CSC Cloud Security Compliance 2 — Questions and Answers
Question 1: Under the AWS Shared Responsibility Model, which security control is always the customer's responsibility regardless of the service type used?
- Physical data center security
- Hypervisor patching
- Identity and access management for user accounts (Correct answer)
- Network infrastructure maintenance
Correct answer: Identity and access management for user accounts
IAM for user accounts is always the customer's responsibility across all AWS service types (IaaS, PaaS, SaaS).
Question 2: Which cloud security framework specifically addresses controls for cloud service providers and was developed by the Cloud Security Alliance?
- NIST CSF
- ISO/IEC 27001
- Cloud Controls Matrix (CCM) (Correct answer)
- CIS Benchmarks
Correct answer: Cloud Controls Matrix (CCM)
The Cloud Security Alliance's Cloud Controls Matrix (CCM) is specifically designed for cloud environments and maps to multiple compliance frameworks.
Question 3: A company stores PHI in a cloud database. Under HIPAA, which document must be executed with the cloud provider before any PHI is stored?
- Data Processing Agreement (DPA)
- Business Associate Agreement (BAA) (Correct answer)
- Service Level Agreement (SLA)
- Non-Disclosure Agreement (NDA)
Correct answer: Business Associate Agreement (BAA)
HIPAA requires a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Question 4: What is the primary purpose of a Cloud Access Security Broker (CASB)?
- To replace on-premises firewalls with cloud-native alternatives
- To enforce security policies between cloud users and cloud service providers (Correct answer)
- To provide cloud-based antivirus scanning
- To manage SSL/TLS certificates for cloud applications
Correct answer: To enforce security policies between cloud users and cloud service providers
A CASB acts as an intermediary that enforces security, compliance, and governance policies for cloud service usage.
Question 5: An organization subject to PCI DSS uses a cloud provider that has a PCI DSS AOC (Attestation of Compliance). What does this mean for the organization's compliance posture?
- The organization is automatically PCI DSS compliant
- The cloud provider's in-scope infrastructure satisfies certain PCI DSS requirements, but the customer must still address their own controls (Correct answer)
- The organization no longer needs its own QSA assessment
- The organization can store unencrypted cardholder data in the cloud
Correct answer: The cloud provider's in-scope infrastructure satisfies certain PCI DSS requirements, but the customer must still address their own controls
A provider's AOC covers only their portion of the shared responsibility; customers must still implement and validate their own controls.
Question 6: Which encryption approach ensures that a cloud provider cannot decrypt customer data even when compelled by a legal order?
- Server-side encryption with provider-managed keys
- Client-side encryption with customer-managed keys (Correct answer)
- Transport Layer Security (TLS) encryption
- Envelope encryption using provider KMS
Correct answer: Client-side encryption with customer-managed keys
Client-side encryption with customer-managed keys means the provider never has access to the plaintext data or the decryption keys.
Question 7: Under GDPR, if a U.S.-based company transfers EU personal data to its cloud provider's servers located in the U.S., which mechanism is commonly used to legalize the transfer?
- Safe Harbor Agreement
- Standard Contractual Clauses (SCCs) (Correct answer)
- APEC CBPR certification
- EU Cloud Code of Conduct
Correct answer: Standard Contractual Clauses (SCCs)
Standard Contractual Clauses (SCCs) are the most widely used legal mechanism for transferring personal data from the EU to third countries after Privacy Shield was invalidated.
