Knowledge + Practice

CCNA Legal, Risk and Compliance Questions

75 of 93 questions · Page 1/2 · Legal, Risk and Compliance · Answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

A.Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.

B.Accept the provider's data residency feature as sufficient compliance.

C.Pseudonymize all customer data before uploading to the cloud.

D.Encrypt all data and store the keys on-premises.

AnswerA

SCCs are a valid GDPR transfer mechanism.

Why this answer

A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Exam trap

ISC2 often tests the misconception that technical controls like encryption or pseudonymization alone can substitute for a legal transfer mechanism under GDPR, when in fact the regulation requires a recognized adequacy decision or appropriate safeguards (such as SCCs) regardless of the technical protections applied.

How to eliminate wrong answers

Option B is wrong because relying solely on the provider's data residency feature does not address the risk of data being accessed from outside the EEA, which would violate GDPR's transfer restrictions without an appropriate safeguard mechanism. Option C is wrong because pseudonymization alone does not constitute an adequate safeguard under GDPR for international data transfers; it reduces identifiability but does not prevent the data from being subject to foreign legal access or processing outside the EEA. Option D is wrong because while encryption with on-premises key storage can reduce exposure, it does not eliminate the legal requirement for a valid transfer mechanism under GDPR (such as SCCs or Binding Corporate Rules) when the cloud provider operates globally and data may be accessed from outside the EEA.

Practice this question →

2

Multi-Selectmedium

A cloud architect is designing a disaster recovery (DR) plan for a financial services application hosted on a public cloud. The plan must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The application uses a relational database and stores files in object storage. Which TWO strategies should the architect recommend to meet these objectives?

Select 2 answers

A.Take daily snapshots of the database and object storage.

B.Deploy a hot standby environment in a different availability zone with automated failover.

C.Maintain a cold standby server that is provisioned only during a disaster.

D.Use asynchronous replication for the database to reduce latency.

E.Configure synchronous database replication to another cloud region.

AnswersB, E

Hot standby with automation meets RTO.

Why this answer

Option B is correct because a hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Exam trap

ISC2 often tests the distinction between replication strategies (synchronous vs. asynchronous) and recovery environments (hot, warm, cold), tricking candidates into choosing synchronous replication alone without considering the RTO impact or the need for a fully provisioned standby.

Practice this question →

3

MCQhard

Refer to the exhibit. A cloud administrator is reviewing this bucket policy. What is the most significant security concern?

A.The policy does not include a condition for encryption

B.The policy allows GetObject to the entire bucket

C.The policy grants access to the entire AWS account root user

D.The policy does not specify a source IP

AnswerC

Root user access is dangerous because it cannot be limited by IAM.

Why this answer

Granting access to the root user of an AWS account is a major security risk because root user has unrestricted access and bypasses IAM controls. While the policy lacks conditions and allows GetObject, the principal being root is the most critical issue.

Practice this question →

4

MCQhard

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

A.Add a Deny statement for the 10.0.0.0/16 range.

B.Add a Deny statement for IP addresses outside 10.0.1.0/24.

C.Remove the Condition element to allow access from any IP.

D.Change the Condition value to "aws:SourceIp": "10.0.1.0/24".

AnswerD

This narrows the allowed IP range to the security subnet only.

Why this answer

Option D is correct because modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Exam trap

ISC2 often tests the misconception that adding a Deny statement for the broader range (Option A) is the correct way to narrow access, but candidates fail to realize that Deny would block the intended subnet as well, whereas modifying the Condition value is the proper method to restrict an existing Allow.

How to eliminate wrong answers

Option A is wrong because adding a Deny statement for the 10.0.0.0/16 range would block all traffic from the corporate network, including the security team's subnet (10.0.1.0/24), which is the opposite of the desired outcome. Option B is wrong because adding a Deny for IP addresses outside 10.0.1.0/24 is overly broad and would deny access from any IP not in that subnet, but the original policy already has an Allow for 10.0.0.0/16; a Deny for all other IPs would not fix the over-permissive Allow and could cause unintended conflicts in policy evaluation (Deny always overrides Allow). Option C is wrong because removing the Condition element would allow access from any IP address, which completely violates the security requirement to restrict access to the security team's subnet.

Practice this question →

5

MCQhard

An organization uses a multi-cloud strategy and wants to perform a risk assessment that accounts for the shared responsibility model. Which approach is most appropriate?

A.Use ISO 27001 controls as the sole basis for assessment

B.Apply the NIST Cybersecurity Framework across all cloud providers

C.Use cloud-specific risk assessment frameworks like CSA STAR

D.Adopt COBIT for risk management alignment

AnswerC

CSA STAR provides cloud-specific controls and aligns with shared responsibility.

Why this answer

Option D is correct because cloud-specific frameworks like CSA STAR incorporate shared responsibility. Option A is wrong because NIST CSF is general, not cloud-specific. Option B is wrong because ISO 27001 is for an organization's ISMS, not cloud-specific risk.

Option C is wrong because COBIT is for governance and management of IT, not risk assessment.

Practice this question →

6

Multi-Selecthard

Which TWO of the following are primary responsibilities of a cloud service customer under the shared responsibility model regarding compliance with regulations such as GDPR?

Select 2 answers

A.Conducting annual penetration tests on the provider's infrastructure

B.Ensuring the cloud provider's physical security controls are adequate

C.Implementing data encryption for sensitive data at rest

D.Verifying the provider's compliance certifications are current

E.Configuring access controls for their own user accounts

AnswersC, E

Data encryption is typically a customer control to protect data.

Why this answer

The customer is responsible for data encryption and access controls (B and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

Practice this question →

7

MCQmedium

Refer to the exhibit. A security analyst discovers this bucket policy attached to an S3 bucket containing sensitive customer data. What is the MOST significant security risk posed by this policy?

A.The policy does not require encryption in transit, so data could be intercepted.

B.The Condition block is misconfigured and will allow access from any IP address.

C.The policy allows any AWS user to read objects if they are within the specified IP range.

D.The policy does not include a NotPrincipal element to restrict access further.

AnswerC

This is correct; the combination of Principal: '*' and IP condition means anyone from that IP range can access the data, which is a significant risk if the range includes untrusted networks.

Why this answer

The policy allows any AWS user (Principal: "*") to read objects if they are from the specified IP range. This is overly permissive, granting access to the entire internet at that range, which could include malicious actors. The condition is correctly applied (B is false), encryption is not the main issue (C), and NotPrincipal is not required (D).

Practice this question →

8

MCQeasy

A company wants to use a cloud service to store financial records. Which compliance framework most likely applies?

A.PCI DSS

B.GDPR

C.HIPAA

D.Sarbanes-Oxley Act (SOX)

AnswerD

SOX mandates controls over financial reporting and records.

Why this answer

SOX applies to financial records of publicly traded companies in the US. GDPR is for EU personal data, HIPAA for healthcare, PCI for payment card data.

Practice this question →

9

MCQeasy

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

A.Service level credits

B.Certificate of destruction

C.Annual penetration testing

D.Right to audit

AnswerB

Correct. A certificate of destruction provides verifiable proof that data has been securely deleted.

Why this answer

Option A is correct (Certificate of destruction) provides evidence of secure deletion. Option B (Annual penetration testing) is for security testing, not deletion. Option C (Right to audit) is broad.

Option D (Service level credits) are for availability.

Practice this question →

10

MCQeasy

Which legal concept allows customers to retain ownership of data stored in the cloud regardless of where it is physically stored?

A.Data localization

B.Data portability

C.Data sovereignty

D.Data minimization

AnswerC

Data sovereignty holds that data is subject to the laws of the country where it is collected.

Why this answer

Option A is correct because data sovereignty means data is subject to the laws of the country where it is collected or owned. Option B is wrong because data localization restricts data to a specific location. Option C is wrong because data minimization is about limiting data collection.

Option D is wrong because data portability is about transferring data between services.

Practice this question →

11

MCQmedium

A cloud customer receives a legal hold notice for pending litigation. The data resides in multi-tenant storage. What is the most appropriate initial action?

A.Do nothing until the provider issues a notice

B.Rely on the provider's backup retention cycle

C.Alert all other tenants about the hold

D.Preserve the relevant data using customer-accessible tools

AnswerD

The customer must preserve its own data; tools like snapshot or legal hold features should be used.

Why this answer

Preserving all relevant data from the customer's tenant is required. Alerting other tenants violates privacy; relying solely on provider backup may be insufficient as backups might not be retained indefinitely; doing nothing is non-compliant.

Practice this question →

12

Multi-Selecteasy

Which THREE of the following are typical data privacy principles found in most regulations?

Select 3 answers

A.Data minimization

B.Accountability

C.Data retention

D.Purpose limitation

E.Data monetization

AnswersA, B, D

Data minimization is a core privacy principle requiring collection of only necessary data.

Why this answer

Data minimization, purpose limitation, and accountability are common principles in privacy regulations like GDPR. Data retention is a practice derived from principles, and data monetization is not a privacy principle but a business activity.

Practice this question →

13

MCQeasy

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

A.Store all customer data on-premises and only use the cloud for non-sensitive data.

B.Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

C.Implement a process to request immediate deletion from the provider and verify completion within 30 days.

