I85PREP
⌘ K
CCSK study materials
CCSK study resources

CCSK practice questions

One question at a time. Build your CCSK understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Computing Concepts & Architectures

Which NIST cloud characteristic lets a consumer provision server time and network storage unilaterally, without human interaction with the provider?

  1. On-demand self-service Correct answer.
  2. Measured, metered service
  3. Broad network access
  4. Multi-tenant resource pooling

Explanation

NIST defines on-demand self-service as the ability of a consumer to unilaterally provision computing capabilities, such as server time and network storage, automatically and without requiring human interaction with each service provider. The remaining characteristics describe how services are reached, how resources are shared, and how usage is metered rather than how provisioning autonomy works.

Question 2Cloud Computing Concepts & Architectures

In which service model does the provider manage the application itself while the consumer simply uses it, with no management of the underlying infrastructure?

  1. SaaS Correct answer.
  2. FaaS
  3. IaaS
  4. PaaS

Explanation

In Software as a Service the provider runs and maintains the entire stack including the application, and the consumer accesses it through a client interface without managing servers, platforms or application code. The other models expose progressively more of the stack to the consumer for management.

Question 3Cloud Computing Concepts & Architectures

Which deployment model describes cloud infrastructure provisioned for exclusive use by a single organization comprising multiple consumers, such as separate business units?

  1. Private cloud Correct answer.
  2. Public cloud
  3. Hybrid cloud
  4. Community cloud

Explanation

A private cloud is provisioned for exclusive use by a single organization with multiple consumers, and it may be owned, managed and operated by the organization or a third party on or off its premises. Community clouds serve several organizations with shared concerns, while public clouds are open to the general public.

Question 4Cloud Computing Concepts & Architectures

Which component runs directly on the physical host hardware without requiring an underlying general-purpose operating system?

  1. Type 1 hypervisor Correct answer.
  2. Paravirtualized guest OS
  3. Hosted hypervisor
  4. Type 2 hypervisor

Explanation

A Type 1, or bare-metal, hypervisor is installed directly on the host hardware and does not depend on a general-purpose host operating system, which reduces the attack surface and often improves performance. Type 2 hypervisors run as applications on a conventional operating system.

Question 5Cloud Computing Concepts & Architectures

Which cloud storage model is best suited to large volumes of unstructured data accessed over HTTP APIs through a flat namespace of unique keys?

  1. Block storage
  2. Direct-attached storage
  3. File storage
  4. Object storage Correct answer.

Explanation

Object storage keeps data as discrete objects with unique keys and rich metadata in a flat namespace, reached through RESTful HTTP APIs, which makes it well suited to massive unstructured datasets and web-scale access. Block and file storage present different abstractions intended for different workloads.

Question 6Cloud Computing Concepts & Architectures

Under the shared responsibility model for an IaaS deployment, which task remains the customer's responsibility?

  1. Patching the guest operating system Correct answer.
  2. Securing the physical network fabric
  3. Patching the hypervisor
  4. Maintaining the physical data center

Explanation

In IaaS the provider secures and operates the facilities, hardware, network fabric and hypervisor, while the customer owns everything from the guest operating system upward, including its patches, configuration and applications. The boundary shifts upward as customers adopt PaaS and SaaS.

Question 7Cloud Computing Concepts & Architectures

Which practice describes running an application primarily in a private environment and automatically extending capacity into a public cloud when demand peaks?

  1. Moving peak overflow demand from a private environment into a public cloud Correct answer.
  2. Migrating all workloads permanently from private to public cloud
  3. Balancing traffic across availability zones within a single region
  4. Running workloads across two public providers for redundancy

Explanation

Cloud bursting keeps the baseline workload in a private or dedicated environment and temporarily adds public cloud capacity when demand exceeds local resources, after which the overflow is released. It is a capacity strategy, not a permanent migration or an availability-zone design pattern.

Question 8Cloud Computing Concepts & Architectures

What primarily distinguishes container-based workloads from virtual machines?

