccept the report because it is a Type II report
   • CAnalyze the deficiency to determine if it impacts the company's requirements
   • DRequest a SOC 1 report instead
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A cloud provider has obtained a FedRAMP authorization at the Moderate impact level. A prospective customer, a federal agency, is considering using the provider for a system that will process data at the High impact level. What should the agency do?

   • AAccept the Moderate authorization because it is a FedRAMP authorization
   • BRequest a SOC 2 Type II report instead
   • CUse the Moderate authorization and implement compensating controls
   • DRequire the provider to obtain a FedRAMP High authorization
   Reveal Solution Discussion Select an answer first