CCSP Legal, Risk and Compliance — 20 Questions

Question 1

A company's cloud infrastructure is subject to GDPR. The DPO requires that all customer personal data be encrypted at rest and in transit. The cloud provider offers SSE-S3 for object storage and enforces TLS 1.2 for API calls. Which additional control should the company implement to meet GDPR accountability requirements?

Accepted Answer

Enable detailed logging of all access to encrypted data.. While SSE-S3 and TLS 1.2 address encryption at rest and in transit, GDPR accountability requires the company to demonstrate compliance through audit trails. Enabling detailed logging of all access to encrypted data (Option B) provides the necessary records to prove who accessed personal data, when, and from where, fulfilling the 'demonstrate compliance' principle under Article 5(2) and Article 30 of the GDPR.

Answer

Implement client-side encryption with a key management service.

Answer

Automatically delete backups older than 30 days.

Answer

Apply data masking to all personal data fields before storage.

Question 2

A financial institution uses a multi-cloud strategy with AWS and Azure. They must comply with PCI DSS. The security team found that a developer accidentally stored a file with credit card numbers in an S3 bucket that is publicly readable. Which immediate action should be taken to contain the breach?

Accepted Answer

Remove the public read permission on the bucket.. Option C is correct because removing the public read permission on the S3 bucket immediately stops unauthorized access to the file containing credit card numbers, containing the breach in accordance with PCI DSS incident response requirements. This action does not destroy evidence (unlike deletion) and directly addresses the root cause—the bucket's misconfigured access control list (ACL) or bucket policy that allowed public read access. It is the fastest way to prevent further data exfiltration while preserving the file for forensic analysis.

Answer

Delete the file immediately.

Answer

Enable default encryption on the bucket.

Answer

Revoke the developer's IAM credentials.

Question 3

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

Accepted Answer

The cloud service provider.. Option A is correct because the hypervisor is part of the underlying infrastructure, which the CSP manages. Option B is wrong because the customer does not have access to patch the hypervisor. Option C is wrong because a third party is not involved. Option D is wrong because the hypervisor is not typically managed by a regulatory body.

Answer

The customer.

Answer

The regulatory authority.

Answer

A third-party auditor.

Question 4

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 5

An e-commerce company uses a cloud-based web application firewall (WAF) to protect against common web exploits. The security team notices that a specific IP address is sending a high volume of requests that appear to be a DDoS attack. What is the best immediate response to mitigate the attack while minimizing impact on legitimate users?

Accepted Answer

Implement rate limiting on the IP address with a threshold that allows normal traffic.. Option D is correct because rate limiting at the WAF allows the security team to restrict the volume of requests from the offending IP address without completely blocking it. This approach ensures that legitimate traffic from that IP (e.g., a shared NAT gateway or a user with a dynamic IP) can still pass through, while the DDoS attack traffic is throttled. WAFs typically support granular rate-limiting rules based on IP, session, or URI, making this the most precise and least disruptive immediate response.

Answer

Change the DNS to point to a different IP address.

Answer

Increase the compute capacity of the web servers.

Answer

Block the IP address in the WAF.

Question 6

A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?

Accepted Answer

Implement controls to reduce the risk.. Option C is correct because, in risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.

Answer

Ignore the risk until it materializes.

Answer

Accept the risk because the likelihood is low.

Answer

Transfer the risk to a third party.

Question 7

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

Accepted Answer

Encrypt data client-side before uploading to the cloud.. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Answer

Enable detailed audit logging of all data access.

Answer

Implement strict IAM policies for CSP employees.

Answer

Enable server-side encryption with customer-provided keys.

Question 8

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. Option A is correct because a communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 9

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Option A is correct because under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 10

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Accepted Answer

Continuous improvement process.. The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Answer

Business continuity plan.

Answer

Annual penetration testing.

Answer

Encryption of all data at rest.

Question 11

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

Accepted Answer

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".. Option D is correct because modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer

Add a Deny statement for the 10.0.0.0/16 range.

Answer

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Answer

Remove the Condition element to allow access from any IP.

Question 12

Refer to the exhibit. A cloud administrator sees this error log from AWS CloudTrail. The user [email protected] is a member of the 'Analysts' group. Which of the following is the most likely cause of the AccessDenied error?

