CCSP Legal, Risk and Compliance Practice Test 6 — 15 Questions

Question 1

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Accepted Answer

2. The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Answer

12

Answer

4

Answer

3

Question 2

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Answer

SOX

Answer

HIPAA

Answer

PCI DSS

Question 3

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Accepted Answer

Certificate of destruction. Option A is correct (Certificate of destruction) provides evidence of secure deletion. Option B (Annual penetration testing) is for security testing, not deletion. Option C (Right to audit) is broad. Option D (Service level credits) are for availability.

Answer

Service level credits

Answer

Annual penetration testing

Answer

Right to audit

Question 4

Which THREE of the following are key components of a data protection impact assessment (DPIA) under GDPR?

Accepted Answer

Measures to address risks. Option C is correct because Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.

Answer

List of all data subjects' names

Answer

Copy of the encryption algorithm

Question 5

Which TWO of the following are common risk treatment options in cloud risk management?

Accepted Answer

Transference. Options A and C are correct. Avoidance and transference (transfer) are standard risk treatment options. Acceptance is also a treatment, but in this question we require exactly two correct, so we chose avoidance and transference. Mitigation is another common option, but it is not listed as correct here.

Answer

Ignorance

Answer

Deletion

Answer

Acceptance

Question 6

Which TWO of the following are requirements for a cloud service agreement to comply with the European Data Protection Board (EDPB) guidelines on data processing?

Accepted Answer

The processor must only process data on documented instructions from the controller. Option B is correct because the EDPB guidelines mandate that a processor may only process personal data on documented instructions from the controller. This ensures the processor’s actions are strictly controlled and auditable, preventing unauthorized processing that could violate GDPR Article 28(3)(a).

Answer

The processor may subcontract processing without notification

Answer

The controller must ensure the processor agrees to audit rights

Answer

The processor must retain data indefinitely

Question 7

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Accepted Answer

The policy allows GetObject requests only from the specified IP range. The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Answer

The policy grants full administrative access to the bucket

Answer

The policy denies all access from the specified IP range

Answer

The bucket is publicly accessible to any IP address

Question 8

Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options:
A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises.
B. Use the provider's default encryption and rely on their BAA that states they will protect the keys.
C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.
D. Disable encryption and rely on access controls and auditing only.

Which option best addresses the compliance requirement while considering the operational impact?

Accepted Answer

Enable client-side encryption using a custom key management system (KMS) on the customer's premises.. Option A is correct because client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.

Answer

Disable encryption and rely on access controls and auditing only.

Answer

Use the provider's default encryption and rely on their BAA that states they will protect the keys.

Answer

Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.

Question 9

A multinational corporation uses a SaaS application for customer relationship management (CRM). The CRM application stores customer data including names, email addresses, and purchase history. The company has operations in the EU, California, and Japan. A new regulation in Japan requires that any transfer of personal data outside Japan must have the data subject's consent if the destination country does not have an adequacy decision. The company's cloud provider stores data in the United States. The company currently relies on the provider's data processing agreement that includes standard contractual clauses (SCCs). However, the Japanese regulator has stated that SCCs are not sufficient for transfers from Japan unless supplemented. You are tasked with ensuring compliance for Japanese data subjects. Which of the following is the most appropriate next step?
A. Obtain explicit consent from each Japanese data subject for data transfer to the US.
B. Move the data for Japanese subjects to a data center in Japan.
C. Continue using SCCs as they are recognized internationally.
D. Pseudonymize the data before transfer.

Which option best addresses the compliance requirement while considering the operational impact?

Accepted Answer

Obtain explicit consent from each Japanese data subject for data transfer to the US.. Option D is correct because the Japanese regulator has explicitly stated that SCCs alone are insufficient for transfers from Japan, and obtaining explicit consent from each data subject directly satisfies the requirement for a valid transfer mechanism under Japanese law. This approach ensures compliance without requiring infrastructure changes, though it may be operationally burdensome. The other options either fail to meet regulatory requirements or introduce unnecessary operational impact.

Answer

Move the data for Japanese subjects to a data center in Japan.

Answer

Continue using SCCs as they are recognized internationally.

Answer

Pseudonymize the data before transfer.

Question 10

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

Accepted Answer

Implement a process to request immediate deletion from the provider and verify completion within 30 days.. Option C is correct because the bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Answer

Store all customer data on-premises and only use the cloud for non-sensitive data.