  1. Containers cannot run on Linux hosts
  2. Containers require a guest OS per instance
  3. Containers provide stronger hardware isolation than virtual machines
  4. Containers share the host kernel instead of virtualizing hardware Correct answer.

Explanation

Containers package an application with its dependencies and rely on operating-system-level isolation, sharing the host kernel rather than each carrying a full guest operating system. This makes them lighter and faster to start, but it also means the shared kernel becomes part of the trust boundary.

Question 9Cloud Computing Concepts & Architectures

A company keeps regulated records in its own data center while running its web front end in a public cloud, with orchestration linking the two. Which deployment model does this illustrate?

  1. Hybrid cloud Correct answer.
  2. Community cloud
  3. Private cloud
  4. Public cloud

Explanation

A hybrid cloud combines two or more distinct deployment models that remain unique entities but are bound together by standardized or proprietary technology enabling data and application portability. The split between an on-premises estate and a public provider, joined by orchestration, is the defining pattern.

Question 10Cloud Computing Concepts & Architectures

Which term describes the ability to move application workloads and data from one cloud provider to another with minimal disruption and rework?

  1. Federation
  2. Elasticity
  3. Portability Correct answer.
  4. Interoperability

Explanation

Portability is the capability to move components such as applications and data between providers or environments without significant re-engineering. Interoperability is the related but distinct ability of systems to exchange and use information, which does not by itself permit migration.

Question 11Cloud Computing Concepts & Architectures

Which mechanism lets a user authenticated by the home organization's identity provider reach a cloud service without a separate set of cloud-specific credentials?

  1. Multi-factor authentication
  2. Federated identity Correct answer.
  3. Mandatory access control
  4. Role-based access control

Explanation

Federated identity establishes a trust relationship between the user's home identity provider and the cloud service provider, so assertions about the authenticated user are accepted across organizational boundaries. This avoids maintaining parallel local credentials at each provider.

Question 12Cloud Computing Concepts & Architectures

How does a cloud provider typically structure regions and availability zones to support resiliency?

  1. Each region is limited to exactly one availability zone
  2. A region contains multiple isolated zones with independent power and network Correct answer.
  3. All availability zones share one power and cooling infrastructure
  4. Availability zones are logical partitions inside a single data hall

Explanation

A region is a geographic area containing multiple availability zones that are physically separated with independent power, cooling and network connectivity, so a failure in one zone does not cascade to others. Customers achieve resilience by deploying redundant instances across zones within a region.

Question 13Cloud Computing Concepts & Architectures

Which cloud model runs individual code units on demand, scales automatically, and bills only for the execution time consumed while the provider manages all server infrastructure?

  1. Bare-metal hosting
  2. IaaS with reserved instances
  3. Managed Kubernetes clusters
  4. Serverless compute Correct answer.

Explanation

Serverless compute, typically delivered as Functions as a Service, abstracts servers entirely: the provider provisions capacity, scales on demand and charges per invocation and execution duration. The customer supplies code and configuration only, never host or cluster management.

Question 14Cloud Computing Concepts & Architectures

What is a defining feature of software-defined networking in cloud environments?

  1. Network functions run only on dedicated hardware appliances
  2. Control plane is decoupled from the data plane and managed programmatically Correct answer.
  3. Network topology is fixed at provisioning time
  4. Traffic is routed solely by physical switch MAC tables

Explanation

Software-defined networking separates the control plane that decides where traffic goes from the data plane that forwards it, exposing control through APIs so networks can be defined in software. This is what allows cloud providers and tenants to create isolated virtual networks, subnets and security policies on demand.

Question 15Cloud Computing Concepts & Architectures

Why is destroying the encryption keys often the preferred way to render deleted cloud data unrecoverable?

  1. Compressing data reduces the storage cost of deletion
  2. It proves the provider cannot access the data
  3. Destroying the keys renders the remaining ciphertext unrecoverable Correct answer.
  4. It automatically replicates data to a second region

Explanation

Cryptographic erasure leaves ciphertext in place but destroys the key material needed to decrypt it, which is practical in multi-tenant environments where the exact physical media location of the data may be unknown or replicated. The technique depends on effective key management and key destruction being auditable.

