CSC Cloud Security Compliance 3

Question 1

A security auditor is reviewing a multi-cloud environment. Which document helps map a cloud provider's security controls to multiple compliance frameworks simultaneously?

Accepted Answer

CSA STAR registry entry

Answer

The CSA STAR (Security Trust Assurance and Risk) registry provides a public repository of cloud provider security controls mapped to the CCM and multiple compliance frameworks.

Question 2

What distinguishes a SOC 2 Type I report from a SOC 2 Type II report?

Accepted Answer

Type I assesses control design at a point in time; Type II tests operational effectiveness over a period

Answer

SOC 2 Type I evaluates whether controls are suitably designed at a specific date, while Type II tests whether those controls operated effectively over a review period (typically 6–12 months).

Question 3

Which FedRAMP authorization level is required for cloud systems that process Controlled Unclassified Information (CUI) with moderate potential impact?

Accepted Answer

FedRAMP Moderate

Answer

FedRAMP Moderate is required for systems where compromise would have serious adverse effects, covering most federal civilian data including standard CUI.

Question 4

An organization discovers that its cloud provider subcontracted data processing to a fourth-party vendor without notification. Which compliance principle does this most directly violate?

Accepted Answer

Sub-processor notification requirements

Answer

GDPR and many frameworks require processors to notify controllers before engaging sub-processors, giving controllers the right to object.

Question 5

What is the primary security concern addressed by implementing a Zero Trust Architecture in cloud environments?

Accepted Answer

Ensuring that no user or device is inherently trusted, requiring continuous verification

Answer

Zero Trust eliminates implicit trust based on network location, requiring every access request to be authenticated, authorized, and continuously validated.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Cloud Security Compliance 3