CCSP Legal, Risk, and Compliance Practice Test 2 — 15 Questions

Question 1

A multinational company headquartered in the US processes personal data of EU data subjects using a cloud service provider hosted in Singapore. Under GDPR, which legal mechanism is most appropriate for lawful transfer of personal data from the EU to Singapore?

Accepted Answer

Standard Contractual Clauses (SCCs). GDPR requires an appropriate safeguard for transfers to third countries without an adequacy decision. Standard Contractual Clauses (SCCs) are a common mechanism.

Answer

Binding Corporate Rules (BCRs)

Answer

Adequacy decision by the European Commission

Answer

Data Protection Agreement (DPA) with the cloud provider

Question 2

A covered entity under HIPAA is moving electronic protected health information (ePHI) to a public cloud. What is the primary requirement before the cloud provider hosts ePHI?

Accepted Answer

The cloud provider must sign a Business Associate Agreement (BAA). HIPAA requires a Business Associate Agreement (BAA) between the covered entity and the cloud provider to ensure PHI is handled appropriately.

Answer

The cloud provider must be located within the United States

Answer

The cloud provider must be certified under ISO 27001

Answer

The covered entity must obtain written authorization from each patient

Question 3

A company subject to PCI DSS is considering a cloud provider to process credit card transactions. What must the cloud provider present to demonstrate compliance with PCI DSS?

Accepted Answer

A PCI DSS Attestation of Compliance (AOC) from a QSA. PCI DSS allows cloud providers to be assessed by a QSA; the resulting Attestation of Compliance (AOC) demonstrates compliance.

Answer

A CSA STAR Level 1 self-assessment

Answer

A SOC 2 Type II report

Answer

An ISO 27001 certificate

Question 4

A company that must comply with SOX is migrating its financial systems to a cloud service. Which of the following IT general controls is most critical for SOX compliance in the cloud?

Accepted Answer

Change management controls. SOX requires strong controls over financial data; change management ensures changes to systems are authorized and tested.

Answer

Multi-factor authentication

Answer

Data encryption at rest

Answer

Automated backup procedures

Question 5

During an eDiscovery process, a company needs to preserve data stored in AWS S3 that may be relevant to a lawsuit. Which AWS feature should be used to implement a legal hold?

Accepted Answer

S3 Object Lock. S3 Object Lock prevents object deletion or modification for a specified period, meeting legal hold requirements.

Answer

AWS CloudTrail

Answer

S3 Versioning

Answer

AWS Config

Question 6

A cloud customer is negotiating a contract and wants to ensure they have the right to verify the cloud provider's security controls. Which contractual provision is most important?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the ability to review the provider's security measures, often through independent reports or on-site assessments.

Answer

Data portability clause

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) for uptime

Question 7

Which CSA STAR tier involves a third-party assessment and results in a certification based on ISO 27001?

Accepted Answer

Tier 2: Third-party assessment. CSA STAR Tier 2 includes STAR Certification, which is based on ISO 27001 plus cloud-specific controls.

Answer

Tier 4: Auditing

Answer

Tier 3: Continuous monitoring

Answer

Tier 1: Self-assessment

Question 8

A company is using a single cloud provider for all critical services. What is the primary risk this company faces?

Accepted Answer

Concentration risk. Concentration risk (vendor lock-in) arises from over-reliance on one provider, leading to potential business disruption if the provider fails.

Answer

Data sovereignty risk

Answer

Compliance risk

Answer

Insider threat risk

Question 9

Under GDPR, a cloud data controller must notify the supervisory authority of a personal data breach within what timeframe?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 10

A cloud customer wants to ensure that when the contract ends, the cloud provider deletes all customer data, including from backups. Which contractual clause is essential?

Accepted Answer

Data deletion clause. A data deletion clause should specify the obligation to delete customer data, including backups, upon termination.

Answer

Right to audit clause

Answer

Data portability clause

Answer

Service Level Agreement

Question 11

A cloud customer is concerned about the risk of unauthorized access to data due to the shared infrastructure of a public cloud. What type of risk does this represent?

Accepted Answer

Inherent risk. Inherent risk is the risk that exists before any controls are applied; shared infrastructure is a key inherent risk of cloud computing.

Answer

Control risk

Answer

Detection risk

Answer

Residual risk

Question 12

A company needs to export data from a cloud service in a machine-readable format to comply with a data subject's right to data portability under GDPR. Which format is most appropriate?

Accepted Answer

CSV (Comma-Separated Values). GDPR requires data to be provided in a structured, commonly used, machine-readable format; CSV is widely accepted.

Answer

HTML

Answer

PDF

Answer

JPEG

Question 13

A cloud customer is evaluating a provider's compliance with PCI DSS. Which two components are part of the PCI DSS shared responsibility model as referenced in Appendix A3? (Choose two.)

Accepted Answer

Physical security of data centers. PCI DSS Appendix A3 requires a Cloud Provider Responsibility Matrix that delineates responsibilities; typical shared responsibilities include physical security (provider) and access controls (customer).

Answer

Network perimeter controls

Answer

Application security for custom code

Answer

Encryption key management

Question 14

A global company uses a cloud provider that stores data in multiple jurisdictions. During an eDiscovery request from a US court, which three challenges are most likely to arise? (Choose three.)

Accepted Answer

Jurisdictional conflicts over which court has authority. eDiscovery in the cloud poses jurisdictional conflicts, data access limitations, and data preservation challenges.

Answer

Lack of encryption options

Answer

Excessive cost of cloud storage

Question 15

A company is adopting a multi-cloud strategy to reduce concentration risk. Which two benefits are directly associated with this approach? (Choose two.)

Accepted Answer

Reduced vendor lock-in. Multi-cloud reduces dependency on a single provider (concentration risk) and allows flexibility to use best-of-breed services.

Answer

Simplified compliance management

Answer

Unified security controls

Answer

Lower network latency