CCSP Legal, Risk, and Compliance Practice Test 4 — 15 Questions

Question 1

A multinational corporation with its headquarters in the United States processes personal data of European Union data subjects using a cloud-based customer relationship management (CRM) system hosted in the United States. According to the General Data Protection Regulation (GDPR), which of the following is the company's primary obligation regarding the protection of that data?

Accepted Answer

The company must appoint a representative in the EU and ensure that any data transfers outside the EU are covered by an adequacy decision, standard contractual clauses, or binding corporate rules.. GDPR applies to any organization processing personal data of EU data subjects, regardless of where the processing occurs. The company is a data controller and must comply with all GDPR requirements, including data subject rights and breach notification.

Answer

The company must delete all personal data within 30 days of collection.

Answer

The company is not subject to GDPR because its headquarters and the cloud server are located outside the EU.

Answer

The company must obtain explicit consent from each data subject before processing their data.

Question 2

A healthcare provider is planning to migrate its electronic health records (EHR) system to a public cloud infrastructure. The system will store protected health information (PHI). Under HIPAA, what must the healthcare provider obtain from the cloud service provider before beginning the migration?

Accepted Answer

A Business Associate Agreement (BAA) that outlines the permitted uses of PHI and the security safeguards in place. HIPAA requires covered entities to have a Business Associate Agreement (BAA) with any business associate that creates, receives, maintains, or transmits PHI on their behalf. The cloud provider is a business associate.

Answer

A signed letter of attestation that the cloud provider is HIPAA-compliant

Answer

A Data Processing Agreement (DPA) as defined under GDPR

Answer

A Service Organization Control (SOC) 2 Type II report

Question 3

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. SOX requires organizations to maintain ITGCs over systems that support financial reporting. Logical access controls (e.g., user provisioning, authentication) are typically the responsibility of the customer (the financial institution) because they manage who can access the application and data.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines

Question 4

A company is subject to PCI DSS because it processes credit card transactions. It plans to use a cloud provider that is not specifically listed as a PCI DSS validated service provider. What is the most important step the company must take to ensure compliance?

Accepted Answer

The company must obtain a copy of the cloud provider's PCI DSS Attestation of Compliance (AOC) and ensure the provider is assessed by a Qualified Security Assessor (QSA).. PCI DSS requires that if a cloud provider is not already validated, the customer must ensure the provider undergoes a PCI DSS assessment. The shared responsibility matrix (SRM) is used to delineate which controls are the provider's and which are the customer's.

Answer

The company must sign a Business Associate Agreement (BAA) with the cloud provider.

Answer

The company must conduct its own on-site audit of the cloud provider's data centers.

Answer

The company must ensure that the cloud provider encrypts all cardholder data at rest and in transit.

Question 5

Under the General Data Protection Regulation (GDPR), if a cloud service provider (acting as a data processor) suffers a personal data breach, what is the provider's obligation regarding notification?

Accepted Answer

The processor must notify the data controller without undue delay upon becoming aware of the breach.. GDPR Article 33 requires the data processor to notify the data controller without undue delay after becoming aware of a breach. The controller then has 72 hours to notify the supervisory authority.

Answer

The processor must notify the supervisory authority within 72 hours.

Answer

The processor does not have any notification obligation under GDPR.

Answer

The processor must notify the affected data subjects directly within 72 hours.

Question 6

A cloud customer is preparing for litigation and needs to place a legal hold on specific data stored in an object storage service. The cloud provider offers features such as object lock and retention policies. What is the primary challenge the customer must address to ensure the legal hold is effective across all copies of the data?

Accepted Answer

Ensuring that the legal hold is applied to all copies of the data, including replicas and backups, and that the hold prevents modification as well as deletion.. In cloud environments, data may be replicated across multiple regions or stored in backups. A legal hold must prevent deletion or alteration of all copies, including replicas and backups. Failure to apply hold to all copies can result in spoliation.

Answer

Ensuring that the legal hold is time-limited and automatically expires after 90 days.

Answer

Verifying that the cloud provider has a backup of the data in a different geographic region.

Answer

Obtaining a court order that specifically authorizes the cloud provider to preserve the data.

Question 7

A company is negotiating a cloud service agreement and wants to ensure it can periodically assess the security of the cloud provider's operations. Which contractual clause is most directly relevant to this requirement?

Accepted Answer

Right to Audit clause permitting the customer to review the provider's security controls and certifications. A right to audit clause allows the customer to conduct or commission audits of the provider's controls. This is a key contract consideration for cloud customers.

