CCSP Practice Test 25 — 15 Questions

Question 1

A company is subject to PCI DSS because it processes credit card transactions. It plans to use a cloud provider that is not specifically listed as a PCI DSS validated service provider. What is the most important step the company must take to ensure compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The company must obtain a copy of the cloud provider's PCI DSS Attestation of Compliance (AOC) and ensure the provider is assessed by a Qualified Security Assessor (QSA).. PCI DSS requires that if a cloud provider is not already validated, the customer must ensure the provider undergoes a PCI DSS assessment. The shared responsibility matrix (SRM) is used to delineate which controls are the provider's and which are the customer's.

Answer

The company must sign a Business Associate Agreement (BAA) with the cloud provider.

Answer

The company must conduct its own on-site audit of the cloud provider's data centers.

Answer

The company must ensure that the cloud provider encrypts all cardholder data at rest and in transit.

Question 2

A company is negotiating a cloud service agreement and wants to ensure it can periodically assess the security of the cloud provider's operations. Which contractual clause is most directly relevant to this requirement?

Accepted Answer

Right to Audit clause permitting the customer to review the provider's security controls and certifications. A right to audit clause allows the customer to conduct or commission audits of the provider's controls. This is a key contract consideration for cloud customers.

Answer

Data portability clause ensuring data can be exported in a usable format

Answer

Service Level Agreement (SLA) with uptime guarantees

Answer

Data deletion clause specifying how data is deleted after contract termination

Question 3

Under GDPR, what is the role of a cloud provider that processes personal data solely on behalf of a customer?

Accepted Answer

Data processor. The cloud provider is a data processor, as it processes data on behalf of the data controller (the customer).

Answer

Data controller

Answer

Supervisory authority

Answer

Data subject

Question 4

Which of the following is a key requirement for data portability under the General Data Protection Regulation (GDPR)?

Accepted Answer

Data must be provided in a structured, commonly used, and machine-readable format.. GDPR Article 20 gives data subjects the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. This includes the cloud provider providing export functionality.

Answer

Data must be transferred directly to the data subject's own device.

Answer

Data portability applies only to pseudonymized data.

Answer

Data must be deleted within 30 days of a portability request.

Question 5

A multinational corporation collects personal data of EU residents and uses a cloud provider with data centers in the US and Asia. Under GDPR, which mechanism is appropriate for transferring data from the EU to the US data center, assuming no adequacy decision exists?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a GDPR-approved mechanism for lawful data transfers to countries without an adequacy decision, provided the parties contractually commit to GDPR protections.

Answer

Adequacy decision by the US

Answer

Data Subject's explicit consent

Answer

Binding Corporate Rules (BCRs)

Question 6

A cloud customer is negotiating a contract and wants to ensure they have the right to verify the cloud provider's security controls. Which contractual provision is most important?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the ability to review the provider's security measures, often through independent reports or on-site assessments.

Answer

Data portability clause

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) for uptime

Question 7

A healthcare organization stores protected health information (PHI) in a cloud environment. Under HIPAA, what must the organization obtain from the cloud provider before processing PHI?

Accepted Answer

A Business Associate Agreement (BAA). HIPAA requires a covered entity to obtain a Business Associate Agreement (BAA) from any cloud provider that will handle PHI. The BAA ensures the provider agrees to safeguard the PHI appropriately.

Answer

A Data Processing Agreement (DPA) under GDPR

Answer

A Service Organization Control (SOC) 2 report

Answer

An ISO 27001 certification

Question 8

A cloud customer is assessing the risk of using a cloud provider. Which THREE factors are most important in evaluating the inherent risk of migrating data and applications to the cloud?

Accepted Answer

Data leaving the customer's direct control and being stored on shared infrastructure. Inherent risk includes data leaving the customer's premises, the shared infrastructure model (multi-tenancy), and dependency on the provider's security controls. These are fundamental to cloud risk assessment.

Answer

The provider's compliance certifications (e.g., ISO 27001, SOC 2)

Answer

The provider's physical security controls at data centers

Question 9

A cloud customer is subject to eDiscovery requirements in a lawsuit. The data resides in a cloud storage service that uses encryption. What is the primary challenge in collecting this data in a forensically sound manner?

Accepted Answer

Ensuring the integrity and chain of custody when data is collected via API or provider tools rather than physical seizure. Cloud environments often lack physical access, and data may be distributed across multiple servers and jurisdictions. Ensuring the collection methodology preserves integrity and metadata is challenging without provider cooperation.

Answer

Obtaining a search warrant for data stored in the cloud

Answer

Decrypting the data without the encryption keys

Answer

Identifying the specific geographic location of the data

Question 10

A company wants to export its data from a cloud provider to another provider upon contract termination. Which contract clause is essential to ensure the data can be exported in a usable format?

Accepted Answer

Data portability clause. A data portability clause ensures the customer has the right to export data in a machine-readable format, often with provider assistance.

Answer

Service level agreement

Answer

Right to audit

Answer

Data deletion clause

Question 11

A global company uses a cloud provider that stores data in multiple jurisdictions. During an eDiscovery request from a US court, which three challenges are most likely to arise? (Choose three.)

Accepted Answer

Jurisdictional conflicts over which court has authority. eDiscovery in the cloud poses jurisdictional conflicts, data access limitations, and data preservation challenges.

Answer

Lack of encryption options

Answer

Excessive cost of cloud storage

Question 12

An organization is using GCP and wants to collect audit logs for all API calls made within the project. Which GCP service should be enabled to capture these logs?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record administrative activities and data access within GCP projects. They are the primary source for API call logging. Security Command Center provides security and risk management but does not generate audit logs. Cloud Monitoring collects metrics and uptime checks. VPC Flow Logs capture network traffic, not API calls.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Question 13

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk refers to over-reliance on a single vendor, which can lead to significant business impact if that vendor experiences a failure.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 14

Under the General Data Protection Regulation (GDPR), if a cloud service provider (acting as a data processor) suffers a personal data breach, what is the provider's obligation regarding notification?

Accepted Answer

The processor must notify the data controller without undue delay upon becoming aware of the breach.. GDPR Article 33 requires the data processor to notify the data controller without undue delay after becoming aware of a breach. The controller then has 72 hours to notify the supervisory authority.

Answer

The processor must notify the supervisory authority within 72 hours.

Answer

The processor does not have any notification obligation under GDPR.

Answer

The processor must notify the affected data subjects directly within 72 hours.

Question 15

A company needs to export data from a cloud service in a machine-readable format to comply with a data subject's right to data portability under GDPR. Which format is most appropriate?

Accepted Answer

CSV (Comma-Separated Values). GDPR requires data to be provided in a structured, commonly used, machine-readable format; CSV is widely accepted.

Answer

HTML

Answer

PDF

Answer

JPEG