Question 16Cloud Computing Concepts & Architectures

Which risk is most closely associated with co-locating virtual machines from different tenants on the same hypervisor?

  1. Increased latency from network oversubscription
  2. Cross-tenant compromise through a hypervisor or side-channel exploit Correct answer.
  3. Loss of the ability to encrypt data at rest
  4. Reduced elasticity during demand spikes

Explanation

Multi-tenancy places logically isolated instances on shared physical hosts, so a hypervisor vulnerability or a cache-timing side channel can become a path from one tenant's workload to another's data. This is why providers emphasize hypervisor patching, hardware-assisted isolation and dedicated-host options for the most sensitive workloads.

Question 17Cloud Computing Concepts & Architectures

What is the principal security consequence of cloud platforms being API-driven and remotely managed?

  1. Encryption at rest becomes unnecessary
  2. API access cannot be logged or audited
  3. APIs remove the need for authentication
  4. Compromise of management APIs can expose entire environments Correct answer.

Explanation

Because provisioning, configuration and data access are performed through management APIs, a stolen or over-privileged key can act at machine speed across the whole estate. This is why API credential protection, least privilege, key rotation and management-plane logging are central cloud controls.

Question 18Cloud Computing Concepts & Architectures

A provider automatically replicates customer data into several geographic regions for durability. What is the primary governance concern this creates?

  1. Data residency and legal jurisdiction of stored copies Correct answer.
  2. Increased storage cost only
  3. Loss of data durability
  4. Reduced availability during outages

Explanation

Cross-region replication can place copies of data in other countries or legal jurisdictions, which may conflict with residency requirements, contractual commitments or data protection law. Organizations must map where data is stored and processed, and confirm which replication features can be constrained.

Question 19Cloud Governance

In cloud governance, which statement best distinguishes governance from management?

  1. Governance applies only to financial reporting; management covers security operations.
  2. Governance executes controls; management defines the risk appetite.
  3. Governance is performed only by the cloud provider; management only by the customer.
  4. Governance sets strategic direction and oversight; management executes day-to-day activities. Correct answer.

Explanation

Governance establishes direction, priorities, risk appetite, and oversight through leadership and policy. Management carries out the operational activities that implement that direction. The two are complementary but not interchangeable.

Question 20Cloud Governance

An organization migrates to a SaaS provider. Which governance responsibility remains with the customer?

  1. Maintaining the physical security of the provider's data centers
  2. Defining which data may be stored and who may access it Correct answer.
  3. Patching the provider's hypervisor and host operating systems
  4. Managing the provider's internal employee background checks

Explanation

Under the shared responsibility model, the customer retains accountability for its own data, including classification, permitted use, and access decisions. Physical security and provider platform patching generally belong to the provider in a SaaS arrangement. The customer cannot delegate its data governance obligations to the provider.

Question 21Cloud Governance

Which sequence correctly orders the typical hierarchy of security documents from highest to most specific?

  1. Standard, policy, procedure, guideline
  2. Procedure, policy, standard, guideline
  3. Guideline, procedure, standard, policy
  4. Policy, standard, procedure, guideline Correct answer.

Explanation

Policy states management intent and mandatory high-level requirements. Standards define specific mandatory rules, procedures describe how to perform tasks, and guidelines provide recommended practices. This ordering moves from broad direction to detailed implementation guidance.

Question 22Cloud Governance

What does risk appetite represent in an enterprise risk management program?

  1. The amount and type of risk an organization is willing to retain Correct answer.
  2. The technical controls used to reduce identified vulnerabilities
  3. The maximum financial loss a single system can tolerate
  4. The list of risks that have been transferred to an insurer

Explanation

Risk appetite is the level and type of risk an organization is willing to accept in pursuit of its objectives. It guides decisions about which risks to avoid, mitigate, transfer, or accept. It is distinct from risk tolerance, which sets acceptable variation around that appetite.