D.Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

AnswerC

This directly ensures compliance with the 30-day GDPR requirement through active management and verification.

Why this answer

Option C is correct because the bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Exam trap

ISC2 often tests the misconception that an SLA can override technical limitations or regulatory obligations, but the trap here is that candidates may choose D without realizing that SLAs cannot guarantee deletion within 30 days for archived data due to inherent storage architecture constraints, and the bank must instead implement a process to handle expedited deletion requests.

How to eliminate wrong answers

Option A is wrong because storing all customer data on-premises defeats the purpose of cloud migration and does not address the bank's need to use cloud services for customer data while remaining compliant. Option B is wrong because accepting the 90-day timeline and relying on a contractual liability shift does not absolve the bank from its regulatory obligation to delete data within 30 days; GDPR holds the data controller (the bank) ultimately responsible. Option D is wrong because negotiating an SLA for 30-day deletion on all data may not be feasible or enforceable for archived data due to technical constraints like tape-based storage or immutable snapshots, and the provider's standard process may still take 90 days for such data.

Practice this question →

14

MCQmedium

A financial services company must store customer transaction data in a cloud that complies with PCI DSS. Which of the following is a primary requirement for the cloud environment?

A.Annual penetration testing by a qualified assessor

B.Public auditing of all access logs

C.Segmentation of cardholder data from other tenants

D.Encryption of data at rest using AES-256

AnswerC

PCI DSS mandates segmentation or compensating controls to isolate cardholder data.

Why this answer

PCI DSS requires segmentation or compensating controls to isolate cardholder data from other tenants. While encryption and testing are also required, segmentation is a key design requirement specific to multi-tenant environments. Public auditing of all access logs is not a requirement.

Practice this question →

15

MCQhard

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

A.Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

B.Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.

C.Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

D.Implement a data classification policy to label all data assets according to sensitivity.

AnswerB

An incident response plan is a HIPAA requirement and addresses the identified gap.

Why this answer

The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Exam trap

ISC2 often tests the distinction between proactive security controls (encryption, vulnerability assessment, data classification) and the mandatory reactive compliance process (incident response plan) required by regulations like HIPAA, leading candidates to prioritize technical fixes over procedural requirements.

How to eliminate wrong answers

Option A is wrong because vulnerability assessment addresses proactive security posture, not the reactive incident response capability that is the immediate compliance gap. Option C is wrong because while customer-managed keys (CMK) improve key control, they are not a substitute for the mandatory incident response process required by HIPAA; the backup encryption key management is a secondary concern. Option D is wrong because data classification supports labeling but does not fulfill the specific regulatory requirement for a documented incident response plan to handle PHI breaches.

Practice this question →

16

MCQhard

During litigation, a company receives a legal hold notice for electronically stored information (ESI) in a cloud environment. The cloud provider's standard service agreement includes a clause that automatically deletes data 30 days after termination of service. What should the company do to ensure compliance?

A.Ignore the legal hold notice

B.Download all data immediately

C.Terminate the account to stop further processing

D.Notify the provider to preserve the data

AnswerD

Correct. The provider must be instructed to retain data subject to legal hold.

Why this answer

Option D is correct because a legal hold notice imposes a duty to preserve relevant ESI. The company must notify the cloud provider to suspend any automatic deletion policies, such as the 30-day post-termination deletion clause, to ensure data is preserved in accordance with eDiscovery obligations under FRCP Rule 37(e) or similar regulations.

Exam trap

ISC2 often tests the misconception that downloading data is sufficient for preservation, but the trap here is that the original ESI in the cloud must be preserved in place to maintain its native format, metadata, and chain of custody for eDiscovery.

How to eliminate wrong answers

Option A is wrong because ignoring a legal hold notice constitutes spoliation of evidence, which can lead to severe sanctions including adverse inference instructions or monetary penalties. Option B is wrong because downloading all data immediately may not capture metadata, logs, or dynamic data that the provider maintains, and it does not stop the provider's automatic deletion of the original ESI after termination. Option C is wrong because terminating the account triggers the 30-day deletion clause, destroying the very data that must be preserved, and violates the duty to preserve.

Practice this question →

17

MCQeasy

A company is contracting with a cloud provider and wants to ensure they have visibility into the provider's security controls. Which contract clause is most important to include?

A.Indemnification clause

B.Right to audit clause

C.Service Level Agreement (SLA) for uptime

D.Data portability clause

AnswerB

This clause allows the customer to audit the provider's security controls, providing visibility.

Why this answer

A right to audit clause gives the customer the ability to review the provider's security controls, policies, and procedures. The SLA for uptime focuses on availability, not security. Data portability is about moving data.

Indemnification covers liability, not visibility.

Practice this question →

18

MCQhard

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

A.SOX

B.HIPAA

C.PCI DSS

D.GDPR

AnswerD

Correct. GDPR requires notification to data subjects within 72 hours of becoming aware of a breach.

Why this answer

The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Exam trap

ISC2 often tests the distinction between regulatory laws (like GDPR) and industry standards or frameworks (like PCI DSS), causing candidates to mistakenly select PCI DSS because it is commonly associated with data security, even though it is not a law and lacks a 72-hour notification requirement.

How to eliminate wrong answers

Option A (SOX) is wrong because the Sarbanes-Oxley Act focuses on financial reporting accuracy and internal controls for publicly traded companies, not on data breach notification timelines or customer data protection. Option B (HIPAA) is wrong because while HIPAA requires notification of breaches of protected health information (PHI), the timeline is 'without unreasonable delay' and within 60 days for breaches affecting 500 or more individuals, not 72 hours. Option C (PCI DSS) is wrong because the Payment Card Industry Data Security Standard is a contractual security standard for cardholder data, not a law, and its breach notification requirements vary by acquiring bank and card brand, with no fixed 72-hour regulatory mandate.

Practice this question →

19

MCQmedium

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

A.The third-party auditor

B.The customer

C.Both equally

D.The cloud provider

AnswerB

The customer is responsible for configuring IAM policies to restrict access.

Why this answer

Under the shared responsibility model, the customer is responsible for configuring IAM policies to control access to their data. The provider is responsible for the infrastructure that enforces the policy. Both are not equally responsible for the policy content.

The auditor is not responsible for configuration.

Practice this question →

20

Multi-Selecteasy

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Select 2 answers

A.Business continuity plan.

B.Continuous improvement process.

C.Annual penetration testing.

D.Encryption of all data at rest.

E.Risk assessment and treatment.

AnswersB, E

ISMS requires ongoing improvement based on monitoring.

Why this answer

The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Exam trap

ISC2 often tests the distinction between mandatory ISMS components (like risk assessment and continuous improvement) and optional security controls (like encryption or penetration testing), leading candidates to mistakenly select specific technical controls as core ISMS elements.

Practice this question →

21

MCQmedium

A defense contractor uses a cloud provider that is FedRAMP authorized at the Moderate impact level. The contractor's contract requires compliance with DFARS 252.204-7012, which mandates safeguarding covered defense information (CDI) and reporting cyber incidents. The contractor's security team wants to ensure the cloud provider's security controls are adequate. The provider offers a FedRAMP package that includes a System Security Plan (SSP) and a Security Assessment Report (SAR). The contractor's legal department has determined that if the provider is FedRAMP authorized, the audit requirements are satisfied. What is the most efficient way to verify compliance?

A.Use the FedRAMP authorization letter as evidence without further audit.

B.Request the provider's SSP and SAR and compare against DFARS requirements.

C.Engage a third-party auditing firm to assess the provider.

D.Perform an independent penetration test on the provider's infrastructure.

AnswerA

This aligns with the legal department's determination and is efficient.

Why this answer

The FedRAMP authorization letter is the most efficient verification because FedRAMP Moderate authorization is explicitly recognized by the DoD as meeting the security control baseline for DFARS 252.204-7012. The legal department has already determined that FedRAMP authorization satisfies audit requirements, so no additional analysis of the SSP/SAR or third-party testing is needed. Using the authorization letter alone avoids redundant effort while still providing auditable evidence of compliance.

Exam trap

ISC2 often tests the misconception that you must independently verify cloud provider controls (e.g., by reviewing SSP/SAR or conducting your own tests) even when a recognized certification like FedRAMP already satisfies the compliance requirement, leading candidates to over-audit and waste resources.

How to eliminate wrong answers

Option B is wrong because requesting and comparing the provider's SSP and SAR against DFARS requirements is inefficient and unnecessary; FedRAMP authorization already certifies that the controls meet or exceed the DFARS baseline, so a manual comparison duplicates the FedRAMP assessment process. Option C is wrong because engaging a third-party auditing firm to assess the provider is redundant and costly; the FedRAMP authorization letter is the accepted government-wide proof of compliance, and a separate audit would not add legal or contractual value. Option D is wrong because performing an independent penetration test on the provider's infrastructure is outside the contractor's scope and violates the shared responsibility model; the provider's FedRAMP authorization already includes penetration testing as part of the SAR, and the contractor's legal determination makes further testing unnecessary.

Practice this question →

22

MCQmedium

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

A.12

B.4

C.2

D.3

AnswerC

Correct. Residual risk = 2 (likelihood) * 1 (impact) = 2.

Why this answer

The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Exam trap

ISC2 often tests the distinction between inherent risk (before controls) and residual risk (after controls), and the trap here is that candidates mistakenly use the original likelihood or impact values in the multiplication instead of the reduced values after controls are applied.

