CCSE Cloud Risk & Compliance Management 3

Question 1

Which audit report type provides the most comprehensive assurance about a cloud provider's controls by covering both design and operating effectiveness?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II evaluates both the design and operating effectiveness of security controls over a period of time, providing the most comprehensive assurance.

Question 2

A healthcare organization migrates to a cloud SaaS application. Under HIPAA, what agreement must be established with the cloud provider before storing PHI?

Accepted Answer

Business Associate Agreement (BAA)

Answer

HIPAA requires a Business Associate Agreement (BAA) with any vendor that handles Protected Health Information (PHI) on behalf of a covered entity.

Question 3

What is the key difference between a qualitative and quantitative risk assessment approach?

Accepted Answer

Quantitative uses monetary values and statistics; qualitative uses descriptive ratings

Answer

Quantitative risk assessment uses numerical values and statistical methods (e.g., ALE), while qualitative uses descriptive categories like High/Medium/Low.

Question 4

An organization uses multiple cloud providers to avoid single points of failure. This strategy primarily addresses which risk?

Accepted Answer

Vendor lock-in and provider availability risk

Answer

Multi-cloud strategies reduce vendor lock-in risk and protect against provider-specific outages or business failures.

Question 5

Which element is typically included in a cloud vendor risk assessment but NOT in an internal vulnerability scan?

Accepted Answer

Financial stability and business continuity of the vendor

Answer

Vendor risk assessments evaluate third-party factors like financial stability and business continuity that internal scans cannot assess.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Risk & Compliance Management 3