Question 23Cloud Governance

What is the primary purpose of the CSA Cloud Controls Matrix (CCM)?

  1. To replace an organization's enterprise risk management program
  2. To measure the latency and availability of cloud data centers
  3. To provide a controls framework mapped to multiple standards Correct answer.
  4. To certify cloud providers against a single global privacy law

Explanation

The Cloud Controls Matrix provides a cloud-specific set of security controls and maps them to various standards and regulations. Organizations use it to assess providers and align cloud controls with broader compliance requirements. It is a controls framework, not a certification or performance measurement tool.

Question 24Cloud Governance

A company wants assurance that it can examine a cloud provider's security controls and records. Which contractual element best supports this?

  1. A right-to-audit clause covering relevant controls Correct answer.
  2. A service level agreement that lists uptime percentages
  3. A data residency clause naming the primary region
  4. A limitation-of-liability clause capping damages

Explanation

A right-to-audit clause grants the customer or its designee the ability to review the provider's controls, records, and audit reports. It supports ongoing governance and third-party risk oversight. Uptime, residency, and liability terms address different concerns.

Question 25Cloud Governance

What is the main role of COBIT in cloud governance?

  1. It provides an enterprise IT governance framework Correct answer.
  2. It certifies individual cloud data centers for physical security
  3. It defines technical configurations for cloud firewalls
  4. It prescribes cryptographic algorithms for data at rest

Explanation

COBIT is a framework for the governance and management of enterprise IT. It helps organizations define objectives, assign accountability, and assess IT-related risk and performance, including cloud services. It does not prescribe low-level technical configurations or certify facilities.

Question 26Cloud Governance

A risk assessment finds that a legacy application cannot be secured in the cloud. The organization retires the application instead of migrating it. Which risk treatment is this?

  1. Risk mitigation
  2. Risk avoidance Correct answer.
  3. Risk transfer
  4. Risk acceptance

Explanation

Risk avoidance eliminates the activity or asset that creates the risk, which is what retiring the application does. Risk mitigation reduces risk through controls, transfer shifts financial impact, and acceptance retains the risk knowingly. Retiring the service removes the exposure entirely.

Question 27Cloud Governance

What does a SOC 2 Type II report primarily provide to a cloud customer?

  1. An auditor's opinion on control effectiveness over a period Correct answer.
  2. A complete list of the provider's source code vulnerabilities
  3. A guarantee that no security incidents will occur in the future
  4. A certification of compliance with every global privacy regulation

Explanation

A SOC 2 Type II report covers the design and operating effectiveness of controls over a period of time, based on an independent auditor's testing. It gives customers evidence about controls but does not guarantee future outcomes. It is also not a complete vulnerability list or universal privacy certification.

Question 28Cloud Governance

In information governance, which role typically decides who may access a dataset and for what purposes?

  1. The data owner, who is accountable for the data Correct answer.
  2. The data custodian, who operates the storage platform
  3. The external auditor performing the annual review
  4. The cloud provider's facilities manager

Explanation

The data owner is accountable for a dataset and typically sets access rules and permitted uses. The custodian implements and operates the technical controls on the owner's behalf. Auditors provide independent assessment but do not set access policy.

Question 29Cloud Governance

Which governance approach best addresses employees adopting unsanctioned cloud services?

  1. Blocking all outbound traffic permanently without exception
  2. Delegating all cloud purchasing to individual business units
  3. Maintaining a sanctioned service catalog with light approval Correct answer.
  4. Relying on the finance department to detect recurring charges

Explanation

Shadow IT is best managed by making approved services easy to adopt while still applying risk review. A sanctioned catalog with a lightweight approval path gives users a compliant alternative. Blanket blocking and after-the-fact expense detection do not address the underlying business need.

Question 30Cloud Governance

Why is continuous compliance monitoring especially important in cloud environments?