Answer

Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

Answer

Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

Question 11

A financial services company uses a cloud-based logging service for audit trails. A regulatory investigation is initiated, and the company is required to preserve all logs from the past 18 months. The cloud provider's default retention policy is 12 months, and logs older than that are automatically deleted. The company did not configure custom retention. What is the most appropriate action to ensure compliance?

Accepted Answer

Request that the provider place a legal hold on all logs and verify implementation.. Option C is correct because a legal hold (or litigation hold) is a cloud provider feature that overrides the default retention policy to preserve data indefinitely or for a specified period, preventing automated deletion. This ensures compliance with regulatory requirements without relying on manual exports or backups, and the company must verify implementation through provider tools or APIs to confirm the hold is active.

Answer

Accept the data loss and explain to regulators that the provider has a limited retention policy.

Answer

Export all available logs and store them locally immediately.

Answer

Rely on the provider's backup policy, which may retain data for up to 24 months.

Question 12

A healthcare company uses a cloud-based patient management system. The cloud provider experiences a security incident that may have exposed protected health information (PHI). The provider notifies the company within 72 hours, as required by the service agreement. The company's internal breach response policy requires a legal review of the incident before notifying affected individuals. The legal review typically takes 48 hours. However, the company is required to notify patients within 60 days under HIPAA. With the 72-hour notification from the provider, the company has 60 days to notify patients. What is the most effective approach to meet the 60-day notification requirement while ensuring compliance with internal policy?

Accepted Answer

Begin the legal review immediately and prepare patient notification in parallel.. Option D is correct because it allows the company to satisfy both the HIPAA 60-day notification requirement and its internal legal review policy by running the legal review and patient notification preparation concurrently. This parallel approach minimizes delay while ensuring that the notification content is legally vetted before release, which is critical for PHI incidents under HIPAA's Breach Notification Rule (45 CFR § 164.404).

Answer

Notify patients immediately and then perform the legal review.

Answer

Wait for the legal review to complete before notifying patients.

Answer

Notify patients immediately based on the provider's notification.

Question 13

A company receives an erasure request under GDPR. The cloud provider can delete from active storage within 24 hours but requires 90 days to delete from archives. The company has a contractual obligation to ensure deletion within 30 days. What should the company do?

Accepted Answer

Request the provider to delete from archives within 30 days and verify.. Option C is correct because the company has a contractual obligation to ensure deletion within 30 days, which overrides the provider's default 90-day archive retention policy. The company must formally request the provider to expedite the deletion from archives and verify compliance, as GDPR Article 17 requires the controller to ensure erasure without undue delay, and the provider as processor must assist. Relying on the provider's standard timeline without action would breach the contract and GDPR accountability requirements.

Answer

Delete the data from the application layer only and rely on provider for archives.

Answer

Accept the 90-day timeline and inform the data subject accordingly.

Answer

Reject the request as impractical.

Question 14

A defense contractor uses a cloud provider that is FedRAMP authorized at the Moderate impact level. The contractor's contract requires compliance with DFARS 252.204-7012, which mandates safeguarding covered defense information (CDI) and reporting cyber incidents. The contractor's security team wants to ensure the cloud provider's security controls are adequate. The provider offers a FedRAMP package that includes a System Security Plan (SSP) and a Security Assessment Report (SAR). The contractor's legal department has determined that if the provider is FedRAMP authorized, the audit requirements are satisfied. What is the most efficient way to verify compliance?

Accepted Answer

Use the FedRAMP authorization letter as evidence without further audit.. The FedRAMP authorization letter is the most efficient verification because FedRAMP Moderate authorization is explicitly recognized by the DoD as meeting the security control baseline for DFARS 252.204-7012. The legal department has already determined that FedRAMP authorization satisfies audit requirements, so no additional analysis of the SSP/SAR or third-party testing is needed. Using the authorization letter alone avoids redundant effort while still providing auditable evidence of compliance.

Answer

Request the provider's SSP and SAR and compare against DFARS requirements.

Answer

Engage a third-party auditing firm to assess the provider.

Answer

Perform an independent penetration test on the provider's infrastructure.

Question 15

Which TWO of the following are primary responsibilities of a cloud service customer under the shared responsibility model regarding compliance with regulations such as GDPR?

Accepted Answer

Implementing data encryption for sensitive data at rest. The customer is responsible for data encryption and access controls (B and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

Answer

Conducting annual penetration tests on the provider's infrastructure

Answer

Ensuring the cloud provider's physical security controls are adequate

Answer

Verifying the provider's compliance certifications are current