easyMultiple SelectObjective-mapped
CCSP Practice Question: A multinational corporation stores customer data…
A multinational corporation stores customer data in an AWS S3 bucket located in the US. The company's European customers' personal data must comply with GDPR. Which TWO actions should the company take to ensure compliance with GDPR data transfer requirements?
⚠ Common exam trap
The CCSP exam often tests the distinction between security controls (encryption, access restrictions) and legal transfer mechanisms (SCCs, DPA), trapping candidates who think technical measures alone satisfy GDPR transfer requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign Standard Contractual Clauses (SCCs) with the cloud provider.
Standard Contractual Clauses (SCCs) are a lawful mechanism under GDPR for transferring personal data from the EU to a third country (the US) without an adequacy decision. By signing SCCs with AWS, the company contractually binds the cloud provider to ensure adequate data protection for the European customers' data stored in the US S3 bucket. This directly addresses the GDPR requirement for a valid transfer tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement encryption at rest using AWS KMS with a key stored in the US.
Why it's wrong here
Encryption alone does not provide a legal basis for cross-border data transfers under GDPR.
- ✓
Sign Standard Contractual Clauses (SCCs) with the cloud provider.
Why this is correct
SCCs are a valid adequacy mechanism for transferring personal data to third countries under GDPR.
- ✗
Ensure that the data is only accessed by employees in the EU.
Why it's wrong here
Access location does not change the fact that data is physically stored in the US, still requiring a transfer mechanism.
- ✗
Use AWS Direct Connect to route traffic exclusively through EU-based links.
Why it's wrong here
Direct Connect is a networking service; it does not provide legal compliance for data transfers.
- ✓
Implement a Data Processing Agreement (DPA) with AWS.
Why this is correct
A DPA establishes the responsibilities of the data processor and is required under GDPR for data processing by third parties.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.