A company is about to sign a cloud contract and is reviewing the insurance requirements. The company's risk manager wants to ensure that the company is protected against financial losses from a data breach that occurs in the cloud. The vendor's proposed contract states that the vendor is not liable for data breaches. Which action should the company take to address this risk?

Accept the vendor's limitation of liability and rely on the vendor's cyber insurance

Purchase a separate cyber insurance policy for the company

Require the vendor to indemnify the company for all losses

Negotiate for the vendor to maintain adequate cyber risk insurance and name the company as an additional insured

A financial services firm is negotiating a cloud contract for a new customer-facing application. The vendor's proposed SLA defines availability as 'monthly uptime percentage' but does not specify how outages are measured or what constitutes an 'outage.' The firm's compliance team requires that any service credit be tied to specific, measurable performance targets. Which document should the firm insist on modifying to address this gap?

The Service Level Agreement (SLA)

The Data Processing Agreement (DPA)

The Master Service Agreement (MSA)

In a cloud outsourcing contract, which document is primarily used to define the specific deliverables, timelines, and acceptance criteria for a particular project or service engagement?

Data Processing Agreement (DPA)

Certified Cloud Security Professional

Domain 6Objective 5

Understand Outsourcing and Cloud Contract Design CCSP Practice Questions (Page 4)

Part of the Legal, Risk and Compliance domain, which accounts for 13% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

13%of the exam

12 Concepts in This Objective

Business Requirements in Cloud Contracts
Vendor Assessments
Vendor Lock-in Risks
Vendor Viability and Escrow
Right to Audit
Contract Metrics and Definitions
Termination and Litigation
Assurance and Compliance in Contracts
Access to Cloud and Data
Cyber Risk Insurance
Data Ownership and Security Requirements
Supply-Chain Management in Cloud

Questions 16–20

16application · medium
A company is about to sign a cloud contract and is reviewing the insurance requirements. The company's risk manager wants to ensure that the company is protected against financial losses from a data breach that occurs in the cloud. The vendor's proposed contract states that the vendor is not liable for data breaches. Which action should the company take to address this risk?
Select an answer first
17foundation · easy
Which standard is specifically focused on providing guidance for information security in supplier relationships?
Select an answer first
18application · medium
A financial services firm is negotiating a cloud contract for a new customer-facing application. The vendor's proposed SLA defines availability as 'monthly uptime percentage' but does not specify how outages are measured or what constitutes an 'outage.' The firm's compliance team requires that any service credit be tied to specific, measurable performance targets. Which document should the firm insist on modifying to address this gap?
Select an answer first
19foundation · easy
Which component of a cloud contract is most appropriate for specifying the required uptime percentage and the remedy if that target is not met?
Select an answer first
20foundation · easy
In a cloud outsourcing contract, which document is primarily used to define the specific deliverables, timelines, and acceptance criteria for a particular project or service engagement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Understand Outsourcing and Cloud Contract Design CCSP Practice Questions (Page 4)

Questions 16–20

Which standard is specifically focused on providing guidance for information security in supplier relationships?

Which component of a cloud contract is most appropriate for specifying the required uptime percentage and the remedy if that target is not met?

In a cloud outsourcing contract, which document is primarily used to define the specific deliverables, timelines, and acceptance criteria for a particular project or service engagement?

Keep studying — Legal, Risk and Compliance