A company is using a cloud provider for its critical applications. The provider has been acquired by a larger company, and there are rumors of significant restructuring. The company's risk manager is concerned about the provider's continued viability and the potential for service disruption. The current contract does not have a data escrow arrangement. What is the MOST prudent action for the company to take?

Increase the frequency of audits of the provider

Immediately begin migrating to a different cloud provider

Negotiate a data escrow agreement with the provider

Rely on the provider's assurances that the acquisition will not affect services

A company is ending its contract with a cloud provider. The contract includes a termination clause that requires the provider to return all customer data in a specific format within 30 days. The company is concerned that the provider might not comply or might delay the process. Which additional provision would BEST strengthen the company's position in the event of a dispute?

A clause that requires the provider to provide a certificate of data destruction

A clause specifying the governing law and jurisdiction for disputes

A clause that allows the company to withhold final payment until data is returned

A clause that requires the provider to delete all data after a certain period

How do cloud contracts typically address compliance requirements?

By excluding any mention of compliance to avoid liability

By requiring the provider to guarantee no security breaches

By stating that the customer is solely responsible for all compliance

By including clauses that require the provider to maintain specific certifications and comply with applicable laws and regulations

A company in the European Union is contracting with a US-based cloud provider to process personal data of EU citizens. The company's legal team is concerned about compliance with GDPR, specifically regarding international data transfers. Which contractual mechanism is MOST appropriate to address this concern?

Including Standard Contractual Clauses (SCCs) in the contract

Requiring the provider to store all data within the EU

Requiring the provider to obtain Privacy Shield certification

What is the primary role of metrics in a cloud contract?

To provide a basis for measuring service performance and determining whether SLAs are met

To provide marketing data for the provider

To increase the cost of the service

To replace the need for a service level agreement

Certified Cloud Security Professional

Domain 6Objective 5

Understand Outsourcing and Cloud Contract Design CCSP Practice Questions (Page 3)

Part of the Legal, Risk and Compliance domain, which accounts for 13% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

13%of the exam

12 Concepts in This Objective

Business Requirements in Cloud Contracts
Vendor Assessments
Vendor Lock-in Risks
Vendor Viability and Escrow
Right to Audit
Contract Metrics and Definitions
Termination and Litigation
Assurance and Compliance in Contracts
Access to Cloud and Data
Cyber Risk Insurance
Data Ownership and Security Requirements
Supply-Chain Management in Cloud

Questions 11–15

11expert · hard
A company is using a cloud provider for its critical applications. The provider has been acquired by a larger company, and there are rumors of significant restructuring. The company's risk manager is concerned about the provider's continued viability and the potential for service disruption. The current contract does not have a data escrow arrangement. What is the MOST prudent action for the company to take?
Select an answer first
12application · medium
A company is ending its contract with a cloud provider. The contract includes a termination clause that requires the provider to return all customer data in a specific format within 30 days. The company is concerned that the provider might not comply or might delay the process. Which additional provision would BEST strengthen the company's position in the event of a dispute?
Select an answer first
13foundation · easy
How do cloud contracts typically address compliance requirements?
Select an answer first
14application · medium
A company in the European Union is contracting with a US-based cloud provider to process personal data of EU citizens. The company's legal team is concerned about compliance with GDPR, specifically regarding international data transfers. Which contractual mechanism is MOST appropriate to address this concern?
Select an answer first
15foundation · easy
What is the primary role of metrics in a cloud contract?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Understand Outsourcing and Cloud Contract Design CCSP Practice Questions (Page 3)

Questions 11–15

How do cloud contracts typically address compliance requirements?

What is the primary role of metrics in a cloud contract?

Keep studying — Legal, Risk and Compliance