  1. Cloud configurations change frequently, making audits quickly stale Correct answer.
  2. Continuous monitoring eliminates the need for any internal controls
  3. Cloud providers are legally required to publish all audit findings
  4. Point-in-time audits are prohibited by most standards

Explanation

Cloud resources are provisioned and changed rapidly, so a configuration that was compliant during an annual audit may drift soon afterward. Continuous monitoring detects drift and control failures closer to real time. It complements, rather than replaces, internal controls and periodic audits.

Question 31Cloud Governance

An enterprise uses several cloud providers with different control frameworks. Which practice most improves governance consistency?

  1. Accepting each provider's self-attestation without review
  2. Standardizing on the provider with the lowest cost
  3. Mapping provider controls to a single internal control framework Correct answer.
  4. Letting each business unit define its own unrelated controls

Explanation

A single internal control framework provides a common language for comparing providers and reporting risk. Provider-specific controls can be mapped into that framework so gaps and overlaps are visible. Decentralized or unverified approaches reduce comparability and oversight.

Question 32Cloud Governance

A team argues that moving workloads to a private cloud eliminates the need for cloud risk assessment. What is the most accurate governance response?

  1. Disagree, because private cloud still carries shared and operational risks Correct answer.
  2. Disagree, because private clouds are exempt from compliance requirements
  3. Agree, because risk assessment is only required for public cloud services
  4. Agree, because private clouds are always operated by internal staff

Explanation

Private cloud still involves shared infrastructure, operational dependencies, and concentration risk, even when operated internally. Governance requires risk assessment for any cloud deployment model. The deployment model changes the risk profile but does not remove the need to assess it.

Question 33Cloud Governance

Which set of measures best demonstrates cloud governance effectiveness to executive management?

  1. Counts of firewall rules and server names per region
  2. Number of cloud providers evaluated and subscription costs
  3. Asset ownership coverage and timely exception remediation Correct answer.
  4. Total employees attending any security awareness session

Explanation

Effective governance metrics should show accountability and follow-through, such as how much of the cloud estate has assigned owners and whether exceptions are remediated on time. Raw technical counts and attendance figures do not demonstrate governance outcomes. Executive reporting should focus on risk and control effectiveness.

Question 34Cloud Governance

Which governance control best addresses the risk of excessive entitlements accumulating in cloud identities over time?

  1. Increasing password complexity requirements for all users
  2. Requiring users to acknowledge an acceptable use policy annually
  3. Enabling static, long-lived access keys for service accounts
  4. Periodic access reviews with entitlement recertification Correct answer.

Explanation

Entitlement creep occurs when users or services retain permissions beyond what their current role requires. Periodic access reviews require managers or resource owners to recertify access and remove unnecessary rights. Password rules and policy acknowledgments do not address accumulated permissions.

Question 35Cloud Governance

What is the purpose of a cloud governance steering committee?

  1. To negotiate individual employee salaries in the cloud team
  2. To provide cross-functional oversight of cloud strategy and risk Correct answer.
  3. To write application code for cloud-native services
  4. To perform daily patch management across all cloud servers

Explanation

A governance steering committee brings together business, security, risk, and IT stakeholders to set cloud direction, resolve conflicts, and oversee risk and policy. It is an oversight body rather than an operational team. Technical execution remains with the appropriate engineering and operations groups.

Question 36Cloud Governance

Which statement best describes the relationship between compliance and governance in cloud computing?

  1. Governance gives oversight and direction; compliance shows adherence Correct answer.
  2. Compliance guarantees that governance objectives are fully met
  3. Compliance is optional when governance is mature
  4. Governance and compliance are identical and interchangeable terms

Explanation

Governance sets direction, accountability, and risk appetite, while compliance demonstrates that obligations and controls are being met. They are related but distinct: strong governance drives compliance activities, and compliance evidence informs governance. Neither replaces the other.

Question 37Risk, Audit, & Compliance

Which CSA artifact is a structured framework of security controls, organized by domain and mapped to major standards, that organizations use to assess a cloud provider's control environment?

