CCSE Cloud Risk & Compliance Management 4

Question 1

Which GDPR principle requires that personal data collected for one purpose not be used for an incompatible purpose without additional consent?

Accepted Answer

Purpose limitation

Answer

The GDPR purpose limitation principle restricts the use of personal data to the specific purpose for which it was originally collected.

Question 2

A CCSE is evaluating cloud risk using the formula: Risk = Threat × Vulnerability × Impact. Which scenario represents the highest risk?

Accepted Answer

High threat, high vulnerability, high impact

Answer

Risk is maximized when all three factors—threat likelihood, vulnerability, and impact—are high simultaneously.

Question 3

What is the purpose of a Cloud Access Security Broker (CASB) in a compliance management program?

Accepted Answer

To enforce security policies and provide visibility between users and cloud services

Answer

A CASB sits between users and cloud services to enforce security policies, provide visibility, and ensure compliance with organizational rules.

Question 4

Under FedRAMP, what level of authorization is required for cloud systems processing Controlled Unclassified Information (CUI) with moderate risk?

Accepted Answer

FedRAMP Moderate

Answer

FedRAMP Moderate authorization is designed for systems where compromise could have serious adverse effects, including most CUI systems.

Question 5

Which risk scenario best describes a 'configuration drift' compliance failure in a cloud environment?

Accepted Answer

Resources gradually deviate from their approved secure baseline over time

Answer

Configuration drift occurs when cloud resources gradually diverge from their approved secure baseline, often due to ad-hoc changes or updates.

(CCSE) Certified Cloud Security Engineer Practice Test