Accepted Answer

The IAM policy attached to the user or group does not include s3:PutObject for that bucket.. The AccessDenied error for an s3:PutObject operation indicates that the IAM policy attached to the user or group does not grant the necessary permissions. Since the user is a member of the 'Analysts' group, the most likely cause is that the group's IAM policy lacks an Allow effect for s3:PutObject on the target bucket. AWS IAM evaluates both identity-based and resource-based policies, and if no explicit Allow is present, the default implicit deny applies.

Answer

The user is trying to access the bucket from a different AWS region.

Answer

The bucket policy explicitly denies access to the 'Analysts' group.

Answer

The bucket requires server-side encryption and the request did not include encryption headers.

Question 13

A healthcare organization is migrating its electronic health record (EHR) system to a public cloud. The system stores sensitive patient data subject to HIPAA. The cloud architect has designed a multi-tier architecture with load balancers, web servers, application servers, and a PostgreSQL database. The database contains ePHI. To meet compliance, the architect plans to encrypt the database at rest using AWS RDS encryption with KMS. However, during a security review, the compliance officer notes that the database backups are stored in an S3 bucket that is not encrypted. Additionally, the application logs, which may contain patient data, are sent to CloudWatch Logs without encryption. The compliance officer insists that all data stores containing ePHI must be encrypted at rest. Which action should the architect take to ensure compliance?

Accepted Answer

Enable S3 bucket encryption for backups and enable encryption for CloudWatch Logs using KMS.. Option A is correct because HIPAA requires encryption of ePHI at rest in all data stores. The S3 bucket containing unencrypted database backups and the CloudWatch Logs that may contain patient data both need encryption enabled via KMS to meet compliance. AWS RDS encryption protects the live database, but backups and logs are separate storage locations that must also be encrypted.

Answer

Disable automated backups and rely on point-in-time recovery.

Answer

Enable encryption on the RDS instance and use encrypted replicas.

Answer

Enable encryption on the S3 bucket only, since backups are the main concern.

Question 14

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 15

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

Accepted Answer

Ensure cryptographic operations use constant-time algorithms.. Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Answer

Implement virtual LANs (VLANs) and firewall rules between tenants.

Answer

Use hardware security modules (HSMs) for key management.

Answer

Enforce strict API rate limiting for each tenant.

Question 16

A cloud architect is designing a disaster recovery (DR) plan for a financial services application hosted on a public cloud. The plan must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The application uses a relational database and stores files in object storage. Which TWO strategies should the architect recommend to meet these objectives?

Accepted Answer

Deploy a hot standby environment in a different availability zone with automated failover.. Option B is correct because a hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Answer

Take daily snapshots of the database and object storage.

Answer

Maintain a cold standby server that is provisioned only during a disaster.

Answer

Use asynchronous replication for the database to reduce latency.

Question 17

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

Accepted Answer

Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.. The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Answer

Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

Answer

Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

Answer

Implement a data classification policy to label all data assets according to sensitivity.

Question 18

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is the correct legal framework because it specifically governs the processing of personally identifiable information (PII) of European Union citizens, regardless of where the data is stored or processed. As the cloud customer is moving a customer database containing EU PII to a public cloud provider, GDPR imposes strict requirements on the data controller (the customer) for data protection, consent, breach notification, and cross-border data transfer safeguards.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Question 19

A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?

Accepted Answer

Least privilege principle. The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.

Answer

Change management procedures

Answer

Encryption of data at rest

Answer

Physical access controls

Question 20

An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?

Accepted Answer

The bucket's ACLs grant PutObject permission to the authenticated user, which takes effect before the bucket policy is evaluated.. Option C is correct because S3 bucket policies and ACLs are evaluated independently, and if an ACL grants PutObject permission to the authenticated user, that permission is effective even if a bucket policy denies the same action based on a condition like 'aws:SecureTransport'. The AWS CLI request without HTTPS still succeeds because the ACL allows the upload before the bucket policy's Deny statement is evaluated, as S3 evaluates all access control mechanisms and grants access if any applicable policy allows it, unless an explicit Deny is present in the same policy evaluation context. However, the bucket policy's Deny statement does not override the ACL's Allow because the ACL is a separate authorization mechanism that is evaluated first, and S3's authorization model grants access if any of the policies (ACL, bucket policy, user policy) allow the action, provided there is no explicit Deny from the same source.

Answer

The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

Answer

The policy does not apply to requests made by the AWS root account user.

Answer

The bucket policy has a syntax error; the Allow and Deny statements cannot be combined in the same policy.