  1. The Cloud Controls Matrix (CCM) Correct answer.
  2. The Top Threats to Cloud Computing report
  3. The Consensus Assessments Initiative Questionnaire (CAIQ)
  4. The Security, Trust, Assurance and Risk (STAR) registry

Explanation

The CCM is CSA's controls framework: it catalogues security controls by domain and maps them to standards such as ISO/IEC 27001, COBIT and PCI DSS so that cloud environments can be assessed consistently. The CAIQ is a questionnaire built on top of the CCM, while STAR is a programme that publishes assessments.

Question 38Risk, Audit, & Compliance

What is the primary purpose of the CSA Consensus Assessments Initiative Questionnaire (CAIQ)?

  1. To define the legal terms that govern cloud service contracts
  2. To certify a provider's infrastructure against the ISO/IEC 27001 standard
  3. To document provider controls using a standard set of questions Correct answer.
  4. To benchmark provider pricing against industry averages

Explanation

The CAIQ gives customers a consistent, industry-agreed set of yes/no questions so that provider responses can be compared across vendors and mapped back to the CCM. It is a disclosure instrument that supports due diligence, not a certification or a contract template.

Question 39Risk, Audit, & Compliance

A cloud provider wants to show that its controls have been examined by an independent third-party assessor, with the results published in the CSA STAR registry. Which STAR level applies?

  1. Level 1: self-assessment
  2. Level 2: third-party audit Correct answer.
  3. Level 3: continuous monitoring-based certification
  4. Level 4: government accreditation

Explanation

STAR Level 2 requires an independent third-party assessment of the provider's controls against the CCM or a recognized standard, and the resulting report is published in the registry. Level 1 is a self-assessment, and Level 3 adds continuous monitoring-based certification on top of an audited assessment.

Question 40Risk, Audit, & Compliance

Which standard supplies cloud-specific controls and implementation guidance that supplement ISO/IEC 27001 and ISO/IEC 27002?

  1. ISO/IEC 27036
  2. ISO/IEC 27018
  3. ISO/IEC 27017 Correct answer.
  4. ISO/IEC 27701

Explanation

ISO/IEC 27017 extends the ISO/IEC 27001 and 27002 control sets with cloud-specific guidance, and it explicitly clarifies which controls apply to cloud service providers and which to cloud customers. This makes it the reference point for dividing security responsibilities in a cloud relationship.

Question 41Risk, Audit, & Compliance

ISO/IEC 27018 is best described as which of the following?

  1. A certification scheme for the physical security of cloud data centres
  2. A code of practice for protecting PII in public cloud services Correct answer.
  3. A standard for cryptographic key management in the cloud
  4. A framework for cloud service level agreement metrics

Explanation

ISO/IEC 27018 is a code of practice that applies to public cloud providers acting as processors of personally identifiable information, adding requirements on consent, disclosure to third parties, and return or deletion of PII. It is used alongside ISO/IEC 27001 and 27017 rather than replacing them.

Question 42Risk, Audit, & Compliance

Which assurance report is intended for general distribution and summarizes a service organization's controls without disclosing detailed test results and exceptions?

  1. SOC 3 Correct answer.
  2. SOC 1 Type 1
  3. SOC 1 Type 2
  4. SOC 2 Type 2

Explanation

A SOC 3 report is a general-use report that gives the auditor's opinion on whether the service organization's description is fairly presented and its controls suitably designed, without the detailed control testing results included in SOC 2 reports. SOC 2 reports are restricted-use and distributed under confidentiality to specified parties.

Question 43Risk, Audit, & Compliance

In an IaaS deployment, a customer's auditor asks for evidence that guest operating system patches on the customer's virtual machines were applied within policy. Who must normally supply that evidence?

  1. The auditor, by scanning the provider's infrastructure
  2. The customer, because guest OS patching is a customer responsibility in IaaS Correct answer.
  3. The provider, because the hypervisor is in scope of its certification
  4. A third-party assessor, because patch evidence can only be validated externally

Explanation

In IaaS the provider secures the facilities, hardware, network and virtualization layer, while the customer controls the guest operating system, middleware and applications, including patching. The provider's audit reports therefore cannot evidence guest OS patch levels on customer-controlled instances.

