CCSP Legal, Risk and Compliance Practice Test 2 — 15 Questions

Question 1

A cloud architect is designing a disaster recovery (DR) plan for a financial services application hosted on a public cloud. The plan must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The application uses a relational database and stores files in object storage. Which TWO strategies should the architect recommend to meet these objectives?

Accepted Answer

Deploy a hot standby environment in a different availability zone with automated failover.. Option B is correct because a hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Answer

Take daily snapshots of the database and object storage.

Answer

Maintain a cold standby server that is provisioned only during a disaster.

Answer

Use asynchronous replication for the database to reduce latency.

Question 2

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

Accepted Answer

Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.. The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Answer

Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

Answer

Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

Answer

Implement a data classification policy to label all data assets according to sensitivity.

Question 3

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is the correct legal framework because it specifically governs the processing of personally identifiable information (PII) of European Union citizens, regardless of where the data is stored or processed. As the cloud customer is moving a customer database containing EU PII to a public cloud provider, GDPR imposes strict requirements on the data controller (the customer) for data protection, consent, breach notification, and cross-border data transfer safeguards.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Question 4

A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?

Accepted Answer

Least privilege principle. The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.

Answer

Change management procedures

Answer

Encryption of data at rest

Answer

Physical access controls

Question 5

An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?

Accepted Answer

The bucket's ACLs grant PutObject permission to the authenticated user, which takes effect before the bucket policy is evaluated.. Option C is correct because S3 bucket policies and ACLs are evaluated independently, and if an ACL grants PutObject permission to the authenticated user, that permission is effective even if a bucket policy denies the same action based on a condition like 'aws:SecureTransport'. The AWS CLI request without HTTPS still succeeds because the ACL allows the upload before the bucket policy's Deny statement is evaluated, as S3 evaluates all access control mechanisms and grants access if any applicable policy allows it, unless an explicit Deny is present in the same policy evaluation context. However, the bucket policy's Deny statement does not override the ACL's Allow because the ACL is a separate authorization mechanism that is evaluated first, and S3's authorization model grants access if any of the policies (ACL, bucket policy, user policy) allow the action, provided there is no explicit Deny from the same source.

Answer

The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

Answer

The policy does not apply to requests made by the AWS root account user.

Answer

The bucket policy has a syntax error; the Allow and Deny statements cannot be combined in the same policy.

Question 6

Drag and drop the steps for setting up a cloud access security broker (CASB) in a SaaS environment into the correct order.

Question 7

Drag and drop the steps for setting up a virtual private cloud (VPC) with public and private subnets in AWS into the correct order.

Question 8

Match each IAM term to its definition.

Question 9

Match each cloud security tool to its primary purpose.

Question 10

A healthcare organization is migrating patient data to a public cloud. Which legal framework most directly governs the protection of this data?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to protected health information (PHI) in the US, making it the most directly relevant legal framework for healthcare data. GDPR is broader but less specific to US healthcare, and PCI DSS is for payment card data.

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Sarbanes-Oxley Act (SOX)

Answer

General Data Protection Regulation (GDPR)

Question 11

During a cloud migration, a company discovers that data stored in a specific region must remain there per contract. The cloud provider offers data replication across regions. What is the best practice to ensure compliance?

Accepted Answer

Use data residency controls provided by the cloud provider. Configuring data residency controls (like tagging and policies) ensures data stays within the required region. Disabling replication across regions is too restrictive and may affect availability; contract negotiation is less efficient than technical controls.

Answer

Negotiate a new contract to allow replication

Answer

Disable all data replication features

Answer

Encrypt data before storing it

Question 12

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

Accepted Answer

Up to $500K, the total fees paid in the past 12 months. The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Answer

The amount of direct damages only

Answer

Full $2M because negligence overrides liability caps

Answer

Zero because the customer accepted the terms

Question 13

A company wants to use a cloud service to store financial records. Which compliance framework most likely applies?

Accepted Answer

Sarbanes-Oxley Act (SOX). SOX applies to financial records of publicly traded companies in the US. GDPR is for EU personal data, HIPAA for healthcare, PCI for payment card data.

Answer

PCI DSS

Answer

GDPR

Answer

HIPAA

Question 14

A cloud customer receives a legal hold notice for pending litigation. The data resides in multi-tenant storage. What is the most appropriate initial action?

Accepted Answer

Preserve the relevant data using customer-accessible tools. Preserving all relevant data from the customer's tenant is required. Alerting other tenants violates privacy; relying solely on provider backup may be insufficient as backups might not be retained indefinitely; doing nothing is non-compliant.

Answer

Do nothing until the provider issues a notice

Answer

Rely on the provider's backup retention cycle

Answer

Alert all other tenants about the hold

Question 15

A company uses a cloud-based intrusion detection system (IDS) that generates logs containing IP addresses. The company is headquartered in a country with data localization laws. What is the primary compliance risk?

Accepted Answer

Log data containing personal data may be processed in a different jurisdiction. Logs contain IP addresses (personal data under many laws) and may be transferred abroad if the IDS vendor processes logs in another jurisdiction, violating localization requirements. Encryption does not solve localization.

Answer

The logs may be tampered with in transit

Answer

The IDS logs consume too much storage

Answer

The IDS may miss certain attack patterns