CCSK Legal, Compliance, and Audit in Cloud 2

Question 1

What does the GDPR require of cloud customers regarding data processing by cloud providers?

Accepted Answer

Customers must enter into Data Processing Agreements (DPAs) with cloud providers who process EU personal data on their behalf

Answer

GDPR requires data controllers (customers) to have DPAs with processors (cloud providers) ensuring the provider handles EU personal data per GDPR requirements.

Question 2

What is a 'SOC 2 Type II' report and why is it relevant to CCSK cloud security assessments?

Accepted Answer

An independent auditor's report verifying a cloud provider's security controls operated effectively over a defined period (typically 12 months)

Answer

SOC 2 Type II covers operational effectiveness of controls over time (vs. Type I which is point-in-time), providing stronger assurance of consistent security practices.

Question 3

According to CCSK, what is 'regulatory arbitrage' in cloud computing and why is it a concern?

Accepted Answer

Storing data in jurisdictions with weaker privacy laws to avoid stricter regulations, undermining compliance intent

Answer

Regulatory arbitrage exploits jurisdictional differences by storing data where regulations are weakest, which may violate the intent of regulations in the customer's home jurisdiction.

Question 4

What is 'ISO/IEC 27017' and how does it differ from ISO/IEC 27001 in cloud security?

Accepted Answer

ISO 27017 provides cloud-specific security controls extending ISO 27001, addressing cloud-unique risks like virtual environments and shared infrastructure

Answer

ISO 27017 extends the ISO 27001 framework with additional controls specific to cloud services, covering topics like virtual machines, provider-customer responsibilities, and asset ownership.

Question 5

What does CCSK say about the handling of 'personally identifiable information' (PII) in cloud audit logs?

Accepted Answer

Audit logs containing PII must be protected with the same controls as other sensitive data, and retention periods must comply with privacy regulations

Answer

Audit logs often contain PII (usernames, IP addresses, access details) and must be protected, access-controlled, and retained per applicable privacy and compliance requirements.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Legal, Compliance, and Audit in Cloud 2