Legal, Risk and Compliance

CCSP · 39 questions

• A cloud provider headquartered in the United States receives a lawful US order under the CLOUD Act to disclose emails of a European customer that are stored only in its EU region. The customer's data protection officer warns that disclosure could breach GDPR transfer restrictions. Which concept best describes this risk?
• A multinational plans to roll out a SaaS human resources system. One country where it operates has a statute requiring that personal data about its citizens be stored and processed only within national borders. Which design response best satisfies this requirement?
• During due diligence, a customer learns that a prospective cloud provider uses subprocessors in several other countries for customer support and backup storage. The standard contract does not name them or their locations. What should the customer do to evaluate this legal risk?
• A multinational wants to anchor its cloud privacy program in internationally recognized principles, such as collection limitation, purpose specification, use limitation, security safeguards and accountability, that have influenced many national privacy laws. Which source best fits this need?
• A company in litigation must identify, preserve, collect and produce email and attachments held in its SaaS collaboration platform. Which approach best aligns with ISO/IEC 27050 and CSA guidance on eDiscovery in the cloud?
• Law enforcement investigating one tenant of a public cloud service proposes seizing the physical server that hosts that tenant's virtual machines. The provider objects. Why is physical seizure problematic in this setting, and what approach is generally preferred?
• Investigators handling a cloud incident need internationally recognized guidelines for the identification, collection, acquisition and preservation of potential digital evidence, including from virtualized systems. Which standard should they consult?
• A forensic laboratory supporting cloud investigations must demonstrate, before relying on a new acquisition tool and procedure, that its investigative methods are suitable and adequate for their purpose. Which standard provides guidance specifically on this assurance?
• A marketing firm receives a client's list of business contacts under a contract that limits how the list may be used, and no statute in its jurisdiction regulates that business contact data. Separately, its clinic subsidiary stores patient health records. Which statement correctly distinguishes the two?
• A US hospital, a HIPAA covered entity, plans to store electronic protected health information with a cloud provider. The data will be encrypted, and the provider states it has no access to the decryption keys. Before migration, what does HIPAA require regarding the provider?
• A US university that receives federal education funding moves student education records, including grades and disciplinary files, into a SaaS learning management system. Which law primarily governs disclosure of these records, and how can the vendor lawfully receive them?
• A Canadian private-sector company collects customers' personal information in the course of commercial activity and plans to have it processed by a cloud provider located in another country. Under PIPEDA, which statement is correct?
• An EU-based controller wants to use a cloud provider located in a third country that does not have an adequacy decision from the European Commission. Which mechanism can lawfully enable the transfer of personal data to that provider under the GDPR?
• A company that serves users in India decides why and how their digital personal data is processed, and it uses a cloud provider that processes that data only on the company's behalf. Under India's Digital Personal Data Protection Act, how are these parties described?
• A public cloud provider that processes personally identifiable information on behalf of its customers wants to adopt an international code of practice that extends ISO/IEC 27002 controls specifically for protecting PII in that processor role. Which standard should it adopt?
• A company is designing a new cloud-based analytics platform that will combine customer purchase histories with location data to build behavioral profiles. Architecture decisions are still open. What should the privacy team do, and when?
• A company's board wants independent assurance on the effectiveness of its cloud security controls that regulators and investors will accept, rather than a review by staff who report to the CIO and help run those controls. What should the company engage?
• An auditor finds that the virtual machines sampled last quarter no longer exist, because the cloud environment autoscales and rebuilds instances from images every day, and the hypervisor layer is not visible to the customer. What is the core assurance challenge, and how should the audit adapt?
• A customer's security team needs a detailed, restricted-use report from an independent auditor on a SaaS provider's controls relevant to security, availability and confidentiality, rather than controls relevant to the customer's financial reporting. Which report should it request?
• A vendor provides a SOC 2 report in which the auditor opines on the suitability of the design of controls as of a single specific date. The customer's risk committee needs evidence that those controls actually operated effectively throughout the past year. What should the customer request?
• A cloud provider headquartered in Europe offers its customers an independent assurance report issued under the international standard for controls at a service organization relevant to user entities' financial reporting. A US customer's auditors ask what this report corresponds to. Which statement is correct?
• A SaaS provider's SOC 2 report states that it uses the carve-out method for the colocation company that operates its data centers, and it lists several complementary user entity controls. What does this mean for the customer relying on the report?
• Before pursuing ISO/IEC 27001 certification, a company wants to compare its current cloud security controls against the standard's requirements to see what is missing, and to have control owners rate how well their own controls work. Which activity fits this need?
• Internal audit is planning an audit of a customer-facing application deployed across three cloud regions in different countries, using a mix of IaaS and SaaS services. What should the audit plan establish first?
• An organization building an internal information security management system is drafting a top-level security policy, functional policies for areas such as access control and data classification, and a policy governing use of cloud services. How should these policies relate to each other?
• A North American electric utility plans to move systems that support real-time monitoring and control of its bulk electric system to a cloud service operated across several regions. Which compliance requirement is most specific to this workload?
• While reviewing a cloud provider's risk management program, a customer finds that the provider accepts certain risks, such as extended patching windows for some platform components, that exceed the customer's own risk appetite for a regulated workload. What should the customer do?
• An online retailer decides which customer data to collect and why, and it uses a cloud provider that stores and processes that data only according to the retailer's documented instructions. Under the GDPR, how should these roles be classified?
• In a company's cloud data program, a database administrator implements backups, encryption and access controls as directed by policy, while a business analyst defines data quality rules, maintains metadata and ensures the data is used appropriately. Which roles do they hold?
• A cloud provider acting as a GDPR processor discovers that personal data it hosts for one of its customers, the controller, has been exfiltrated by an attacker. What is the provider's primary notification obligation under the GDPR?
• A US public company moves its general ledger and financial reporting applications to a SaaS provider. The company's external auditors are preparing their review of internal control over financial reporting. What is the main Sarbanes-Oxley implication of this move?
• A multinational's risk team must select a risk management framework that is an international, principles-based standard applicable to any type of organization and any type of risk, rather than one designed for federal information systems or limited to cloud computing. Which should it choose?
• Leadership wants metrics that warn when the organization's cloud risk exposure is increasing before an incident occurs, such as a rising number of publicly accessible storage buckets or of identities without multifactor authentication. What type of metric should the risk team define?
• A SaaS vendor that hosts several of a company's critical business processes announces layoffs, delays its annual audit report and misses a planned funding round. Which risk assessment activity should the company carry out?
• A procurement team mixes up three cloud contract documents: one sets the overall legal terms such as liability, confidentiality and governing law for every engagement; one defines measurable service commitments such as availability and support response times; and one describes specific deliverables for a migration project. What are these documents, in that order?
• A customer's policy requires the right to audit critical suppliers. A large multi-tenant cloud provider refuses individual on-site customer audits, citing security and the impact on other tenants, but offers current independent attestation reports and certifications. What is the most appropriate approach?
• A company's SaaS contract is silent on what happens to customer data when the agreement ends. Legal counsel wants to close that gap before renewal. Which contract terms should be added?
• A small SaaS vendor provides a custom application that runs a critical business process for the company, and no comparable product exists on the market. The company is concerned the vendor could go out of business and leave it without access to the software. Which contractual mechanism best addresses this risk?
• A company wants an international standard that addresses information security in supplier relationships, including acquiring cloud services, so it can manage security risk across its supply chain throughout the life of each supplier engagement. Which standard should it use?