CCSP Legal, Risk, and Compliance Practice Question
A cloud customer is reviewing its contract with a cloud provider. The customer wants to ensure that if the provider subcontracts any part of the service to a third party, the customer's data remains protected. Which contract provision is most critical to address this risk?
⚠ Common exam trap
The trap here is thinking that a right to audit subcontractors is sufficient, when the more fundamental control is contractual flow-down of obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requirement for provider to flow down data protection obligations to subcontractors
Flow-down obligations ensure that subcontractors are contractually bound to the same data protection standards as the primary provider. This maintains protection throughout the cloud supply chain and is often a regulatory requirement. Other options focus on audit rights, availability, or exit, which do not directly ensure subcontractor compliance with data protection obligations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Requirement for provider to flow down data protection obligations to subcontractors
Why this is correct
This provision ensures that any subcontractor engaged by the provider is bound by the same data protection and security obligations as the provider. It creates a chain of responsibility, so the customer's data remains protected even when handled by third parties. It is a fundamental requirement in cloud contracts, especially under regulations like GDPR, to maintain compliance throughout the supply chain.
- ✗
Right to terminate for convenience
Why it's wrong here
A right to terminate for convenience allows the customer to exit the contract without cause, but it does not prevent data protection risks from subcontractors. It is a remedy after the fact, not a preventive control. The customer needs assurance that data is protected during processing, so termination rights are not the most critical provision for this scenario.
- ✗
Service level agreement (SLA) with penalties for downtime
Why it's wrong here
An SLA with penalties addresses availability, not data protection by subcontractors. While important for service performance, it does not impose any security or privacy requirements on subcontractors. The customer's concern is about data protection, so an SLA is not the most critical provision here and could distract from the real contractual need.
- ✗
Right to audit the provider's subcontractors
Why it's wrong here
A right to audit subcontractors can be valuable, but it is often impractical for a customer to audit every subcontractor, and the provider may resist. More importantly, it does not ensure that the subcontractor is contractually bound to protect data. Without flow-down obligations, the customer's data could be handled without adequate safeguards, so this alone is insufficient.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.