CCSP Legal, Risk and Compliance — Timed 10 Questions

Question 1

A company's cloud infrastructure is subject to GDPR. The DPO requires that all customer personal data be encrypted at rest and in transit. The cloud provider offers SSE-S3 for object storage and enforces TLS 1.2 for API calls. Which additional control should the company implement to meet GDPR accountability requirements?

Accepted Answer

Enable detailed logging of all access to encrypted data.. While SSE-S3 and TLS 1.2 address encryption at rest and in transit, GDPR accountability requires the company to demonstrate compliance through audit trails. Enabling detailed logging of all access to encrypted data (Option B) provides the necessary records to prove who accessed personal data, when, and from where, fulfilling the 'demonstrate compliance' principle under Article 5(2) and Article 30 of the GDPR.

Answer

Implement client-side encryption with a key management service.

Answer

Automatically delete backups older than 30 days.

Answer

Apply data masking to all personal data fields before storage.

Question 2

A financial institution uses a multi-cloud strategy with AWS and Azure. They must comply with PCI DSS. The security team found that a developer accidentally stored a file with credit card numbers in an S3 bucket that is publicly readable. Which immediate action should be taken to contain the breach?

Accepted Answer

Remove the public read permission on the bucket.. Option C is correct because removing the public read permission on the S3 bucket immediately stops unauthorized access to the file containing credit card numbers, containing the breach in accordance with PCI DSS incident response requirements. This action does not destroy evidence (unlike deletion) and directly addresses the root cause—the bucket's misconfigured access control list (ACL) or bucket policy that allowed public read access. It is the fastest way to prevent further data exfiltration while preserving the file for forensic analysis.

Answer

Delete the file immediately.

Answer

Enable default encryption on the bucket.

Answer

Revoke the developer's IAM credentials.

Question 3

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

Accepted Answer

The cloud service provider.. Option A is correct because the hypervisor is part of the underlying infrastructure, which the CSP manages. Option B is wrong because the customer does not have access to patch the hypervisor. Option C is wrong because a third party is not involved. Option D is wrong because the hypervisor is not typically managed by a regulatory body.

Answer

The customer.

Answer

The regulatory authority.

Answer

A third-party auditor.

Question 4

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 5

An e-commerce company uses a cloud-based web application firewall (WAF) to protect against common web exploits. The security team notices that a specific IP address is sending a high volume of requests that appear to be a DDoS attack. What is the best immediate response to mitigate the attack while minimizing impact on legitimate users?

Accepted Answer

Implement rate limiting on the IP address with a threshold that allows normal traffic.. Option D is correct because rate limiting at the WAF allows the security team to restrict the volume of requests from the offending IP address without completely blocking it. This approach ensures that legitimate traffic from that IP (e.g., a shared NAT gateway or a user with a dynamic IP) can still pass through, while the DDoS attack traffic is throttled. WAFs typically support granular rate-limiting rules based on IP, session, or URI, making this the most precise and least disruptive immediate response.

Answer

Change the DNS to point to a different IP address.

Answer

Increase the compute capacity of the web servers.

Answer

Block the IP address in the WAF.

Question 6

A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?

Accepted Answer

Implement controls to reduce the risk.. Option C is correct because, in risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.

Answer

Ignore the risk until it materializes.

Answer

Accept the risk because the likelihood is low.

Answer

Transfer the risk to a third party.

Question 7

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

Accepted Answer

Encrypt data client-side before uploading to the cloud.. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Answer

Enable detailed audit logging of all data access.

Answer

Implement strict IAM policies for CSP employees.

Answer

Enable server-side encryption with customer-provided keys.

Question 8

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. Option A is correct because a communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 9

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Option A is correct because under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 10

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Accepted Answer

Continuous improvement process.. The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Answer

Business continuity plan.

Answer

Annual penetration testing.

Answer

Encryption of all data at rest.