CCSP Legal, Risk, and Compliance Practice Test 3 — 15 Questions

Question 1

A healthcare organization stores protected health information (PHI) in a cloud environment. Under HIPAA, what must the organization obtain from the cloud provider before processing PHI?

Accepted Answer

A Business Associate Agreement (BAA). HIPAA requires a covered entity to obtain a Business Associate Agreement (BAA) from any cloud provider that will handle PHI. The BAA ensures the provider agrees to safeguard the PHI appropriately.

Answer

A Data Processing Agreement (DPA) under GDPR

Answer

A Service Organization Control (SOC) 2 report

Answer

An ISO 27001 certification

Question 2

A multinational corporation collects personal data of EU residents and uses a cloud provider with data centers in the US and Asia. Under GDPR, which mechanism is appropriate for transferring data from the EU to the US data center, assuming no adequacy decision exists?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a GDPR-approved mechanism for lawful data transfers to countries without an adequacy decision, provided the parties contractually commit to GDPR protections.

Answer

Adequacy decision by the US

Answer

Data Subject's explicit consent

Answer

Binding Corporate Rules (BCRs)

Question 3

Under GDPR, what is the maximum time allowed for a data controller to notify the supervisory authority of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 4

A company is subject to PCI DSS and plans to use a cloud provider to process credit card transactions. The cloud provider has been assessed by a Qualified Security Assessor (QSA). According to PCI DSS, what must the company obtain from the provider to demonstrate compliance?

Accepted Answer

The provider's PCI DSS Attestation of Compliance (AOC) and Responsibility Matrix. PCI DSS requires that the service provider's responsibilities are mapped in a Cloud Provider Responsibility Matrix, typically in Appendix A3. Additionally, the customer must obtain evidence of the provider's QSA assessment.

Answer

A signed Business Associate Agreement

Answer

An ISO 27001 certificate

Answer

A SOC 2 Type II report

Question 5

Under SOX, which of the following is an IT general control that must be implemented for financial data systems in a cloud environment?

Accepted Answer

Access controls over financial systems. SOX requires IT general controls (ITGCs) such as access controls to ensure the integrity of financial data. Audit logs support monitoring but are not the only control.

Answer

Data encryption at rest

Answer

Multi-factor authentication

Answer

Annual penetration testing

Question 6

A company is subject to a legal hold order and uses a cloud storage service with object replication across multiple regions. Which cloud feature should the company use to prevent deletion or modification of relevant data?

Accepted Answer

Legal hold policies (e.g., S3 Object Lock). Legal hold features like S3 Object Lock (AWS) or Azure Immutable Blob prevent data from being deleted or modified during the hold period, even if replication exists.

Answer

Versioning of objects

Answer

Cross-region replication

Answer

Backup to another provider

Question 7

A cloud customer wants to ensure they can audit their cloud provider's security controls annually. Which contractual provision should be included in the cloud service agreement?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the contractual ability to perform audits, review security reports, or bring in a third-party auditor.

Answer

Service level agreement (SLA) with uptime guarantees

Answer

Data deletion clause

Answer

Data portability clause

Question 8

Which CSA STAR tier involves a third-party assessment against ISO 27001?

Accepted Answer

Tier 2 – Third-party assessment. The CSA STAR (Security, Trust, Assurance, and Risk) program has three tiers: Tier 1 (Self-Assessment), Tier 2 (Third-Party Assessment), and Tier 3 (Continuous Monitoring). Tier 2 specifically requires a third-party assessment against the ISO/IEC 27001 standard, where an accredited certification body audits the cloud service provider's Information Security Management System (ISMS) for compliance. This tier provides a higher level of assurance than self-assessment, as it involves independent validation of security controls.

Answer

Tier 4 – Peer review

Answer

Tier 1 – Self-assessment

Answer

Tier 3 – Continuous monitoring

Question 9

A company is evaluating the risk of using a single cloud provider for all critical workloads. Which risk is most directly associated with this scenario?

Accepted Answer

Concentration risk. Concentration risk refers to the over-reliance on a single provider, leading to high impact if that provider suffers an outage or data loss.

Answer

Inherent risk of shared infrastructure

Answer

Third-party risk

Answer

Control effectiveness risk

Question 10

In a cloud environment, a data subject exercises their right to erasure under GDPR. The cloud provider has multiple replicas and backups. What is the primary technical challenge in fulfilling this request?

Accepted Answer

Ensuring deletion from backups and replicas within retention periods. GDPR's right to erasure requires deletion of all copies, including from backups and replicas, which is technically complex due to retention policies and storage architecture.

Answer

Transferring data to another controller

Answer

Obtaining consent from other data subjects

Answer

Identifying the data subject's data across all systems

Question 11

Under GDPR, what is the role of a cloud provider that processes personal data solely on behalf of a customer?

Accepted Answer

Data processor. The cloud provider is a data processor, as it processes data on behalf of the data controller (the customer).

Answer

Data controller

Answer

Supervisory authority

Answer

Data subject

Question 12

A company wants to export its data from a cloud provider to another provider upon contract termination. Which contract clause is essential to ensure the data can be exported in a usable format?

Accepted Answer

Data portability clause. A data portability clause ensures the customer has the right to export data in a machine-readable format, often with provider assistance.

Answer

Service level agreement

Answer

Right to audit

Answer

Data deletion clause

Question 13

A company is negotiating a cloud contract and wants to ensure data ownership and deletion. Which TWO clauses should be included? (Select two.)

Accepted Answer

Data ownership clause. Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Answer

Right to audit clause

Answer

Non-disclosure agreement

Answer

Service level agreement

Question 14

A global enterprise is conducting a cloud risk assessment. Which THREE factors should be considered? (Select three.)

Accepted Answer

Inherent risk of data leaving the on-premises environment. Inherent risk relates to data leaving premises. Provider control effectiveness is assessed via audit reports. Concentration risk is the risk of over-reliance on a single provider.

Answer

Color of the provider's logo

Answer

Provider's stock price

Question 15

According to GDPR, which THREE are data subject rights? (Select three.)

Accepted Answer

Right to object to processing for direct marketing. Under GDPR, data subject rights include the right to object to processing for direct marketing (Article 21), right of access (Article 15), and right to erasure (Article 17). Options A and E are also valid rights (right to portability is a data subject right), but the question asks for three specific rights from the list, and B, C, D are the correct set as per the intended answer.

Answer

Right to transfer data to a third country

Answer

Right to portability