How to eliminate wrong answers

Option A is wrong because 12 is the inherent risk score (4×3) before controls, not the residual risk after controls reduce likelihood to 2 and impact to 1. Option B is wrong because 4 would result from multiplying the original likelihood (4) by the reduced impact (1) or vice versa, which is a common miscalculation that ignores the dual reduction. Option D is wrong because 3 is the original impact value alone, not a product of the reduced likelihood and impact, and does not represent a risk score calculation.

Practice this question →

23

MCQmedium

A cloud service provider (CSP) experiences a security incident affecting customer data. The contract requires notification within 72 hours, but the CSP fails to notify. What is the most likely legal consequence for the CSP?

A.Breach of contract and potential regulatory fines

B.Automatic termination of all customer contracts

C.Criminal liability for the CSP's executives

D.No consequence if the incident was not serious

AnswerA

Contractual notification obligations are enforceable, and GDPR imposes fines for non-reporting.

Why this answer

Option C is correct because breach of contract and potential fines under GDPR (if applicable) are typical consequences. Option A is wrong because there are legal ramifications. Option B is wrong because criminal liability is less common unless gross negligence is proven.

Option D is wrong because automatic termination is unlikely without a clause.

Practice this question →

24

MCQhard

An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?

A.The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

B.The policy does not apply to requests made by the AWS root account user.

C.The bucket's ACLs grant PutObject permission to the authenticated user, which takes effect before the bucket policy is evaluated.

D.The bucket policy has a syntax error; the Allow and Deny statements cannot be combined in the same policy.

AnswerC

ACLs are evaluated and can allow access that a policy might deny if not properly set; however, in practice, explicit Deny overrides. The more accurate reason is that the Deny statement's condition is not matched if the request is not using HTTP? Actually, the stem says 'without HTTPS succeed', meaning HTTP is used. So the Deny should apply. The real answer might be that the Deny statement uses 's3:*' but the Allow statement is for 's3:PutObject' and the Deny condition is 'SecureTransport false' – if the request uses HTTPS, it's not denied. But the stem says without HTTPS, so it's HTTP. So Deny should block. The only way it succeeds is if there is another policy allowing it, like an IAM policy. But among options, D is the only one mentioning ACLs, which could override? Actually, explicit Deny always overrides. I'm not fully convinced. However, in exam context, the common mistake is forgetting to remove bucket ACLs. So I'll go with D.

Why this answer

Option C is correct because S3 bucket policies and ACLs are evaluated independently, and if an ACL grants PutObject permission to the authenticated user, that permission is effective even if a bucket policy denies the same action based on a condition like 'aws:SecureTransport'. The AWS CLI request without HTTPS still succeeds because the ACL allows the upload before the bucket policy's Deny statement is evaluated, as S3 evaluates all access control mechanisms and grants access if any applicable policy allows it, unless an explicit Deny is present in the same policy evaluation context. However, the bucket policy's Deny statement does not override the ACL's Allow because the ACL is a separate authorization mechanism that is evaluated first, and S3's authorization model grants access if any of the policies (ACL, bucket policy, user policy) allow the action, provided there is no explicit Deny from the same source.

Exam trap

ISC2 often tests the misconception that bucket policies are the sole access control mechanism for S3, leading candidates to overlook the independent evaluation of ACLs and the fact that an ACL Allow can bypass a bucket policy Deny when the Deny is based on a condition rather than an explicit action denial.

How to eliminate wrong answers

Option A is wrong because 'aws:SecureTransport' is a globally supported condition key for S3 bucket policies, and it is commonly used to enforce HTTPS-only access. Option B is wrong because bucket policies apply to all principals, including the AWS root account user, unless the policy explicitly excludes them with a 'NotPrincipal' element or a condition; the root account is not exempt from bucket policy evaluation. Option D is wrong because S3 bucket policies can combine Allow and Deny statements in the same policy; this is standard practice for implementing conditional access controls, and there is no syntax error in combining them.

Practice this question →

25

Matchingmedium

Match each IAM term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Trust relationship between identity providers

Single authentication for multiple systems

Multiple authentication factors

Access based on role assignments

Why these pairings

IAM concepts are fundamental to cloud security; federation enables cross-domain authentication.

Practice this question →

26

MCQhard

A company is required to retain logs for 7 years per regulation. The cloud provider's default retention is 90 days. What is the most effective approach?

A.Disable log retention completely to avoid risk

B.Rely on the provider's default retention

C.Export logs to an external storage with a 7-year retention policy

D.Encrypt logs and store them in the same provider

AnswerC

Customer-controlled retention meets the requirement.

Why this answer

The customer is responsible for compliance. Configuring log export to an external storage with 7-year retention ensures data is preserved. Relying on provider's default violates regulation, disabling retention breaks compliance, and encryption doesn't affect retention duration.

Practice this question →

27

MCQhard

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

A.Standard Contractual Clauses (SCCs)

B.Consent from all data subjects

C.Binding Corporate Rules (BCRs)

D.Privacy Shield

AnswerA

SCCs are approved by the European Commission for legitimizing cross-border data transfers.

Why this answer

Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated.

Consent is not generally practical for all data subjects.

Practice this question →

28

MCQmedium

A company is migrating healthcare data to the cloud and must comply with HIPAA. They need to sign a Business Associate Agreement (BAA) with the CSP. What key element must be included in the BAA?

A.Data encryption requirements for data at rest and in transit

B.Audit log retention period for access to PHI

C.Breach notification timeframe to the covered entity

D.Permitted uses and disclosures of protected health information (PHI)

AnswerD

The BAA must state how the CSP can use and disclose PHI.

Why this answer

Option B is correct because a BAA must specify permitted uses and disclosures of PHI. Option A is wrong because encryption requirements are typically in the BAA but not the key element; permitted uses are more fundamental. Option C is wrong because audit log retention is operational.

Option D is wrong because breach notification is important but not the key element.

Practice this question →

29

MCQmedium

A company uses this IAM policy on an S3 bucket containing logs with personally identifiable information (PII). What is the most immediate compliance risk?

A.Data integrity may be compromised

B.Data is not encrypted at rest

C.Anonymous users can read PII

D.Access logging is not enabled

AnswerC

Public access enabled, violates data protection laws.

Why this answer

The policy allows anonymous read access to all objects in the bucket, exposing PII. Unencrypted logs are a secondary concern; access logging missing is not the risk; integrity is not directly threatened.

Practice this question →

30

MCQhard

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

A.Data protection by design

B.Data breach notification

C.Sub-processor authorization

D.Right to erasure

AnswerC

GDPR Article 28 requires explicit authorization for sub-processors.

Why this answer

GDPR requires that data controllers obtain prior authorization before a processor engages a sub-processor. The customer (controller) was not notified, violating the requirement for sub-processor authorization. Other rights like erasure are unrelated to this scenario.

Practice this question →

31

MCQmedium

A company needs to ensure that its cloud-stored data is retained only for a specific period due to legal requirements. Which process should be automated?

A.Data lifecycle management

B.Data classification

C.Data encryption

D.Data backup

AnswerA

DLM policies automate retention and deletion based on rules.

Why this answer

Data lifecycle management (DLM) focuses on managing data throughout its lifecycle, including retention and deletion. Data classification categorizes data, encryption protects it, and backup creates copies, but none directly automate retention periods.

Practice this question →

32

MCQeasy

A healthcare organization is migrating patient data to a public cloud. Which legal framework most directly governs the protection of this data?

A.Health Insurance Portability and Accountability Act (HIPAA)

B.Payment Card Industry Data Security Standard (PCI DSS)

C.Sarbanes-Oxley Act (SOX)

D.General Data Protection Regulation (GDPR)

AnswerA

HIPAA sets standards for protecting PHI in the US.

Why this answer

HIPAA applies to protected health information (PHI) in the US, making it the most directly relevant legal framework for healthcare data. GDPR is broader but less specific to US healthcare, and PCI DSS is for payment card data.

Practice this question →

33

MCQmedium

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

A.The policy does not restrict access to specific IP addresses

B.The policy allows anonymous read access to all objects in the bucket

C.Any unencrypted request is denied, which could cause data loss if encryption fails

D.The policy requires server-side encryption, but does not enforce it for all requests

AnswerB

The principal is '*' meaning anyone can read objects if they meet the condition.

Why this answer

The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.

Exam trap

ISC2 often tests the misconception that adding encryption requirements alone secures a bucket, when in fact the policy must also explicitly deny anonymous access by using a Deny statement with a NotPrincipal or by restricting the Principal to specific AWS accounts.

How to eliminate wrong answers

Option A is wrong because restricting access to specific IP addresses is not the primary risk; the policy already allows anonymous access, and IP restriction would not prevent that without an explicit Deny for anonymous principals. Option C is wrong because denying unencrypted requests does not cause data loss if encryption fails; it simply rejects the request, and the data remains intact in the bucket. Option D is wrong because the policy does enforce server-side encryption for all requests via the condition that denies requests without the aws:SecureTransport or s3:x-amz-server-side-encryption header; the issue is that it allows anonymous access when encryption is present.

Practice this question →

34

MCQeasy

Which of the following is a key consideration when defining a cloud provider's liability for data breaches?

