CSC Cloud Security Compliance 3 — Questions and Answers
Question 1: A security auditor is reviewing a multi-cloud environment. Which document helps map a cloud provider's security controls to multiple compliance frameworks simultaneously?
- SOC 2 Type II report
- CSA STAR registry entry (Correct answer)
- ISO 27017 certificate
- FedRAMP Authorization Package
Correct answer: CSA STAR registry entry
The CSA STAR (Security Trust Assurance and Risk) registry provides a public repository of cloud provider security controls mapped to the CCM and multiple compliance frameworks.
Question 2: What distinguishes a SOC 2 Type I report from a SOC 2 Type II report?
- Type I covers security; Type II covers all five Trust Service Criteria
- Type I assesses control design at a point in time; Type II tests operational effectiveness over a period (Correct answer)
- Type I is for cloud providers; Type II is for on-premises environments
- Type I requires a third-party auditor; Type II is self-attested
Correct answer: Type I assesses control design at a point in time; Type II tests operational effectiveness over a period
SOC 2 Type I evaluates whether controls are suitably designed at a specific date, while Type II tests whether those controls operated effectively over a review period (typically 6–12 months).
Question 3: Which FedRAMP authorization level is required for cloud systems that process Controlled Unclassified Information (CUI) with moderate potential impact?
- FedRAMP Low
- FedRAMP Moderate (Correct answer)
- FedRAMP High
- FedRAMP Tailored
Correct answer: FedRAMP Moderate
FedRAMP Moderate is required for systems where compromise would have serious adverse effects, covering most federal civilian data including standard CUI.
Question 4: An organization discovers that its cloud provider subcontracted data processing to a fourth-party vendor without notification. Which compliance principle does this most directly violate?
- Data minimization
- Purpose limitation
- Sub-processor notification requirements (Correct answer)
- Data portability
Correct answer: Sub-processor notification requirements
GDPR and many frameworks require processors to notify controllers before engaging sub-processors, giving controllers the right to object.
Question 5: What is the primary security concern addressed by implementing a Zero Trust Architecture in cloud environments?
- Eliminating the need for encryption
- Ensuring that no user or device is inherently trusted, requiring continuous verification (Correct answer)
- Replacing VPNs with direct internet connectivity
- Reducing the number of security tools required
Correct answer: Ensuring that no user or device is inherently trusted, requiring continuous verification
Zero Trust eliminates implicit trust based on network location, requiring every access request to be authenticated, authorized, and continuously validated.
Question 6: Which cloud storage misconfiguration has been the most common cause of large-scale data breaches in public cloud environments?
- Unencrypted data at rest
- Publicly accessible storage buckets without authentication (Correct answer)
- Lack of versioning on storage objects
- Missing access logging on storage services
Correct answer: Publicly accessible storage buckets without authentication
Misconfigured S3 buckets and equivalent public cloud storage containers set to public access have been responsible for numerous high-profile data breaches.
Question 7: Under the NIST Cloud Computing definition, which deployment model offers infrastructure exclusively for use by a single organization but may be managed by a third party?
- Public cloud
- Hybrid cloud
- Private cloud (Correct answer)
- Community cloud
Correct answer: Private cloud
A private cloud is provisioned for exclusive use by a single organization and can be owned, managed, and operated by the organization, a third party, or a combination.
CSC Cloud Security Compliance 3
A security auditor is reviewing a multi-cloud environment.
Which document helps map a cloud provider's security controls to multiple compliance frameworks simultaneously?