Manage Communication with Relevant Parties CCSP Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   An organization is establishing a new partnership that involves sharing a cloud environment. The organization wants to ensure security requirements are aligned. What is the most effective way to communicate security requirements to the partner?

   • ASend the partner a copy of the organization's internal security policies.
   • BInclude security requirements in the partnership agreement and discuss them in initial meetings.
   • CAsk the cloud provider to enforce security requirements on the partner.
   • DWait until a security incident occurs to discuss security requirements.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is planning to migrate a critical application to the cloud. The security team needs to communicate the change to various internal stakeholders. Which communication approach is most effective?

   • AHold a town hall meeting for all employees to explain the migration.
   • BOnly inform the IT department since they will handle the migration.
   • CCommunicate tailored messages to different stakeholder groups, such as IT, legal, and end users.
   • DSend a single email to all employees with technical details of the migration.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which type of information is most appropriate to include in routine, scheduled communications to a cloud vendor?

   • AUpdates to the customer's security contact list and incident escalation procedures
   • BChanges to the customer's regulatory reporting calendar
   • CDetailed internal audit findings about the customer's own financial controls
   • DThe customer's internal employee performance review results
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company experiences a data breach that involves data stored in a cloud environment. The company's legal team is unsure whether the breach must be reported to a specific regulator. The cloud provider has also detected the breach and is planning to notify its own regulators. What should the company do?

   • AAssess the breach against the regulator's criteria and notify if required, while coordinating with the provider to gather necessary details.
   • BNotify the regulator only if the cloud provider confirms that the breach is reportable.
   • CWait for the cloud provider to complete its investigation before deciding whether to notify the regulator.
   • DRely on the cloud provider's notification to satisfy the company's regulatory obligations.
   Reveal Solution Discussion Select an answer first