Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment CCSP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which compliance framework is specifically relevant to healthcare organizations using cloud services?

   • ANERC CIP
   • BHIPAA
   • CSOX
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary difference between organizational, functional, and cloud computing policies?

   • AOrganizational policies are voluntary, functional policies are mandatory, and cloud computing policies are recommended.
   • BOrganizational policies are only for external stakeholders, functional policies are for internal staff, and cloud computing policies are for the cloud provider.
   • COrganizational policies are high-level and apply to the entire organization, functional policies are specific to business functions, and cloud computing policies address cloud-specific risks and requirements.
   • DOrganizational policies are written by the board of directors, functional policies are written by IT, and cloud computing policies are written by the cloud provider.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A cloud provider offers a multi-tenant platform where customers share the same physical infrastructure. An auditor is assessing the provider's controls for tenant isolation. The provider's SOC 2 report includes a description of the hypervisor and its security features, but the scope statement excludes the hypervisor from the audit. The auditor's client, a tenant, wants to know if the report provides assurance that their data is isolated from other tenants. What is the most appropriate response?

   • AInform the client that the SOC 2 report is sufficient because the description of the hypervisor demonstrates its security.
   • BExplain that the report does not provide assurance over the hypervisor, and recommend the client obtain additional assurance, such as a provider attestation or a separate audit of the hypervisor.
   • CRecommend the client conduct their own penetration test of the hypervisor to gain assurance.
   • DAdvise the client to rely on the provider's marketing materials about hypervisor security.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A utility company is migrating its operational technology (OT) systems to a cloud environment. The company must comply with NERC CIP regulations. The compliance officer is concerned about the cloud provider's ability to meet NERC CIP requirements, which include specific controls for physical security and electronic access. Which of the following is the most appropriate approach?

   • ARely on the provider's SOC 2 report, as it covers all security controls required by NERC CIP.
   • BWork with the provider to establish a shared responsibility model that clearly defines which NERC CIP controls are the provider's responsibility and which are the company's, and obtain a NERC CIP-specific audit or attestation from the provider.
   • CAvoid using the cloud for OT systems and keep all systems on-premises to ensure NERC CIP compliance.
   • DRequire the provider to sign a contract stating they are fully responsible for all NERC CIP compliance.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a specialized compliance requirement for a highly-regulated industry in a cloud environment?

   • ASOC 2 reports for all cloud customers.
   • BNERC CIP requirements for the energy sector.
   • CISO 27001 certification for all cloud providers.
   • DGDPR compliance for all cloud providers.
   Reveal Solution Discussion Select an answer first