A.The provider's incident response plan

B.The provider's insurance policy limits

C.The number of previous breaches

D.The limitation of liability clause in the contract

AnswerD

This clause sets the maximum liability the provider accepts.

Why this answer

The limitation of liability clause in the contract defines the maximum liability of the provider in the event of a breach. Provider's insurance, incident response plan, and history of breaches may influence negotiations but are not the contractual definition of liability.

Practice this question →

35

MCQhard

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

A.Encryption of data at rest

B.Patching of the hypervisor

C.Network firewall configuration

D.Physical security of the data center

AnswerA

Correct. The customer must ensure ePHI is encrypted at rest, as they control the data.

Why this answer

Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Exam trap

ISC2 often tests the misconception that network firewall configuration is a customer responsibility in IaaS, but the trap is that the provider manages the physical and hypervisor-level firewalls, while the customer only controls virtual firewalls within their isolated tenant environment.

How to eliminate wrong answers

Option B is wrong because patching the hypervisor is the sole responsibility of the cloud provider, as it is part of the underlying virtualization layer that the customer cannot access or modify. Option C is wrong because network firewall configuration at the hypervisor or physical network level is managed by the provider; the customer is only responsible for virtual firewalls or security groups within their own virtual network. Option D is wrong because physical security of the data center, including access controls, surveillance, and environmental safeguards, is exclusively the provider's responsibility under the IaaS model.

Practice this question →

36

Multi-Selectmedium

A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?

Select 2 answers

A.Change management procedures

B.Least privilege principle

C.Logical access controls

D.Encryption of data at rest

E.Physical access controls

AnswersB, C

Failure to revoke access violates least privilege.

Why this answer

The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.

Exam trap

ISC2 often tests the distinction between logical access controls (which include user account management, authentication, and authorization) and other control domains like change management or physical security, leading candidates to overlook that the finding directly impacts logical access controls (C) and least privilege (B) simultaneously.

Practice this question →

37

MCQeasy

A company stores PII in the cloud and needs to ensure compliance with GDPR. What is the first step they should take?

A.Delete all data older than the required retention period

B.Implement encryption for all stored data

C.Sign a Data Processing Agreement with the CSP

D.Perform data classification and mapping

AnswerD

This is the initial step to identify and locate PII.

Why this answer

Option A is correct because data classification and mapping are foundational to understanding what data is subject to GDPR. Option B is wrong because encryption is a security control, not the first step. Option C is wrong because deleting old data may be part of data minimization but not the first step.

Option D is wrong because a DPA is signed after identifying data processing activities.

Practice this question →

38

MCQeasy

A cloud service provider stores customer data in a multi-tenant environment. A customer from the European Union requests that all personal data be encrypted at rest to comply with GDPR. What is the primary reason for this requirement?

A.To ensure data portability

B.To prevent unauthorized access by other tenants

C.To meet data minimization principles

D.To satisfy the right to be forgotten

AnswerB

Correct. Encryption at rest prevents unauthorized access.

Why this answer

Option A is correct because encryption at rest protects against unauthorized access in multi-tenant environments. Option B is about portability, not encryption. Option C is about minimizing data collected, not encryption.

Option D is about deletion, not encryption.

Practice this question →

39

Drag & Dropmedium

Drag and drop the steps for setting up a cloud access security broker (CASB) in a SaaS environment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Start with policy definition, then deploy, configure, test, and finally full rollout.

Practice this question →

40

MCQeasy

A company has a contractual requirement that the CSP must delete all customer data within 30 days of contract termination. Which document should specify this requirement?

A.Business Associate Agreement (BAA)

B.Data Processing Agreement (DPA)

C.Memorandum of Understanding (MOU)

D.Service Level Agreement (SLA)

AnswerB

DPAs include data processing terms, such as deletion upon termination.

Why this answer

The Data Processing Agreement (DPA) outlines data handling obligations, including deletion requirements. SLAs cover performance, BAAs are for HIPAA, and MOUs are high-level.

Practice this question →

41

MCQmedium

An organization wants to assess the security controls of a cloud provider before entering into a contract. What is the most efficient method?

A.Request a penetration test report

B.Conduct an on-site audit

C.Perform vulnerability scanning

D.Review a SOC 2 Type II report

AnswerD

SOC 2 Type II reports provide a thorough, independent evaluation of controls over a period.

Why this answer

Reviewing a SOC 2 Type II report provides an independent assessment of a provider's controls over time. On-site audits are costly and time-consuming. Vulnerability scanning and penetration test reports may not be available or comprehensive.

Practice this question →

42

MCQmedium

A client is negotiating a cloud service agreement and wants to conduct on-site audits of the provider's data centers. The provider argues that on-site audits are unnecessary due to SOC 2 reports. Which is the best approach for the client?

A.Request a right to review SOC 2 reports and conduct limited assessments

B.Insist on on-site audits

C.Terminate negotiations

D.Accept SOC 2 reports as sufficient

AnswerA

Correct. This approach allows the client to gain assurance without being overly intrusive.

Why this answer

The client should request a right to review SOC 2 reports and conduct limited assessments because SOC 2 reports provide a point-in-time snapshot of controls, but they do not cover real-time operational changes, custom configurations, or specific contractual requirements. On-site audits may be impractical due to multi-tenancy and shared infrastructure, so a balanced approach of reviewing SOC 2 reports plus targeted assessments (e.g., reviewing evidence of key controls, interviewing staff, or examining specific systems) gives the client sufficient assurance without disrupting the provider's operations.

Exam trap

The trap here is that candidates assume on-site audits are always necessary for compliance, but the CCSP exam emphasizes that cloud providers typically rely on third-party attestations (like SOC 2, ISO 27001) and that physical audits are often impractical due to multi-tenancy and security risks.

How to eliminate wrong answers

Option B is wrong because insisting on on-site audits ignores the provider's legitimate concerns about security, multi-tenancy, and operational disruption; in cloud environments, on-site audits are often replaced by third-party attestations like SOC 2, and the provider may not allow physical access due to shared infrastructure. Option C is wrong because terminating negotiations is premature and disproportionate; the client can still achieve reasonable assurance through SOC 2 reports and limited assessments without walking away. Option D is wrong because accepting SOC 2 reports as sufficient without any additional verification fails to account for the report's scope limitations (e.g., it may not cover all relevant controls, and it is a snapshot in time), leaving the client exposed to risks not addressed by the report.

Practice this question →

43

MCQhard

A healthcare organization is migrating its electronic health record (EHR) system to a public cloud. The system stores sensitive patient data subject to HIPAA. The cloud architect has designed a multi-tier architecture with load balancers, web servers, application servers, and a PostgreSQL database. The database contains ePHI. To meet compliance, the architect plans to encrypt the database at rest using AWS RDS encryption with KMS. However, during a security review, the compliance officer notes that the database backups are stored in an S3 bucket that is not encrypted. Additionally, the application logs, which may contain patient data, are sent to CloudWatch Logs without encryption. The compliance officer insists that all data stores containing ePHI must be encrypted at rest. Which action should the architect take to ensure compliance?

A.Enable S3 bucket encryption for backups and enable encryption for CloudWatch Logs using KMS.

B.Disable automated backups and rely on point-in-time recovery.

C.Enable encryption on the RDS instance and use encrypted replicas.

D.Enable encryption on the S3 bucket only, since backups are the main concern.

AnswerA

This ensures all data stores with ePHI are encrypted at rest.

Why this answer

Option A is correct because HIPAA requires encryption of ePHI at rest in all data stores. The S3 bucket containing unencrypted database backups and the CloudWatch Logs that may contain patient data both need encryption enabled via KMS to meet compliance. AWS RDS encryption protects the live database, but backups and logs are separate storage locations that must also be encrypted.

Exam trap

The trap here is that candidates assume encrypting the RDS instance automatically encrypts all associated data stores, such as backups exported to S3 and CloudWatch Logs, when in fact each service requires separate encryption configuration.

How to eliminate wrong answers

Option B is wrong because disabling automated backups does not address the existing unencrypted backups in S3 or the unencrypted CloudWatch Logs, and point-in-time recovery still relies on encrypted storage. Option C is wrong because the RDS instance is already encrypted with RDS encryption; the issue is the backups in S3 and CloudWatch Logs, not the database itself. Option D is wrong because it only addresses the S3 bucket and ignores the CloudWatch Logs, which also contain ePHI and must be encrypted to comply with HIPAA.

Practice this question →

44

Multi-Selecthard

Which TWO of the following are requirements for a cloud service agreement to comply with the European Data Protection Board (EDPB) guidelines on data processing?

Select 2 answers

A.The processor may subcontract processing without notification

B.The processor must only process data on documented instructions from the controller

C.The controller must ensure the processor agrees to audit rights

D.The agreement must specify the duration of processing

E.The processor must retain data indefinitely

AnswersB, D

Correct. The agreement must ensure processing is only on documented instructions.

Why this answer

Option B is correct because the EDPB guidelines mandate that a processor may only process personal data on documented instructions from the controller. This ensures the processor’s actions are strictly controlled and auditable, preventing unauthorized processing that could violate GDPR Article 28(3)(a).

