CCSP Legal, Risk, and Compliance — 10 Questions

Question 1

A multinational company operating in the EU uses a cloud service provider based in the US to process personal data of EU data subjects. The company is considered a data controller under the GDPR. Which of the following must the company ensure is in place to lawfully transfer personal data from the EU to the US?

Accepted Answer

Standard Contractual Clauses adopted by the European Commission. Under GDPR, transfers of personal data to third countries require an adequate level of protection. Standard Contractual Clauses (SCCs) are a valid transfer mechanism approved by the European Commission.

Answer

A binding corporate rule approved by the US Department of Commerce

Answer

An adequacy decision by the US Federal Trade Commission

Answer

A data processing agreement solely between the cloud provider and the data subjects

Question 2

A covered entity under HIPAA is planning to migrate electronic protected health information (ePHI) to a public cloud environment. Which of the following is a mandatory requirement before using the cloud service?

Accepted Answer

Obtain a signed Business Associate Agreement from the cloud provider. HIPAA requires covered entities to obtain satisfactory assurances that PHI will be protected, typically through a Business Associate Agreement (BAA) with the cloud provider.

Answer

Encrypt all ePHI with keys managed solely by the covered entity

Answer

Conduct a physical on-site audit of the cloud provider's data centers

Answer

Ensure the cloud provider is certified under the Privacy Shield framework

Question 3

A financial institution subject to SOX is migrating its general ledger system to a SaaS provider. Which of the following IT general controls is most critical to ensure the integrity of financial data in the cloud?

Accepted Answer

Change management procedures for the SaaS application. SOX requires controls over financial reporting. Change management ensures that modifications to the system are authorized, tested, and documented, which is critical for data integrity.

Answer

Annual penetration testing of the SaaS provider's infrastructure

Answer

Daily backups of the financial database

Answer

Implementation of multi-factor authentication for all users

Question 4

A cloud customer receives a litigation hold notice requiring preservation of data stored in an object storage service. Which service feature should the customer use to ensure data cannot be modified or deleted until the hold is released?

Accepted Answer

Apply a retention policy using Object Lock. Object lock features like S3 Object Lock enable a write-once-read-many (WORM) model to prevent deletion or modification, meeting legal hold requirements.

Answer

Set a lifecycle policy to transition to archival storage

Answer

Enable versioning on the bucket

Answer

Configure server-side encryption

Question 5

A company is negotiating a cloud service agreement and wants to ensure it can verify the provider's security controls independently. Which contractual clause is essential for this purpose?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the contractual ability to assess the provider's controls, either through on-site audits or review of audit reports.

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) on uptime

Answer

Data portability clause

Question 6

A cloud customer needs to comply with PCI DSS for a cardholder data environment (CDE) hosted on an IaaS platform. According to PCI DSS Appendix A3, which document is critical to define the security responsibilities between the customer and the cloud provider?

Accepted Answer

Cloud Provider Responsibility Matrix. PCI DSS Appendix A3 requires cloud customers and providers to clearly define and document their respective security responsibilities for the cardholder data environment (CDE). The Cloud Provider Responsibility Matrix (often called a Shared Responsibility Matrix) is the critical document that delineates which party is responsible for each security control, such as firewall management, patch management, and access controls, ensuring compliance with PCI DSS requirements.

Answer

Service Organization Control (SOC) 2 report

Answer

Business Associate Agreement (BAA)

Answer

Data Processing Agreement (DPA)

Question 7

A cloud provider's data center is located in Country A, but the customer's data is subject to litigation in Country B. The court in Country B orders the cloud provider to produce data. The cloud provider refuses, citing Country A's laws that prohibit disclosure. This situation best illustrates which challenge in eDiscovery?

Accepted Answer

Jurisdiction issues. Jurisdictional issues arise when data is stored in multiple legal jurisdictions, and courts in one country may not have authority over data in another, leading to conflicts of law.

Answer

Data portability

Answer

Data preservation

Answer

Forensic soundness

Question 8

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk refers to over-reliance on a single vendor, which can lead to significant business impact if that vendor experiences a failure.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 9

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Accepted Answer

One month. GDPR requires the controller to respond to data subject requests without undue delay and in any event within one month of receipt.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 10

A cloud customer is considering adopting a multi-cloud strategy to avoid vendor lock-in. Which risk is this strategy primarily intended to mitigate?

Accepted Answer

Concentration risk. Multi-cloud reduces dependency on a single provider, thus mitigating concentration risk.

Answer

Third-party risk from a specific provider

Answer

Residual risk after controls

Answer

Inherent risk of data leaving premises