Cloud Risk & Compliance Management Flashcards

Which GDPR principle requires that personal data collected for one purpose not be used for an incompatible purpose without additional consent?

Answer: Purpose limitation

The GDPR purpose limitation principle restricts the use of personal data to the specific purpose for which it was originally collected.

A CCSE is evaluating cloud risk using the formula: Risk = Threat × Vulnerability × Impact. Which scenario represents the highest risk?

Answer: High threat, high vulnerability, high impact

Risk is maximized when all three factors—threat likelihood, vulnerability, and impact—are high simultaneously.

What is the purpose of a Cloud Access Security Broker (CASB) in a compliance management program?

Answer: To enforce security policies and provide visibility between users and cloud services

A CASB sits between users and cloud services to enforce security policies, provide visibility, and ensure compliance with organizational rules.

Under FedRAMP, what level of authorization is required for cloud systems processing Controlled Unclassified Information (CUI) with moderate risk?

Answer: FedRAMP Moderate

FedRAMP Moderate authorization is designed for systems where compromise could have serious adverse effects, including most CUI systems.

Which risk scenario best describes a 'configuration drift' compliance failure in a cloud environment?

Answer: Resources gradually deviate from their approved secure baseline over time

Configuration drift occurs when cloud resources gradually diverge from their approved secure baseline, often due to ad-hoc changes or updates.

An organization's legal team flags that its cloud provider contract lacks a right-to-audit clause. Why is this a significant compliance risk?

Answer: It limits the organization's ability to independently verify the provider's security controls

Without a right-to-audit clause, the organization cannot independently verify that the provider's security controls meet regulatory and contractual requirements.

Which approach to compliance in cloud environments is most efficient for organizations operating under multiple regulatory frameworks simultaneously?

Answer: Adopting a unified controls framework that maps to multiple regulations

A unified controls framework (such as CSA CCM) maps a single set of controls to multiple regulations, reducing duplication and audit fatigue.