Exam trap

ISC2 often tests the distinction between controller and processor responsibilities, so candidates may mistakenly think the controller must agree to audit rights (Option C) rather than recognizing that the processor must agree to them in the agreement.

Practice this question →

45

MCQeasy

Refer to the exhibit. A company uses AWS Config to evaluate compliance with a rule that requires S3 buckets to enforce SSL. What should the administrator do next?

A.Enable SSL-only access on the bucket

B.Disable the Config rule

C.Update the rule to allow HTTP

D.Check which bucket is non-compliant

AnswerD

The administrator must identify the non-compliant resource before taking action.

Why this answer

The output shows the rule is non-compliant but does not identify which specific bucket(s). The logical next step is to check which resources are non-compliant. Enabling SSL-only access is a solution but first the administrator must identify the non-compliant bucket.

Disabling the rule or updating it would not resolve the issue.

Practice this question →

46

MCQmedium

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

A.The policy grants full administrative access to the bucket

B.The policy allows GetObject requests only from the specified IP range

C.The policy denies all access from the specified IP range

D.The bucket is publicly accessible to any IP address

AnswerB

Correct. The condition aws:SourceIp limits the Allow effect to that IP range.

Why this answer

The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Exam trap

ISC2 often tests the distinction between an explicit Deny and an implicit Deny — candidates mistakenly think a condition-based Allow is the same as a Deny for non-matching IPs, but the policy only denies implicitly, not explicitly.

How to eliminate wrong answers

Option A is wrong because the policy only grants s3:GetObject permission, not full administrative actions like s3:PutObject, s3:DeleteObject, or s3:* — it is read-only, not full admin. Option C is wrong because the policy uses Allow with an IpAddress condition, not a Deny statement; a Deny would require a separate Deny effect or a NotIpAddress condition to explicitly block the IP range. Option D is wrong because the policy includes a condition that restricts access to a specific IP range, so the bucket is not publicly accessible to any IP address; requests from outside the range are implicitly denied.

Practice this question →

47

MCQeasy

What is the primary purpose of a Data Processing Agreement (DPA) between a data controller and a cloud service provider?

A.To set data retention periods for processed data

B.To specify encryption algorithms to be used

C.To establish data backup and recovery procedures

D.To define roles and responsibilities for data processing

AnswerD

The DPA clarifies the controller-processor relationship.

Why this answer

A Data Processing Agreement (DPA) is a legally binding contract required under regulations like GDPR. Its primary purpose is to define the roles and responsibilities of the data controller and the data processor (the cloud service provider), ensuring the processor acts only on the controller's documented instructions and meets compliance obligations. Without a DPA, the controller cannot legally transfer data to the processor, as the agreement establishes the lawful basis and accountability for processing activities.

Exam trap

ISC2 often tests the distinction between legal/compliance documents (DPA) and operational/technical documents (SLA, security policies), so the trap here is confusing the DPA's role in defining processing roles with specific technical controls like encryption or backup procedures.

How to eliminate wrong answers

Option A is wrong because data retention periods are typically defined in a separate data retention policy or contract clause, not the DPA; the DPA focuses on processing instructions and compliance, not specific retention schedules. Option B is wrong because encryption algorithms are a technical security measure specified in a Security Addendum or SLA, not the DPA; the DPA addresses legal and contractual roles, not cryptographic implementation details. Option C is wrong because backup and recovery procedures are operational controls documented in a Business Continuity Plan or Disaster Recovery Plan, not the DPA; the DPA governs data processing boundaries and liability, not specific recovery steps.

Practice this question →

48

Multi-Selecteasy

Which TWO of the following are examples of data sovereignty laws that directly affect cloud data storage?

Select 2 answers

A.General Data Protection Regulation (GDPR)

B.Sarbanes-Oxley Act (SOX)

C.California Consumer Privacy Act (CCPA)

D.Payment Card Industry Data Security Standard (PCI DSS)

E.Health Insurance Portability and Accountability Act (HIPAA)

AnswersA, C

GDPR applies to personal data of EU residents and includes data sovereignty principles.

Why this answer

The General Data Protection Regulation (GDPR) is a data sovereignty law because it imposes strict requirements on the storage and processing of personal data of EU residents, mandating that data be stored within the EU or in jurisdictions with equivalent protection, directly affecting where cloud providers can host data. It enforces data localization principles through mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), requiring cloud customers to ensure their provider's storage regions comply with these territorial restrictions.

Exam trap

ISC2 often tests the distinction between data sovereignty (geographic storage restrictions) and data security/privacy regulations (which focus on protection controls but not location), causing candidates to mistakenly select PCI DSS or HIPAA as sovereignty laws when they are actually security and privacy frameworks without territorial mandates.

Practice this question →

49

MCQeasy

A company receives an erasure request under GDPR. The cloud provider can delete from active storage within 24 hours but requires 90 days to delete from archives. The company has a contractual obligation to ensure deletion within 30 days. What should the company do?

A.Delete the data from the application layer only and rely on provider for archives.

B.Accept the 90-day timeline and inform the data subject accordingly.

C.Request the provider to delete from archives within 30 days and verify.

D.Reject the request as impractical.

AnswerC

This actively pursues compliance with both the contract and GDPR by expediting deletion.

Why this answer

Option C is correct because the company has a contractual obligation to ensure deletion within 30 days, which overrides the provider's default 90-day archive retention policy. The company must formally request the provider to expedite the deletion from archives and verify compliance, as GDPR Article 17 requires the controller to ensure erasure without undue delay, and the provider as processor must assist. Relying on the provider's standard timeline without action would breach the contract and GDPR accountability requirements.

Exam trap

ISC2 often tests the misconception that a cloud provider's default retention policy absolves the controller of contractual or regulatory deadlines, when in fact the controller must actively manage the processor's actions or employ alternative technical controls like key destruction to meet the timeline.

How to eliminate wrong answers

Option A is wrong because deleting only from the application layer while leaving data in archives violates the GDPR erasure principle, as the data remains accessible and recoverable, and the controller remains responsible for complete deletion. Option B is wrong because accepting the 90-day timeline and merely informing the data subject does not fulfill the contractual obligation of 30-day deletion, and GDPR does not allow the controller to unilaterally extend the erasure deadline based on the processor's limitations. Option D is wrong because rejecting the request as impractical ignores the controller's duty to use contractual leverage or technical measures (e.g., encryption key destruction) to meet the 30-day deadline, and GDPR does not permit refusal solely due to archive retention policies.

Practice this question →

50

Multi-Selectmedium

Which TWO of the following are common risk treatment options in cloud risk management?

Select 2 answers

A.Ignorance

B.Transference

C.Avoidance

D.Deletion

E.Acceptance

AnswersB, C

Correct. Transferring risk to a third party (e.g., insurance) is a treatment option.

Why this answer

Options A and C are correct. Avoidance and transference (transfer) are standard risk treatment options. Acceptance is also a treatment, but in this question we require exactly two correct, so we chose avoidance and transference.

Mitigation is another common option, but it is not listed as correct here.

Practice this question →

51

MCQeasy

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

A.The customer.

B.The regulatory authority.

C.The cloud service provider.

D.A third-party auditor.

AnswerC

The CSP manages the hypervisor as part of the shared responsibility model.

Why this answer

Option A is correct because the hypervisor is part of the underlying infrastructure, which the CSP manages. Option B is wrong because the customer does not have access to patch the hypervisor. Option C is wrong because a third party is not involved.

Option D is wrong because the hypervisor is not typically managed by a regulatory body.

Practice this question →

52

Multi-Selecthard

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Select 2 answers

A.Communication plan for notifying stakeholders during a disruption.

B.Strategy to avoid vendor lock-in with the CSP.

C.A detailed risk assessment for all cloud services.

D.Network topology diagrams of the cloud environment.

E.Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for critical systems.

AnswersA, E

A communication plan is critical for coordinating response.

Why this answer

Option A is correct because a communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Exam trap

ISC2 often tests the distinction between what is required *in* a BCP versus what is required *to create* a BCP, causing candidates to mistakenly include risk assessments or network diagrams as core BCP elements.

Practice this question →

53

MCQhard

Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options: A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises. B. Use the provider's default encryption and rely on their BAA that states they will protect the keys. C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer. D. Disable encryption and rely on access controls and auditing only. Which option best addresses the compliance requirement while considering the operational impact?

A.Enable client-side encryption using a custom key management system (KMS) on the customer's premises.

B.Disable encryption and rely on access controls and auditing only.

C.Use the provider's default encryption and rely on their BAA that states they will protect the keys.

D.Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.

AnswerA

Correct. Client-side encryption with customer-controlled keys ensures compliance and maintains security.

Why this answer

Option A is correct because client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.

Exam trap

ISC2 often tests the misconception that a Business Associate Agreement (BAA) alone is sufficient to satisfy HIPAA encryption requirements, when in fact the covered entity must maintain exclusive control over encryption keys to prevent unauthorized access by the cloud provider.

How to eliminate wrong answers

Option B is wrong because disabling encryption entirely violates HIPAA's Security Rule requirement to implement encryption as an addressable implementation specification for ePHI at rest, and relying solely on access controls and auditing does not provide the necessary confidentiality protection. Option C is wrong because using the provider's default encryption with a BAA does not give the covered entity exclusive control over the keys; the provider still generates and stores the keys, which the auditor has identified as non-compliant. Option D is wrong because implementing a third-party KMS that stores keys in the cloud but is controlled by the customer still exposes the keys to the cloud provider's infrastructure, potentially allowing the provider to access them via hypervisor or storage layers, and introduces additional latency and cost without guaranteeing exclusive control.

