CCSP Legal, Risk, and Compliance — 25 Questions

Question 1

A multinational company operating in the EU uses a cloud service provider based in the US to process personal data of EU data subjects. The company is considered a data controller under the GDPR. Which of the following must the company ensure is in place to lawfully transfer personal data from the EU to the US?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standard Contractual Clauses adopted by the European Commission. Under GDPR, transfers of personal data to third countries require an adequate level of protection. Standard Contractual Clauses (SCCs) are a valid transfer mechanism approved by the European Commission.

Answer

A binding corporate rule approved by the US Department of Commerce

Answer

An adequacy decision by the US Federal Trade Commission

Answer

A data processing agreement solely between the cloud provider and the data subjects

Question 2

A covered entity under HIPAA is planning to migrate electronic protected health information (ePHI) to a public cloud environment. Which of the following is a mandatory requirement before using the cloud service?

Accepted Answer

Obtain a signed Business Associate Agreement from the cloud provider. HIPAA requires covered entities to obtain satisfactory assurances that PHI will be protected, typically through a Business Associate Agreement (BAA) with the cloud provider.

Answer

Encrypt all ePHI with keys managed solely by the covered entity

Answer

Conduct a physical on-site audit of the cloud provider's data centers

Answer

Ensure the cloud provider is certified under the Privacy Shield framework

Question 3

A financial institution subject to SOX is migrating its general ledger system to a SaaS provider. Which of the following IT general controls is most critical to ensure the integrity of financial data in the cloud?

Accepted Answer

Change management procedures for the SaaS application. SOX requires controls over financial reporting. Change management ensures that modifications to the system are authorized, tested, and documented, which is critical for data integrity.

Answer

Annual penetration testing of the SaaS provider's infrastructure

Answer

Daily backups of the financial database

Answer

Implementation of multi-factor authentication for all users

Question 4

A cloud customer receives a litigation hold notice requiring preservation of data stored in an object storage service. Which service feature should the customer use to ensure data cannot be modified or deleted until the hold is released?

Accepted Answer

Apply a retention policy using Object Lock. Object lock features like S3 Object Lock enable a write-once-read-many (WORM) model to prevent deletion or modification, meeting legal hold requirements.

Answer

Set a lifecycle policy to transition to archival storage

Answer

Enable versioning on the bucket

Answer

Configure server-side encryption

Question 5

A company is negotiating a cloud service agreement and wants to ensure it can verify the provider's security controls independently. Which contractual clause is essential for this purpose?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the contractual ability to assess the provider's controls, either through on-site audits or review of audit reports.

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) on uptime

Answer

Data portability clause

Question 6

A cloud customer needs to comply with PCI DSS for a cardholder data environment (CDE) hosted on an IaaS platform. According to PCI DSS Appendix A3, which document is critical to define the security responsibilities between the customer and the cloud provider?

Accepted Answer

Cloud Provider Responsibility Matrix. PCI DSS Appendix A3 requires cloud customers and providers to clearly define and document their respective security responsibilities for the cardholder data environment (CDE). The Cloud Provider Responsibility Matrix (often called a Shared Responsibility Matrix) is the critical document that delineates which party is responsible for each security control, such as firewall management, patch management, and access controls, ensuring compliance with PCI DSS requirements.

Answer

Service Organization Control (SOC) 2 report

Answer

Business Associate Agreement (BAA)

Answer

Data Processing Agreement (DPA)

Question 7

A cloud provider's data center is located in Country A, but the customer's data is subject to litigation in Country B. The court in Country B orders the cloud provider to produce data. The cloud provider refuses, citing Country A's laws that prohibit disclosure. This situation best illustrates which challenge in eDiscovery?

Accepted Answer

Jurisdiction issues. Jurisdictional issues arise when data is stored in multiple legal jurisdictions, and courts in one country may not have authority over data in another, leading to conflicts of law.

Answer

Data portability

Answer

Data preservation

Answer

Forensic soundness

Question 8

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk refers to over-reliance on a single vendor, which can lead to significant business impact if that vendor experiences a failure.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 9

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Accepted Answer

One month. GDPR requires the controller to respond to data subject requests without undue delay and in any event within one month of receipt.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 10

A cloud customer is considering adopting a multi-cloud strategy to avoid vendor lock-in. Which risk is this strategy primarily intended to mitigate?

Accepted Answer

Concentration risk. Multi-cloud reduces dependency on a single provider, thus mitigating concentration risk.

Answer

Third-party risk from a specific provider

Answer

Residual risk after controls

Answer

Inherent risk of data leaving premises

Question 11

Under the CSA STAR program, which tier involves a third-party assessment resulting in a certification based on ISO 27001?

