Manage Communication with Relevant Parties CCSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of establishing a defined communication frequency with a cloud vendor?

   • ATo reduce the vendor's administrative workload by limiting all communication to quarterly reports
   • BTo ensure the vendor's billing cycle aligns with the customer's fiscal year
   • CTo provide a predictable cadence for sharing security updates and operational changes
   • DTo satisfy the customer's internal requirement for weekly status meetings
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regulator requests audit evidence from a company that uses a cloud service. The company's security team needs to respond. What is the most appropriate action?

   • ARefuse the request until the cloud provider confirms the evidence is accurate.
   • BAsk the cloud provider to respond directly to the regulator.
   • CProvide the regulator with direct access to the cloud provider's systems to obtain the evidence.
   • DCollect the relevant evidence from the cloud provider and provide it to the regulator in the required format.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A cloud provider suffers a security incident that affects multiple customers. The provider must communicate with customers, but the incident is still under investigation and details are incomplete. The provider also has regulatory obligations to report the incident. What is the most appropriate approach?

   • ACommunicate only with customers who have signed up for incident notifications.
   • BWait until the investigation is complete before communicating with customers or regulators.
   • CCommunicate preliminary information to customers and regulators, and provide updates as the investigation progresses.
   • DCommunicate only with regulators and let them inform customers.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization and its business partner share a cloud environment for a joint project. The organization's security team detects a new malware variant that appears to target the shared environment. What is the most appropriate action regarding partner communication?

   • AReport the malware to the cloud provider and let them notify the partner.
   • BOnly inform the partner if the malware has actually compromised their systems.
   • CShare the threat intelligence with the partner through the established communication channel.
   • DWait until the malware is fully analyzed before informing the partner to avoid false alarms.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company suffers a data breach involving personal data of customers in multiple jurisdictions. The company's legal team confirms that regulatory notification is required in some jurisdictions but not others. What should the company do?

   • AWait for the cloud provider to notify regulators on the company's behalf.
   • BNotify regulators in all jurisdictions to be safe, even where not required.
   • CNotify regulators only after the investigation is complete, regardless of legal timelines.
   • DNotify only the regulators in jurisdictions where notification is legally required, following the specified timelines.
   Reveal Solution Discussion Select an answer first