CSC Cloud Security Compliance 2 — Questions and Answers
Question 1: Under the AWS Shared Responsibility Model, which security control is always the customer's responsibility regardless of the service type used?
- Physical data center security
- Hypervisor patching
- Identity and access management for user accounts (Correct answer)
- Network infrastructure maintenance
Correct answer: Identity and access management for user accounts
IAM for user accounts is always the customer's responsibility across all AWS service types (IaaS, PaaS, SaaS).
Question 2: Which cloud security framework specifically addresses controls for cloud service providers and was developed by the Cloud Security Alliance?
- NIST CSF
- ISO/IEC 27001
- Cloud Controls Matrix (CCM) (Correct answer)
- CIS Benchmarks
Correct answer: Cloud Controls Matrix (CCM)
The Cloud Security Alliance's Cloud Controls Matrix (CCM) is specifically designed for cloud environments and maps to multiple compliance frameworks.
Question 3: A company stores PHI in a cloud database. Under HIPAA, which document must be executed with the cloud provider before any PHI is stored?
- Data Processing Agreement (DPA)
- Business Associate Agreement (BAA) (Correct answer)
- Service Level Agreement (SLA)
- Non-Disclosure Agreement (NDA)
Correct answer: Business Associate Agreement (BAA)
HIPAA requires a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Question 4: What is the primary purpose of a Cloud Access Security Broker (CASB)?
- To replace on-premises firewalls with cloud-native alternatives
- To enforce security policies between cloud users and cloud service providers (Correct answer)
- To provide cloud-based antivirus scanning
- To manage SSL/TLS certificates for cloud applications
Correct answer: To enforce security policies between cloud users and cloud service providers
A CASB acts as an intermediary that enforces security, compliance, and governance policies for cloud service usage.
Question 5: An organization subject to PCI DSS uses a cloud provider that has a PCI DSS AOC (Attestation of Compliance). What does this mean for the organization's compliance posture?
- The organization is automatically PCI DSS compliant
- The cloud provider's in-scope infrastructure satisfies certain PCI DSS requirements, but the customer must still address their own controls (Correct answer)
- The organization no longer needs its own QSA assessment
- The organization can store unencrypted cardholder data in the cloud
Correct answer: The cloud provider's in-scope infrastructure satisfies certain PCI DSS requirements, but the customer must still address their own controls
A provider's AOC covers only their portion of the shared responsibility; customers must still implement and validate their own controls.
Question 6: Which encryption approach ensures that a cloud provider cannot decrypt customer data even when compelled by a legal order?
- Server-side encryption with provider-managed keys
- Client-side encryption with customer-managed keys (Correct answer)
- Transport Layer Security (TLS) encryption
- Envelope encryption using provider KMS
Correct answer: Client-side encryption with customer-managed keys
Client-side encryption with customer-managed keys means the provider never has access to the plaintext data or the decryption keys.
Question 7: Under GDPR, if a U.S.-based company transfers EU personal data to its cloud provider's servers located in the U.S., which mechanism is commonly used to legalize the transfer?
- Safe Harbor Agreement
- Standard Contractual Clauses (SCCs) (Correct answer)
- APEC CBPR certification
- EU Cloud Code of Conduct
Correct answer: Standard Contractual Clauses (SCCs)
Standard Contractual Clauses (SCCs) are the most widely used legal mechanism for transferring personal data from the EU to third countries after Privacy Shield was invalidated.
CSC Cloud Security Compliance 2
Under the AWS Shared Responsibility Model, which security control is always the customer's responsibility regardless of the service type used?