Answer

Data portability clause ensuring data can be exported in a usable format

Answer

Service Level Agreement (SLA) with uptime guarantees

Answer

Data deletion clause specifying how data is deleted after contract termination

Question 8

Which of the following is a key requirement for data portability under the General Data Protection Regulation (GDPR)?

Accepted Answer

Data must be provided in a structured, commonly used, and machine-readable format.. GDPR Article 20 gives data subjects the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. This includes the cloud provider providing export functionality.

Answer

Data must be transferred directly to the data subject's own device.

Answer

Data portability applies only to pseudonymized data.

Answer

Data must be deleted within 30 days of a portability request.

Question 9

A multinational corporation uses multiple cloud service providers for its critical applications. The board is concerned about concentration risk. Which strategy would best address this risk?

Accepted Answer

Adopting a multi-cloud strategy that distributes applications across multiple cloud providers. Concentration risk refers to over-reliance on a single provider. A multi-cloud strategy reduces this risk by distributing workloads across multiple providers, avoiding a single point of failure.

Answer

Negotiating a longer contract with the primary cloud provider to ensure stability

Answer

Implementing a hybrid cloud model with on-premises infrastructure only

Answer

Requiring each business unit to use the same cloud provider for consistency

Question 10

A cloud customer is subject to eDiscovery requirements in a lawsuit. The data resides in a cloud storage service that uses encryption. What is the primary challenge in collecting this data in a forensically sound manner?

Accepted Answer

Ensuring the integrity and chain of custody when data is collected via API or provider tools rather than physical seizure. Cloud environments often lack physical access, and data may be distributed across multiple servers and jurisdictions. Ensuring the collection methodology preserves integrity and metadata is challenging without provider cooperation.

Answer

Obtaining a search warrant for data stored in the cloud

Answer

Decrypting the data without the encryption keys

Answer

Identifying the specific geographic location of the data

Question 11

Which of the following best describes the purpose of the Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) program?

Accepted Answer

To allow cloud providers to publicly document their security controls and achieve different levels of assurance. CSA STAR provides a framework for cloud providers to demonstrate their security posture through self-assessment or third-party assessments. It increases transparency and helps customers assess risk.

Answer

To offer a certification program for cloud security professionals

Answer

To define mandatory security requirements for all cloud services

Answer

To provide a legal framework for cloud contracts

Question 12

A cloud customer is concerned about the right to erasure under GDPR because the cloud provider replicates data across multiple regions and keeps backups. What technical challenge does this create for complying with a erasure request?

Accepted Answer

The cloud provider may not be able to delete data from all replicas and backups within the required time frame.. Under GDPR, the right to erasure requires deletion of all copies of the data. In cloud environments, data may be replicated across regions and stored in backups with different retention periods, making it technically difficult to ensure complete deletion from all locations.

Answer

The data must be anonymized instead of deleted.

Answer

The customer must notify all other users who may have accessed the data.

Answer

The cloud provider must retain the data for audit purposes.

Question 13

A company is drafting a cloud service contract and wants to ensure it can exit the provider without losing access to its data. Which TWO clauses are most important to include?

Accepted Answer

Data deletion clause requiring deletion of all data, including backups, after termination. Data portability ensures the customer can export data in a usable format. Data deletion ensures the provider deletes all copies of customer data after termination. These clauses are critical for a clean exit.

Answer

Service Level Agreement (SLA) for availability

Answer

Non-disclosure agreement (NDA)

Answer

Right to audit clause

Question 14

A cloud customer is assessing the risk of using a cloud provider. Which THREE factors are most important in evaluating the inherent risk of migrating data and applications to the cloud?

Accepted Answer

Data leaving the customer's direct control and being stored on shared infrastructure. Inherent risk includes data leaving the customer's premises, the shared infrastructure model (multi-tenancy), and dependency on the provider's security controls. These are fundamental to cloud risk assessment.

Answer

The provider's compliance certifications (e.g., ISO 27001, SOC 2)

Answer

The provider's physical security controls at data centers

Question 15

In the context of eDiscovery, a legal hold must be placed on data stored in a cloud environment. Which THREE actions should the cloud customer take to ensure the legal hold is effective?

Accepted Answer

Ensure the legal hold prevents both deletion and modification of the data.. A legal hold requires preserving all relevant data, including backups and replicas. It must also prevent modification, not just deletion. Communication with the provider ensures technical enforcement.

Answer

Delete any non-relevant data to reduce storage costs.

Answer

Rely solely on the cloud provider's default backup retention policies.