CCSP Legal, Risk, and Compliance

Question 1

Which framework provides a set of controls specifically designed to assess the security of cloud service providers?

Accepted Answer

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Answer

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework specifically designed for cloud computing, mapping controls to regulatory standards and cloud service models.

Question 2

What is the primary purpose of a Business Associate Agreement (BAA) in the context of HIPAA compliance in the cloud?

Accepted Answer

To legally obligate a cloud vendor handling PHI to comply with HIPAA security and privacy requirements

Answer

A BAA is a legally binding contract required by HIPAA whenever a covered entity shares protected health information (PHI) with a third-party service provider.

Question 3

What type of audit report provides a detailed description of a service organization's controls but is intended for restricted distribution?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II reports provide detailed descriptions and evidence of controls over a period of time and are restricted to customers and stakeholders under NDA.

Question 4

What is the primary focus of the EU General Data Protection Regulation (GDPR) as it applies to cloud computing?

Accepted Answer

Protection of EU residents' personal data and enforcement of privacy rights including consent, access, and erasure

Answer

GDPR mandates how organizations collect, process, store, and delete EU residents' personal data, imposing strict consent requirements, data subject rights, and breach notification obligations.

Question 5

In cloud risk management, what does quantitative risk analysis produce that qualitative analysis does not?

Accepted Answer

Numerical estimates of risk in monetary terms (e.g., Annual Loss Expectancy)

Answer

Quantitative risk analysis calculates numerical values such as ALE (Annual Loss Expectancy) = ARO × SLE, enabling cost-benefit comparison of security controls.

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP Legal, Risk, and Compliance