CCSP Legal, Risk, and Compliance

Question 1

Which framework provides a set of controls specifically designed to assess the security of cloud service providers?

Accepted Answer

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Answer

NIST SP 800-53

Answer

ISO/IEC 27001

Answer

CIS Benchmarks

Question 2

What is the primary purpose of a Business Associate Agreement (BAA) in the context of HIPAA compliance in the cloud?

Accepted Answer

To legally obligate a cloud vendor handling PHI to comply with HIPAA security and privacy requirements

Answer

To establish pricing between a company and its cloud provider

Answer

To authorize the cloud provider to share medical data with third parties

Answer

To certify that a cloud provider has passed a HIPAA audit

Question 3

What type of audit report provides a detailed description of a service organization's controls but is intended for restricted distribution?

Accepted Answer

SOC 2 Type II

Answer

SOC 1 Type II

Answer

SOC 3

Answer

ISO/IEC 27001 certificate

Question 4

What is the primary focus of the EU General Data Protection Regulation (GDPR) as it applies to cloud computing?

Accepted Answer

Protection of EU residents' personal data and enforcement of privacy rights including consent, access, and erasure

Answer

Cloud service pricing transparency

Answer

Security certification requirements for cloud providers

Answer

Network performance standards for cloud services

Question 5

In cloud risk management, what does quantitative risk analysis produce that qualitative analysis does not?

Accepted Answer

Numerical estimates of risk in monetary terms (e.g., Annual Loss Expectancy)

Answer

A color-coded risk heat map

Answer

A descriptive ranking of risks as high, medium, or low

Answer

A list of applicable compliance frameworks

Question 6

What is the role of the Data Protection Officer (DPO) under GDPR?

Accepted Answer

To ensure the organization complies with GDPR, advise on data protection obligations, and act as a contact for supervisory authorities

Answer

To sell personal data to marketing partners

Answer

To manage the organization's cloud infrastructure security

Answer

To conduct penetration tests on cloud environments