Cloud Risk & Compliance Management Flashcards

Which audit report type provides the most comprehensive assurance about a cloud provider's controls by covering both design and operating effectiveness?

Answer: SOC 2 Type II

SOC 2 Type II evaluates both the design and operating effectiveness of security controls over a period of time, providing the most comprehensive assurance.

A healthcare organization migrates to a cloud SaaS application. Under HIPAA, what agreement must be established with the cloud provider before storing PHI?

Answer: Business Associate Agreement (BAA)

HIPAA requires a Business Associate Agreement (BAA) with any vendor that handles Protected Health Information (PHI) on behalf of a covered entity.

What is the key difference between a qualitative and quantitative risk assessment approach?

Answer: Quantitative uses monetary values and statistics; qualitative uses descriptive ratings

Quantitative risk assessment uses numerical values and statistical methods (e.g., ALE), while qualitative uses descriptive categories like High/Medium/Low.

An organization uses multiple cloud providers to avoid single points of failure. This strategy primarily addresses which risk?

Answer: Vendor lock-in and provider availability risk

Multi-cloud strategies reduce vendor lock-in risk and protect against provider-specific outages or business failures.

Which element is typically included in a cloud vendor risk assessment but NOT in an internal vulnerability scan?

Answer: Financial stability and business continuity of the vendor

Vendor risk assessments evaluate third-party factors like financial stability and business continuity that internal scans cannot assess.

The PCI DSS requirement for cloud environments mandates that cardholder data is isolated within a defined boundary. What is this boundary called?

Answer: Cardholder Data Environment (CDE)

PCI DSS defines the Cardholder Data Environment (CDE) as the boundary encompassing all systems that store, process, or transmit cardholder data.

During a cloud compliance audit, an auditor requests evidence of continuous monitoring. Which tool output best satisfies this requirement?

Answer: Automated CSPM alerts and remediation logs over a defined period

Cloud Security Posture Management (CSPM) tools provide ongoing, automated evidence of continuous monitoring and remediation activities.