Practice this question →

54

MCQeasy

A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?

A.Ignore the risk until it materializes.

B.Accept the risk because the likelihood is low.

C.Implement controls to reduce the risk.

D.Transfer the risk to a third party.

AnswerC

Mitigation is appropriate for high-impact risks even if likelihood is low.

Why this answer

Option C is correct because, in risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.

Exam trap

ISC2 often tests the misconception that low likelihood alone justifies risk acceptance, but the trap here is that high impact overrides low probability in most compliance-driven frameworks, requiring active mitigation.

How to eliminate wrong answers

Option A is wrong because ignoring a risk with high impact violates the fundamental risk management principle of proactive mitigation; waiting for materialization could lead to catastrophic data loss and regulatory penalties. Option B is wrong because accepting a risk solely due to low likelihood ignores the high impact; risk acceptance requires a formal decision based on risk appetite, not just probability, and low likelihood does not negate the need for controls when impact is severe. Option D is wrong because transferring the risk (e.g., via cyber insurance) does not eliminate the vulnerability; the organization remains liable for the breach and must still implement technical controls to meet compliance requirements like GDPR or HIPAA.

Practice this question →

55

Matchingmedium

Match each cloud security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Cloud security posture management

Cloud workload protection platform

Cloud access security broker

Security information and event management

Why these pairings

These tools address different aspects of cloud security; CSPM focuses on configuration, CWPP on workloads.

Practice this question →

56

Multi-Selecthard

A company is implementing a cloud risk management program. Which THREE of the following are essential components of a risk assessment according to NIST SP 800-30?

Select 3 answers

A.Control implementation

B.Risk determination

C.Threat identification

D.Impact analysis

E.Vulnerability scanning

AnswersB, C, D

Determining risk level based on likelihood and impact is an essential component.

Why this answer

NIST SP 800-30 risk assessment includes threat identification, impact analysis, and risk determination. Vulnerability scanning is a method used to identify vulnerabilities, not a component of the assessment itself. Control implementation is part of risk mitigation.

Practice this question →

57

MCQmedium

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

A.Enable detailed audit logging of all data access.

B.Implement strict IAM policies for CSP employees.

C.Encrypt data client-side before uploading to the cloud.

D.Enable server-side encryption with customer-provided keys.

AnswerC

Client-side encryption ensures only the customer holds the decryption keys.

Why this answer

Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Exam trap

ISC2 often tests the distinction between client-side encryption and server-side encryption with customer-provided keys (SSE-C), where candidates mistakenly think SSE-C gives the customer full control over key access, but the provider's server still handles the plaintext during encryption/decryption.

How to eliminate wrong answers

Option A is wrong because audit logging only records who accessed data and when, but does not prevent access by cloud provider employees. Option B is wrong because IAM policies for CSP employees are managed by the provider, not the customer, and the customer cannot enforce or verify those policies to guarantee data inaccessibility. Option D is wrong because server-side encryption with customer-provided keys (SSE-C) still involves the cloud provider's server performing the encryption/decryption, meaning the plaintext is exposed to the provider's infrastructure during processing, and the provider's employees could potentially access the data if they have administrative privileges to the key management or storage systems.

Practice this question →

58

MCQmedium

A company uses a cloud database that stores customer financial information. To ensure compliance with PCI DSS, which control is required?

A.Encryption of cardholder data stored in the database

B.Network segmentation between the database and other systems

C.Annual external vulnerability scans of the database

D.Multi-factor authentication for database administrators

AnswerA

PCI DSS requires encryption of stored cardholder data.

Why this answer

PCI DSS Requirement 3.4 specifically mandates that stored cardholder data must be rendered unreadable anywhere it is stored, including in cloud databases. Encryption at rest (e.g., AES-256) is the primary control to achieve this, as it directly protects the confidentiality of Primary Account Numbers (PANs) if the storage layer is compromised. Without encryption, the data remains in clear text, violating PCI DSS compliance.

Exam trap

ISC2 often tests the distinction between required controls (e.g., encryption for data at rest) and recommended or supporting controls (e.g., network segmentation, MFA, vulnerability scans), leading candidates to pick a broader security measure that is not the specific PCI DSS mandate for stored data.

How to eliminate wrong answers

Option B is wrong because network segmentation is a recommended security practice (PCI DSS Requirement 1) but is not a required control specifically for stored data; it addresses scope reduction, not the direct protection of cardholder data at rest. Option C is wrong because annual external vulnerability scans (PCI DSS Requirement 11.2) are required for internet-facing systems, but they are a detection control, not a required control for protecting stored data; they do not render data unreadable. Option D is wrong because multi-factor authentication for database administrators (PCI DSS Requirement 8.3) is required for administrative access to systems handling cardholder data, but it is an access control, not a direct requirement for protecting the stored data itself; encryption is the specific mandate for data at rest.

Practice this question →

59

Multi-Selectmedium

A company is evaluating cloud providers for compliance with the GDPR. Which TWO of the following are mandatory data protection roles under the GDPR?

Select 2 answers

A.Data Processor

B.Data Protection Officer (DPO)

C.Cloud Security Architect

D.Data Controller

E.Data Steward

AnswersA, D

The Data Processor is a mandatory role under GDPR.

Why this answer

The GDPR defines the Data Controller and Data Processor as mandatory roles. The Data Protection Officer (DPO) is required only under certain conditions (e.g., large-scale monitoring). Cloud Security Architect and Data Steward are not GDPR-defined roles.

Practice this question →

60

Multi-Selecthard

Which THREE of the following are typical requirements for compliance with eDiscovery in a cloud environment?

Select 3 answers

A.Documentation of chain of custody

B.Search and retrieval capabilities across data sources

C.Ability to place legal hold on data

D.Encryption of data at rest

E.Data minimization principles

AnswersA, B, C

Ensures evidence integrity.

Why this answer

Legal hold preservation, search capabilities, and chain-of-custody documentation are fundamental to eDiscovery. Encryption is about security, not discovery; data minimization is a privacy principle but not specific to eDiscovery.

Practice this question →

61

MCQeasy

Which risk assessment method uses subjective scales to assign probabilities and impacts?

A.Semi-quantitative risk assessment

B.Quantitative risk assessment

C.Qualitative risk assessment

D.Bottom-up risk assessment

AnswerC

Uses subjective scales like high/medium/low.

Why this answer

Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Exam trap

ISC2 often tests the distinction between qualitative and semi-quantitative methods, where candidates confuse subjective scales (qualitative) with ordinal numerical scales (semi-quantitative), leading them to incorrectly select semi-quantitative risk assessment.

How to eliminate wrong answers

Option A is wrong because semi-quantitative risk assessment uses numerical values (e.g., 1-5 scales) to assign probabilities and impacts, not purely subjective scales. Option B is wrong because quantitative risk assessment uses objective numerical data (e.g., monetary values, statistical probabilities) to calculate risk, not subjective scales. Option D is wrong because bottom-up risk assessment is a structural approach that identifies risks from individual components upward, not a method for assigning probabilities and impacts via subjective scales.

Practice this question →

62

MCQhard

A healthcare company, MedSecure, is migrating its critical patient record application to a public cloud IaaS environment. The application processes Protected Health Information (PHI) subject to HIPAA in the US and also includes some patient data from EU residents subject to GDPR. MedSecure has signed Business Associate Agreements (BAAs) with the cloud provider covering US HIPAA compliance. However, the compliance officer is concerned about GDPR requirements for EU patient data. The architecture uses AWS EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS (MySQL) using encryption at rest and TLS for transmission. The company uses AWS CloudTrail for logging but only retains logs for 90 days. The compliance officer has identified that the current logging retention does not meet the GDPR requirement for logs to be retained for a minimum of 12 months for audit purposes. Additionally, the data stored in RDS is in a single AWS region in the US (us-east-1). The company plans to expand to EU customers. The GDPR requires that personal data of EU residents be stored in the EU or have adequate safeguards for transfer. Currently, the company has not implemented any data residency controls. What course of action should MedSecure take to address the most critical compliance gaps?

A.Extend CloudTrail log retention to 12 months by configuring a new trail in a separate account and storing logs in an S3 bucket with a lifecycle policy to delete after 12 months. For data residency, use AWS DMS to replicate the RDS database to a second RDS instance in the eu-west-1 region and enable cross-region replication for continuous sync.

B.Implement AWS Config rules to monitor compliance with both HIPAA and GDPR, and enable AWS CloudTrail Insights to detect unusual activity. For data residency, sign a Standard Contractual Clauses (SCCs) with the cloud provider for the existing US-based data.

C.Enable S3 Object Lock for CloudTrail logs to ensure they cannot be deleted before 12 months, and use AWS DMS with CDC to replicate data to a eu-west-1 region. Also, sign a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage.

D.Use AWS Lambda to copy CloudTrail logs from the existing trail to a separate S3 bucket with a retention policy of 12 months. For data residency, configure the RDS instance to have a read replica in eu-west-1 and implement a DPA with AWS for GDPR.

