Manage Communication with Relevant Parties CCSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a common regulatory obligation for a cloud provider regarding data breaches?

   • ATo notify only the affected customers and not any regulator
   • BTo report the breach to the regulator within a specified timeframe
   • CTo publicly disclose the breach on social media before notifying the regulator
   • DTo wait until the investigation is complete before informing any regulator
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company uses a cloud vendor that is planning to change its data center location to a different country. The company has customers in that country and is concerned about data residency requirements. The company also has a business partner that processes data on behalf of the company. What is the most appropriate action?

   • AAsk the vendor to keep the data in the original location to avoid any compliance issues.
   • BInform the company's customers about the location change and ask for their approval.
   • CAssess the impact of the location change on data residency requirements and communicate the findings to relevant stakeholders, including the partner.
   • DImmediately terminate the contract with the vendor to avoid any risk.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A cloud service provider experiences a minor service disruption that does not result in a data breach. The provider's customers include both large enterprises with strict compliance requirements and small businesses. How should the provider communicate this incident?

   • ATailor the communication: provide a brief summary to small businesses and a detailed report with impact analysis to enterprise customers.
   • BOnly notify customers who are contractually required to receive incident notifications.
   • CSend the same detailed incident report to all customers to ensure transparency.
   • DPost the incident details on the provider's public status page and assume all customers will see it.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company receives a regulatory inquiry about a security incident that occurred several months ago. The company's records are incomplete because the incident was not fully documented at the time. The company needs to respond to the inquiry. What is the most appropriate action?

   • AReconstruct the incident details based on memory and provide them to the regulator.
   • BAsk the cloud provider to respond to the regulator on the company's behalf.
   • CRefuse to respond until the documentation is complete.
   • DProvide the regulator with the available information and explain the gaps in documentation.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses a SaaS HR platform. The vendor announces a critical security patch that requires a maintenance window. The company's security team needs to ensure internal stakeholders are informed and the vendor's communication is properly managed. What is the most appropriate action?

   • AAsk the vendor to communicate directly with all employees about the patch and maintenance window.
   • BImmediately block access to the SaaS platform until the patch is applied.
   • CIgnore the vendor's notice because the patch is the vendor's responsibility.
   • DReview the vendor's patch details, assess impact, and coordinate internal communication to relevant stakeholders.
   Reveal Solution Discussion Select an answer first