Question 44Risk, Audit, & Compliance

An organization buys cyber insurance to cover losses arising from a cloud data breach. Which risk treatment option does this represent?

  1. Risk transference Correct answer.
  2. Risk mitigation
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transference shifts the financial consequence of a risk to another party, typically through insurance, indemnities or contractual terms; the underlying risk event can still occur. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the exposure.

Question 45Risk, Audit, & Compliance

After controls have been implemented, the level of risk that still remains is known as which of the following?

  1. Inherent risk
  2. Risk tolerance
  3. Residual risk Correct answer.
  4. Risk appetite

Explanation

Residual risk is the exposure that persists once existing controls have been applied and evaluated. It is compared against the organization's risk appetite to decide whether further treatment is required.

Question 46Risk, Audit, & Compliance

Which of the following best defines risk appetite?

  1. The variance between assessed and realized risk
  2. The set of risks recorded in the risk register
  3. The amount and type of risk an organization is willing to accept Correct answer.
  4. The maximum financial loss that a single control failure could cause the organization

Explanation

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives, and it sets the boundary against which residual risk is judged. Tolerance then defines the acceptable variation around that appetite for specific metrics.

Question 47Risk, Audit, & Compliance

Before signing with a new SaaS provider, a company reviews the provider's SOC 2 report, CAIQ responses and public breach history. This activity is best described as which of the following?

  1. Continuous control monitoring
  2. Third-party risk due diligence Correct answer.
  3. Penetration testing
  4. Data loss prevention

Explanation

Due diligence is the pre-contract assessment of a prospective provider's security, privacy and compliance posture, drawing on independent audit reports, standardized questionnaires such as the CAIQ, and incident history. Its outputs feed the risk decision and the contractual requirements imposed on the provider.

Question 48Risk, Audit, & Compliance

A customer's contract with a large public cloud provider contains no right-to-audit clause. What is the most practical way for the customer to obtain assurance over the provider's controls?

  1. Commission an unannounced penetration test against the provider's production infrastructure
  2. Rely on the provider's independent audit reports and certifications Correct answer.
  3. Insist on an on-site inspection, since cloud customers always retain an unconditional right to audit provider facilities
  4. Accept the provider's public marketing statements about security as sufficient assurance

Explanation

Customers of hyperscale providers generally cannot obtain on-site audit rights; instead they rely on independent third-party reports and certifications such as SOC 2, ISO/IEC 27001 or STAR, then map those results to their own requirements and supplement them with contractual commitments. Unauthorized testing of provider infrastructure breaches the terms of service and may be unlawful.

Question 49Risk, Audit, & Compliance

Which approach best maintains assurance over a cloud provider's controls between periodic third-party audits?

  1. Replacing the auditor with an internal self-attestation each quarter
  2. Continuous monitoring of the provider's control evidence Correct answer.
  3. Relying on the original audit report until its expiry date
  4. Requesting a new full-scope audit whenever a configuration change occurs

Explanation

Continuous monitoring collects control evidence on an ongoing basis, such as configuration data, logs and updated attestations, so assurance reflects current conditions rather than a point in time. Re-auditing after every change is disproportionate, and a prior report's findings do not remain valid indefinitely.

Question 50Risk, Audit, & Compliance

A multinational must keep EU personal data within the EU. Which contractual and architectural element most directly addresses this requirement?

  1. Contractual and technical guarantees that data stays in EU regions Correct answer.
  2. A service level agreement guaranteeing 99.99% availability
  3. A right-to-audit clause covering the provider's global data centres
  4. A clause requiring encryption of data at rest with customer-managed keys

Explanation

Data residency is achieved through contractual commitments combined with technical controls such as region pinning, restricted replication and configuration that confines storage and processing to approved jurisdictions. Encryption protects confidentiality but does not by itself prevent data from being stored or processed outside the EU.