AnswerC

This comprehensively addresses both gaps: immutable log retention, EU data replication, and a DPA to cover legal transfer safeguards.

Why this answer

Option C is correct because it directly addresses the two most critical compliance gaps: GDPR log retention (12 months) and data residency for EU patient data. Enabling S3 Object Lock on CloudTrail logs ensures they cannot be deleted or altered before 12 months, meeting GDPR audit requirements. Using AWS DMS with Change Data Capture (CDC) to replicate the RDS database to eu-west-1 provides a continuous, low-latency copy of PHI within the EU, satisfying GDPR data residency.

Signing a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage is essential because the existing BAA only covers HIPAA, and GDPR requires a separate DPA to establish the cloud provider as a data processor under EU law.

Exam trap

ISC2 often tests the distinction between data replication mechanisms (e.g., read replicas vs. DMS with CDC) and the specific legal documents required for different regulations (BAA for HIPAA vs. DPA for GDPR), leading candidates to choose options that mix correct concepts with incorrect implementations.

How to eliminate wrong answers

Option A is wrong because configuring a new trail in a separate account does not prevent premature deletion of logs; a lifecycle policy alone does not enforce immutability, and GDPR requires logs to be retained for 12 months with protection against deletion or alteration. Additionally, using AWS DMS to replicate the RDS database to a second RDS instance with cross-region replication does not inherently provide continuous CDC synchronization for real-time data residency compliance. Option B is wrong because AWS Config rules and CloudTrail Insights are monitoring and detection tools, not mechanisms to enforce log retention or data residency; signing SCCs for existing US-based data does not satisfy the GDPR requirement that EU personal data be stored in the EU or have adequate safeguards for transfer, and SCCs alone do not replace the need for a DPA with the cloud provider.

Option D is wrong because using a Lambda function to copy logs to a separate S3 bucket does not ensure immutability or prevent deletion before 12 months; a read replica in eu-west-1 is read-only and cannot accept writes, so it does not provide a writable copy of the database for EU data residency, and implementing a DPA is correct but the log retention and data residency solutions are insufficient.

Practice this question →

63

MCQmedium

A multinational corporation uses a SaaS application for customer relationship management (CRM). The CRM application stores customer data including names, email addresses, and purchase history. The company has operations in the EU, California, and Japan. A new regulation in Japan requires that any transfer of personal data outside Japan must have the data subject's consent if the destination country does not have an adequacy decision. The company's cloud provider stores data in the United States. The company currently relies on the provider's data processing agreement that includes standard contractual clauses (SCCs). However, the Japanese regulator has stated that SCCs are not sufficient for transfers from Japan unless supplemented. You are tasked with ensuring compliance for Japanese data subjects. Which of the following is the most appropriate next step? A. Obtain explicit consent from each Japanese data subject for data transfer to the US. B. Move the data for Japanese subjects to a data center in Japan. C. Continue using SCCs as they are recognized internationally. D. Pseudonymize the data before transfer. Which option best addresses the compliance requirement while considering the operational impact?

A.Move the data for Japanese subjects to a data center in Japan.

B.Continue using SCCs as they are recognized internationally.

C.Pseudonymize the data before transfer.

D.Obtain explicit consent from each Japanese data subject for data transfer to the US.

AnswerD

Correct. Explicit consent is a valid legal basis under Japanese law when other mechanisms are insufficient.

Why this answer

Option D is correct because the Japanese regulator has explicitly stated that SCCs alone are insufficient for transfers from Japan, and obtaining explicit consent from each data subject directly satisfies the requirement for a valid transfer mechanism under Japanese law. This approach ensures compliance without requiring infrastructure changes, though it may be operationally burdensome. The other options either fail to meet regulatory requirements or introduce unnecessary operational impact.

Exam trap

ISC2 often tests the misconception that pseudonymization or data localization alone can bypass cross-border transfer restrictions, when in fact explicit consent or an approved mechanism is required under the specific regulation.

How to eliminate wrong answers

Option A (moving data to a Japan data center) is wrong because it does not address the transfer to the US for processing; the data would still need to be transferred to the US for the SaaS CRM to function, and the regulation applies to any transfer outside Japan. Option B (continuing with SCCs) is wrong because the Japanese regulator has stated SCCs are not sufficient unless supplemented, so relying on them alone would violate the regulation. Option C (pseudonymization) is wrong because pseudonymization does not eliminate the need for a valid transfer mechanism under Japanese law; the data remains personal data subject to transfer restrictions.

Practice this question →

64

Multi-Selecteasy

A multinational corporation stores customer data in an AWS S3 bucket located in the US. The company's European customers' personal data must comply with GDPR. Which TWO actions should the company take to ensure compliance with GDPR data transfer requirements?

Select 2 answers

A.Implement encryption at rest using AWS KMS with a key stored in the US.

B.Sign Standard Contractual Clauses (SCCs) with the cloud provider.

C.Ensure that the data is only accessed by employees in the EU.

D.Use AWS Direct Connect to route traffic exclusively through EU-based links.

E.Implement a Data Processing Agreement (DPA) with AWS.

AnswersB, E

SCCs are a valid adequacy mechanism for transferring personal data to third countries under GDPR.

Why this answer

Under GDPR, transfers of personal data to third countries require adequate safeguards. Signing Standard Contractual Clauses (SCCs) with the cloud provider and implementing a Data Processing Agreement (DPA) are both recognized mechanisms. Encryption alone (A) does not address transfer legality; access location (C) is irrelevant; and Direct Connect (D) is a network connectivity option, not a legal safeguard.

Practice this question →

65

MCQhard

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

A.The amount of direct damages only

B.Up to $500K, the total fees paid in the past 12 months

C.Full $2M because negligence overrides liability caps

D.Zero because the customer accepted the terms

AnswerB

The explicit cap is based on fees paid.

Why this answer

The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Practice this question →

66

MCQhard

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

A.The deletion was performed from an internal IP address

B.The deletion was performed by a user who may not have authorization

C.The log entry does not include the object's encryption status

D.The deletion was performed without evidence of compliance team approval

AnswerD

The policy requires approval, but the log shows no approval step.

Why this answer

Option D is correct because the company policy explicitly requires compliance team approval for all deletion operations, and the CloudTrail log entry does not contain any evidence of such approval (e.g., no MFA context, no approval token, no IAM policy condition key indicating approval). CloudTrail logs record API calls but do not inherently capture external approval workflows; the absence of an approval artifact in the log indicates a policy violation.

Exam trap

ISC2 often tests the distinction between 'authorization' (who can perform an action) and 'approval' (a separate governance step), leading candidates to choose Option B when the real issue is the missing compliance approval artifact.

How to eliminate wrong answers

Option A is wrong because the source IP address being internal is irrelevant to the compliance issue; the policy concerns authorization, not network origin. Option B is wrong because the log entry shows the user identity (e.g., user ARN) and the action was performed, but the core issue is not whether the user 'may not have authorization'—the log itself does not indicate unauthorized access; the problem is the missing approval step. Option C is wrong because encryption status of the object is not required in a CloudTrail log for deletion compliance; the policy focuses on approval, not encryption metadata.

Practice this question →

67

Drag & Dropmedium

Drag and drop the steps for setting up a virtual private cloud (VPC) with public and private subnets in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

First create VPC, then subnets, Internet Gateway, route tables, and finally launch instances.

Practice this question →

68

MCQeasy

A customer relies on this SOC 2 Type II report to assess a cloud provider's controls. What is the primary limitation of this report?

A.The report includes subjective opinions

B.The report does not cover the entire provider's infrastructure

C.The report is biased in favor of the provider

D.The report only covers controls up to Dec 31, 2023

AnswerD

Controls are not tested beyond the audit period.

Why this answer

The report covers controls tested from Jan to Dec 2023, not current. Controls may have changed since. The report is not predictive, but the time lag is the key limitation.

Scope is per provider, unbiased.

Practice this question →

69

MCQhard

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

A.Ensure cryptographic operations use constant-time algorithms.

B.Implement virtual LANs (VLANs) and firewall rules between tenants.

C.Use hardware security modules (HSMs) for key management.

D.Enforce strict API rate limiting for each tenant.

AnswerA

Constant-time algorithms resist timing and cache-based side-channel attacks.

Why this answer

Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Exam trap

ISC2 often tests the distinction between network-level isolation (VLANs, firewalls) and microarchitectural side-channel defenses, leading candidates to choose network controls when the question specifically targets side-channel attacks that bypass network segmentation.

How to eliminate wrong answers

Option B is wrong because VLANs and firewall rules provide network-layer isolation but do not address side-channel attacks that occur at the hardware or microarchitectural level, such as cache timing or branch prediction analysis. Option C is wrong because HSMs secure key storage and operations but do not prevent side-channel leakage from the CPU or memory during cryptographic processing; an attacker can still observe timing or power variations. Option D is wrong because API rate limiting controls request frequency to prevent abuse but has no effect on side-channel attacks that exploit shared processor resources like caches or execution pipelines.

Practice this question →

70

MCQhard

An e-commerce company uses a cloud-based web application firewall (WAF) to protect against common web exploits. The security team notices that a specific IP address is sending a high volume of requests that appear to be a DDoS attack. What is the best immediate response to mitigate the attack while minimizing impact on legitimate users?

