CCSK Legal, Compliance, and Audit in Cloud

Question 1

What does CCSK identify as the primary legal challenge of cloud computing related to data location?

Accepted Answer

Data may reside in multiple jurisdictions simultaneously, creating complex and potentially conflicting legal obligations

Answer

Cloud data can be distributed across multiple countries, each with different privacy and security laws, creating jurisdictional conflicts and compliance complexity.

Question 2

What is a 'right to audit' clause in cloud contracts and why does CCSK consider it important?

Accepted Answer

A contractual provision giving customers the right to audit or verify the provider's security controls

Answer

A right-to-audit clause ensures customers can verify provider security claims through audits or audit reports, maintaining accountability without relying solely on provider assertions.

Question 3

What is 'eDiscovery' in the context of CCSK and what cloud challenges does it present?

Accepted Answer

The legal process of identifying, collecting, and producing electronically stored information for legal proceedings, complicated in cloud by data distribution and provider access limits

Answer

Cloud eDiscovery is complicated because data may be distributed across jurisdictions, commingled with other tenants, and require provider assistance to collect.

Question 4

According to CCSK, what does 'compliance inheritance' mean for cloud customers?

Accepted Answer

Customers inherit compliance for the cloud infrastructure layer but remain responsible for compliance of their own applications and data

Answer

Compliance inheritance means customers benefit from provider certifications for the infrastructure layer but must achieve compliance for their own configuration, data, and applications.

Question 5

What is the purpose of a 'service level agreement' (SLA) from a security perspective in CCSK?

Accepted Answer

SLAs define provider commitments for availability, security response times, and breach notification, creating contractual accountability

Answer

SLAs include security commitments such as uptime guarantees, incident response timeframes, and breach notification obligations, providing contractual recourse if commitments fail.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Legal, Compliance, and Audit in Cloud