Accepted Answer

Tier 2: Third-party assessment. CSA STAR Tier 2 includes STAR Certification, which builds on ISO 27001 certification and includes cloud-specific controls.

Answer

Tier 4: Nonexistent

Answer

Tier 1: Self-assessment

Answer

Tier 3: Continuous monitoring

Question 12

A cloud customer is terminating its contract with a cloud provider and needs to ensure all data, including backups, is permanently deleted. Which contractual clause is most relevant?

Accepted Answer

Data deletion clause. Data deletion clauses specify the provider's obligation to delete customer data, including from backups, upon termination.

Answer

Service Level Agreement

Answer

Data portability clause

Answer

Right to audit clause

Question 13

A cloud customer must comply with GDPR's right to erasure (right to be forgotten). Which TWO of the following are technical challenges the customer faces when the data is stored in a cloud object storage service with versioning and cross-region replication?

Accepted Answer

Removing previous versions of objects. GDPR right to erasure requires deletion of all copies. Versioning creates multiple versions that must be deleted. Cross-region replication creates additional copies in other regions that must also be deleted.

Answer

Ensuring data is accessible only via a specific IP range

Answer

Encrypting the data at rest with customer-managed keys

Answer

Exporting data in a machine-readable format

Question 14

A cloud customer is selecting a cloud provider for hosting payment card data and must comply with PCI DSS. Which THREE of the following are valid considerations when assessing the provider's PCI DSS compliance?

Accepted Answer

The provider must have a Cloud Provider Responsibility Matrix. PCI DSS allows cloud providers to be assessed by a QSA. Shared responsibility must be clearly defined. The provider may have a Responsibility Matrix as per Appendix A3.

Answer

The provider must sign a Business Associate Agreement

Answer

The cloud provider must be a Level 1 service provider

Question 15

A company subject to SOX is using a cloud ERP system. Which THREE of the following IT general controls are essential for SOX compliance?

Accepted Answer

Audit logging of user activities and system changes. SOX IT general controls include change management (ensuring system changes are controlled), access controls (preventing unauthorized access), and audit logs (monitoring and accountability).

Answer

Physical security of the cloud provider's data centers

Answer

Multi-factor authentication for all cloud provider administrators

Question 16

A multinational company headquartered in the US processes personal data of EU data subjects using a cloud service provider hosted in Singapore. Under GDPR, which legal mechanism is most appropriate for lawful transfer of personal data from the EU to Singapore?

Accepted Answer

Standard Contractual Clauses (SCCs). GDPR requires an appropriate safeguard for transfers to third countries without an adequacy decision. Standard Contractual Clauses (SCCs) are a common mechanism.

Answer

Binding Corporate Rules (BCRs)

Answer

Adequacy decision by the European Commission

Answer

Data Protection Agreement (DPA) with the cloud provider

Question 17

A covered entity under HIPAA is moving electronic protected health information (ePHI) to a public cloud. What is the primary requirement before the cloud provider hosts ePHI?

Accepted Answer

The cloud provider must sign a Business Associate Agreement (BAA). HIPAA requires a Business Associate Agreement (BAA) between the covered entity and the cloud provider to ensure PHI is handled appropriately.

Answer

The cloud provider must be located within the United States

Answer

The cloud provider must be certified under ISO 27001

Answer

The covered entity must obtain written authorization from each patient

Question 18

A company subject to PCI DSS is considering a cloud provider to process credit card transactions. What must the cloud provider present to demonstrate compliance with PCI DSS?

Accepted Answer

A PCI DSS Attestation of Compliance (AOC) from a QSA. PCI DSS allows cloud providers to be assessed by a QSA; the resulting Attestation of Compliance (AOC) demonstrates compliance.

Answer

A CSA STAR Level 1 self-assessment

Answer

A SOC 2 Type II report

Answer

An ISO 27001 certificate

Question 19

A company that must comply with SOX is migrating its financial systems to a cloud service. Which of the following IT general controls is most critical for SOX compliance in the cloud?

Accepted Answer

Change management controls. SOX requires strong controls over financial data; change management ensures changes to systems are authorized and tested.

Answer

Multi-factor authentication

Answer

Data encryption at rest

Answer

Automated backup procedures

Question 20

During an eDiscovery process, a company needs to preserve data stored in AWS S3 that may be relevant to a lawsuit. Which AWS feature should be used to implement a legal hold?

Accepted Answer

S3 Object Lock. S3 Object Lock prevents object deletion or modification for a specified period, meeting legal hold requirements.

Answer

AWS CloudTrail

Answer

S3 Versioning

Answer

AWS Config