A cloud customer stores customer purchase history in a database. The contract with the cloud provider includes a clause limiting the provider's use of this data to providing the service. Which type of data protection is primarily governing this data?

Regulated private data, because the data is personal information

Contractual private data, because the restriction is defined in a business agreement

Both contractual and regulated, because the contract and law always apply equally

Neither, because the data is not sensitive enough to require protection

A global company is negotiating a contract with a cloud provider to store customer data. The company operates in the EU and the US. The contract includes a clause that the cloud provider may process data in any country. The company's legal team is concerned about GDPR compliance. What is the most appropriate contractual measure to address cross-border data transfer risks?

Include Standard Contractual Clauses (SCCs) in the contract

Obtain consent from each customer for the transfer

Rely on the cloud provider's ISO/IEC 27001 certification

Require the cloud provider to store data only in the EU

A US university stores student education records, including grades and disciplinary actions, in a cloud-based learning management system (LMS). The university is subject to FERPA. Which of the following data elements is directly protected by FERPA?

Student library borrowing history

Student health records from a campus clinic

Student credit card payment information

Student grades and disciplinary records

Certified Cloud Security Professional

Domain 6Objective 2

Understand Privacy Issues CCSP Practice Questions (Page 2)

Part of the Legal, Risk and Compliance domain, which accounts for 13% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

13%of the exam

Questions 6–10

6foundation · easy
Which regulation is specifically designed to protect the privacy of student education records in the United States?
Select an answer first
7foundation · easy
A cloud customer stores customer purchase history in a database. The contract with the cloud provider includes a clause limiting the provider's use of this data to providing the service. Which type of data protection is primarily governing this data?
Select an answer first
8expert · hard
A global company is negotiating a contract with a cloud provider to store customer data. The company operates in the EU and the US. The contract includes a clause that the cloud provider may process data in any country. The company's legal team is concerned about GDPR compliance. What is the most appropriate contractual measure to address cross-border data transfer risks?
Select an answer first
9foundation · easy
Which privacy regulation is a Canadian federal law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities?
Select an answer first
10application · medium
A US university stores student education records, including grades and disciplinary actions, in a cloud-based learning management system (LMS). The university is subject to FERPA. Which of the following data elements is directly protected by FERPA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Understand Privacy Issues CCSP Practice Questions (Page 2)

Questions 6–10

Which regulation is specifically designed to protect the privacy of student education records in the United States?

A cloud customer stores customer purchase history in a database. The contract with the cloud provider includes a clause limiting the provider's use of this data to providing the service. Which type of data protection is primarily governing this data?

Which privacy regulation is a Canadian federal law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities?

A US university stores student education records, including grades and disciplinary actions, in a cloud-based learning management system (LMS). The university is subject to FERPA. Which of the following data elements is directly protected by FERPA?

Keep studying — Legal, Risk and Compliance