CCSP Legal, Risk, and Compliance 2

Question 1

Which regulation requires organizations that handle payment card data to comply with a set of security standards?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for all organizations that store, process, or transmit cardholder data.

Question 2

What is vendor lock-in risk in cloud computing and how does it affect compliance?

Accepted Answer

Dependency on a single cloud provider's proprietary technology making migration difficult, which can affect data portability rights under regulations like GDPR

Answer

Vendor lock-in can conflict with GDPR's right to data portability and make it difficult for organizations to switch providers or comply with data residency requirements.

Question 3

What is the purpose of a cloud service level agreement (SLA) from a risk and compliance perspective?

Accepted Answer

To contractually define performance, availability, and security obligations, establishing accountability and remedies for non-compliance

Answer

An SLA establishes measurable service commitments and financial penalties, giving customers contractual recourse if the provider fails to meet security, availability, or compliance obligations.

Question 4

In the context of cloud eDiscovery, what is the primary challenge compared to on-premises environments?

Accepted Answer

Data may be distributed across multiple jurisdictions and commingled with other tenants' data, complicating legal hold and collection

Answer

Cloud eDiscovery challenges include multi-jurisdictional data storage, commingling of data across tenants, and limited customer access to enforce legal holds on provider-managed infrastructure.

Question 5

Which risk treatment option involves transferring the financial impact of a risk to a third party?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial consequences of a risk to a third party, most commonly through cyber liability insurance or contractual indemnification clauses.

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP Legal, Risk, and Compliance 2