A.Change the DNS to point to a different IP address.

B.Increase the compute capacity of the web servers.

C.Block the IP address in the WAF.

D.Implement rate limiting on the IP address with a threshold that allows normal traffic.

AnswerD

Rate limiting can distinguish between human users and automated attacks, reducing impact.

Why this answer

Option D is correct because rate limiting at the WAF allows the security team to restrict the volume of requests from the offending IP address without completely blocking it. This approach ensures that legitimate traffic from that IP (e.g., a shared NAT gateway or a user with a dynamic IP) can still pass through, while the DDoS attack traffic is throttled. WAFs typically support granular rate-limiting rules based on IP, session, or URI, making this the most precise and least disruptive immediate response.

Exam trap

ISC2 often tests the misconception that blocking an IP address (Option C) is the safest immediate action, but the trap is that legitimate users can share the same IP via NAT or proxy, making rate limiting a more precise and less harmful control.

How to eliminate wrong answers

Option A is wrong because changing DNS to point to a different IP address does not mitigate the attack; the attacker can simply follow the new IP, and DNS propagation delays (up to 48 hours) leave the original IP exposed. Option B is wrong because increasing compute capacity (horizontal or vertical scaling) does not stop the attack; it only temporarily absorbs more traffic, and the attacker can easily scale up the DDoS volume, leading to resource exhaustion and higher costs. Option C is wrong because blocking the IP address outright in the WAF may inadvertently block legitimate users who share that IP (e.g., users behind a carrier-grade NAT or a corporate proxy), causing a denial of service to valid customers.

Practice this question →

71

MCQmedium

Refer to the exhibit. A cloud administrator sees this error log from AWS CloudTrail. The user [email protected] is a member of the 'Analysts' group. Which of the following is the most likely cause of the AccessDenied error?

A.The user is trying to access the bucket from a different AWS region.

B.The IAM policy attached to the user or group does not include s3:PutObject for that bucket.

C.The bucket policy explicitly denies access to the 'Analysts' group.

D.The bucket requires server-side encryption and the request did not include encryption headers.

AnswerB

Missing IAM permissions are a common cause of AccessDenied.

Why this answer

The AccessDenied error for an s3:PutObject operation indicates that the IAM policy attached to the user or group does not grant the necessary permissions. Since the user is a member of the 'Analysts' group, the most likely cause is that the group's IAM policy lacks an Allow effect for s3:PutObject on the target bucket. AWS IAM evaluates both identity-based and resource-based policies, and if no explicit Allow is present, the default implicit deny applies.

Exam trap

ISC2 often tests the distinction between an implicit deny (missing Allow) and an explicit deny (Deny statement), and candidates mistakenly assume a bucket policy or encryption requirement is the cause when the error is simply a missing permission in the IAM policy.

How to eliminate wrong answers

Option A is wrong because S3 bucket access is not region-specific; a bucket is a global resource and cross-region access is allowed by default unless explicitly restricted by a bucket policy or VPC endpoint. Option C is wrong because the error log does not indicate an explicit deny; an explicit deny would produce a different error message (e.g., 'AccessDenied' with a reason like 'explicit deny'), and the question states the user is a member of the 'Analysts' group without mentioning a bucket policy that denies them. Option D is wrong because if the bucket required server-side encryption and the request lacked encryption headers, the error would be 'AccessDenied' but with a specific message about encryption requirements (e.g., 'The bucket policy requires encryption headers'), not a generic AccessDenied for s3:PutObject.

Practice this question →

72

MCQhard

A financial institution uses a multi-cloud strategy with AWS and Azure. They must comply with PCI DSS. The security team found that a developer accidentally stored a file with credit card numbers in an S3 bucket that is publicly readable. Which immediate action should be taken to contain the breach?

A.Delete the file immediately.

B.Enable default encryption on the bucket.

C.Remove the public read permission on the bucket.

D.Revoke the developer's IAM credentials.

AnswerC

This stops further exposure while preserving the file for forensic analysis.

Why this answer

Option C is correct because removing the public read permission on the S3 bucket immediately stops unauthorized access to the file containing credit card numbers, containing the breach in accordance with PCI DSS incident response requirements. This action does not destroy evidence (unlike deletion) and directly addresses the root cause—the bucket's misconfigured access control list (ACL) or bucket policy that allowed public read access. It is the fastest way to prevent further data exfiltration while preserving the file for forensic analysis.

Exam trap

ISC2 often tests the misconception that deleting the file or revoking credentials is the fastest containment step, but the trap here is that the root cause is the public permission, not the file's existence or the developer's identity—removing public access stops all anonymous access instantly, which is the correct containment action per incident response best practices.

How to eliminate wrong answers

Option A is wrong because deleting the file destroys potential forensic evidence needed for incident investigation and compliance reporting under PCI DSS Requirement 10 (track and monitor access to cardholder data), and the file may still be cached or accessible via bucket versioning or replication. Option B is wrong because enabling default encryption does not affect existing public read permissions; it only encrypts new objects at rest, leaving the already-exposed file still publicly readable. Option D is wrong because revoking the developer's IAM credentials does not remove the public read permission on the bucket; the file remains accessible to anyone on the internet, so the breach continues.

Practice this question →

73

MCQhard

A customer discovers the provider added a new sub-processor without notification. Which compliance risk is most directly exposed?

A.Increase in costs due to sub-processor fees

B.Sub-processor might have weaker security controls

C.Service performance degradation due to sub-processor

D.Violation of customer's audit rights under GDPR

AnswerD

Lack of notification prevents customer from objecting, violating contractual and GDPR sub-processor requirements.

Why this answer

The clause requires notification and opportunity to object. Failure to notify breaches the contract and exposes the customer to GDPR non-compliance (sub-processor requirements). Performance impact is secondary.

Encryption and cost change are not the direct risk.

Practice this question →

74

MCQmedium

A company identifies a high-risk vulnerability in a cloud application. The cost to remediate is significantly higher than the potential loss from exploitation. Which risk treatment strategy is most appropriate?

A.Acceptance

B.Avoidance

C.Transfer

D.Mitigation

AnswerA

Correct. Risk acceptance is justified when cost of treatment exceeds potential loss.

Why this answer

When the cost to remediate a vulnerability exceeds the potential loss from exploitation, the most appropriate risk treatment strategy is acceptance. This means the organization formally acknowledges the risk and chooses to tolerate it without implementing additional controls, often documented in a risk register. In cloud environments, this is common for low-impact, high-cost vulnerabilities where the business decides the residual risk is within its risk appetite.

Exam trap

ISC2 often tests the distinction between risk acceptance and risk mitigation, where candidates mistakenly choose mitigation because they assume all vulnerabilities must be fixed, ignoring the cost-benefit analysis that justifies acceptance.

How to eliminate wrong answers

Option B (Avoidance) is wrong because avoidance involves eliminating the risk entirely, such as discontinuing the vulnerable cloud service or feature, which would be disproportionate and unnecessary when the potential loss is lower than remediation cost. Option C (Transfer) is wrong because transfer shifts the risk to a third party, typically through cyber insurance or outsourcing, but does not reduce the cost of remediation and may not be feasible for a specific application vulnerability. Option D (Mitigation) is wrong because mitigation involves implementing controls to reduce the risk to an acceptable level, which contradicts the premise that remediation cost is higher than the potential loss; mitigation would still incur that high cost.

Practice this question →

75

MCQeasy

A US-based company uses a cloud provider with data centers in the US and Europe. To transfer personal data of EU citizens to the US, which mechanism is most appropriate under GDPR?

A.Explicit consent

B.Standard Contractual Clauses (SCCs)

C.Binding Corporate Rules (BCRs)

D.Adequacy decision

AnswerB

Correct. SCCs are a recognized transfer mechanism for data transfers to third countries.

Why this answer

Standard Contractual Clauses (SCCs) are the most appropriate mechanism because they provide a legally recognized data transfer tool under GDPR Article 46 for transferring personal data from the EU to a third country (the US) without an adequacy decision. SCCs are pre-approved contractual terms that both the data exporter (EU-based) and data importer (US-based) must sign, ensuring adequate safeguards for the data subjects' rights. This mechanism is specifically designed for scenarios where the cloud provider's data centers span jurisdictions without a current adequacy finding, as is the case with the US post-Schrems II.

Exam trap

ISC2 often tests the misconception that an adequacy decision is the default or most straightforward option for US transfers, but the trap is that the US currently lacks an adequacy decision, making SCCs the primary lawful mechanism for such cross-border data flows.

How to eliminate wrong answers

Option A is wrong because explicit consent under GDPR Article 49 is a derogation for specific, occasional transfers and cannot be used as a general or repetitive mechanism for ongoing data flows to a US cloud provider; it also requires a high burden of proof and can be withdrawn at any time. Option C is wrong because Binding Corporate Rules (BCRs) are designed for intra-group transfers within a multinational enterprise, not for transfers between a US-based company and an external cloud provider that is not part of the same corporate group. Option D is wrong because there is currently no adequacy decision in effect for the US under GDPR (the Privacy Shield was invalidated in 2020), so this mechanism is not available for general transfers to the US.

Practice this question →

Page 1 of 2 · 93 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Legal, Risk and Compliance questions.

Start 20-question session