I85PREP
⌘ K
PECB Lead Cloud Sec study materials
PECB Lead Cloud Sec study resources

PECB Lead Cloud Sec practice questions

One question at a time. Build your PECB Lead Cloud Sec understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of cloud computing

Which cloud characteristic allows computing capacity to be increased or decreased automatically in response to demand, from the consumer's perspective without human intervention?

  1. Resource pooling
  2. Multi-tenancy
  3. Measured service
  4. Rapid elasticity Correct answer.

Explanation

Rapid elasticity is the capability to scale resources out and back automatically as demand changes, appearing unlimited to the consumer. Measured service concerns metering and billing, pooling concerns shared physical resources, and multi-tenancy concerns sharing among tenants.

Question 2Fundamental principles and concepts of cloud computing

A provider offers a service where the consumer manages applications and data but not the operating system, runtime, or virtualization layer. Which service model does this describe?

  1. Function as a Service
  2. Software as a Service
  3. Platform as a Service Correct answer.
  4. Infrastructure as a Service

Explanation

In PaaS the provider manages the underlying infrastructure, operating system, and runtime, while the consumer controls deployed applications and possibly configuration. IaaS leaves the OS to the consumer, and SaaS leaves only limited user-specific settings.

Question 3Fundamental principles and concepts of cloud computing

In the NIST cloud deployment models, which model places infrastructure on the premises of the organization and is provisioned for exclusive use by that single organization?

  1. Community cloud
  2. Public cloud
  3. Private cloud Correct answer.
  4. Hybrid cloud

Explanation

A private cloud is provisioned for exclusive use by a single organization and may be owned, managed, and operated on or off premises. Community cloud serves several organizations with shared concerns, and hybrid combines two or more distinct models.

Question 4Fundamental principles and concepts of cloud computing

Which statement best captures the cloud consumer's responsibility boundary under the shared responsibility model for IaaS?

  1. The consumer secures the physical hosts while the provider secures the hypervisor
  2. The provider secures the physical facility while the consumer secures the guest operating system and its applications Correct answer.
  3. The provider secures the guest operating system while the consumer secures only their data
  4. Both parties jointly secure every layer with no defined boundary

Explanation

In IaaS the provider is responsible for the physical facility, hardware, and virtualization layer, while the consumer secures the guest OS, middleware, applications, and data. Responsibilities are divided by layer, not held jointly across all layers.

Question 5Fundamental principles and concepts of cloud computing

Which characteristic distinguishes community cloud from public cloud?

  1. It cannot use virtualization technology
  2. It is always hosted on the consumer's own premises
  3. It is offered free of charge to the general public
  4. It is provisioned for use by a specific group of organizations sharing common concerns Correct answer.

Explanation

A community cloud is shared by several organizations that have common concerns such as compliance or mission, and it may be managed by them or a third party. It is not necessarily on premises, not free public access, and can use virtualization.

Question 6Fundamental principles and concepts of cloud computing

An organization wants the burst capacity and cost benefits of public cloud while keeping regulated customer records in its own data center. Which deployment model aligns best with this requirement?

  1. Public cloud
  2. Community cloud
  3. Private cloud
  4. Hybrid cloud Correct answer.

Explanation

A hybrid cloud combines two or more distinct deployment models, allowing sensitive workloads to remain private while other workloads use public cloud capacity. Pure public or private models would not satisfy both requirements simultaneously.

Question 7Fundamental principles and concepts of cloud computing

Which cloud computing benefit most directly reduces the need for large upfront capital expenditure on hardware?

  1. Location independence
  2. On-demand self-service
  3. Pay-per-use metering Correct answer.
  4. Broad network access

Explanation

Pay-per-use metering converts capital expenditure into operational expenditure because consumers pay only for consumed resources. Self-service and network access improve agility and reach but do not by themselves change the cost structure.

Question 8Fundamental principles and concepts of cloud computing

A company is assessing the risk that a cloud provider may discontinue a service or change its terms, forcing migration. Which cloud-specific risk category does this represent?

  1. Resource contention
  2. Hypervisor escape
  3. Data remanence
  4. Vendor lock-in Correct answer.

Explanation

Vendor lock-in is the risk of dependence on a provider's proprietary services, terms, or APIs, making exit costly or disruptive. Data remanence concerns residual data, hypervisor escape concerns isolation breaches, and contention concerns noisy-neighbour performance.

Question 9Fundamental principles and concepts of cloud computing

Which statement accurately describes the relationship between virtualization and cloud computing?

  1. Virtualization always implies a public cloud deployment
  2. Cloud computing requires dedicated physical servers with no virtualization
  3. Virtualization and cloud computing are the same concept
  4. Cloud computing typically relies on virtualization but adds self-service, pooling, and metering Correct answer.

Explanation

Virtualization is an enabling technology that abstracts physical resources, while cloud computing adds service characteristics such as on-demand self-service, pooling, elasticity, and measured service. Virtualization can exist without any cloud deployment.

Question 10Fundamental principles and concepts of cloud computing

What does multi-tenancy mean in a cloud environment?

  1. A single consumer uses multiple providers simultaneously
  2. Multiple consumers share provider resources while their data and workloads remain logically isolated Correct answer.
  3. Each consumer receives a dedicated physical server
  4. Tenants must share the same operating system account

Explanation

Multi-tenancy means provider resources are shared among many consumers, with logical isolation separating their data and workloads. Dedicated physical servers describe single-tenancy, and sharing an OS account would defeat isolation.

Question 11Fundamental principles and concepts of cloud computing

Which cloud service model gives the consumer the greatest degree of control over the operating system and runtime environment?

  1. Infrastructure as a Service Correct answer.
  2. Software as a Service
  3. Platform as a Service
  4. Database as a Service

Explanation

IaaS provides virtualized compute, storage, and network resources on which the consumer installs and manages the OS, runtime, and applications, giving the most control. PaaS and SaaS abstract those lower layers away from the consumer.

Question 12Fundamental principles and concepts of cloud computing

A consumer uses a public cloud provider's managed object storage and expects the provider to handle replication and hardware failures. Which principle does this illustrate?

  1. Consumer responsibility for physical security
  2. Consumer-managed backup obligation
  3. Joint control of the hypervisor
  4. Provider-managed resilience of the underlying infrastructure Correct answer.

Explanation

Under the shared responsibility model the provider is accountable for the resilience of the infrastructure that delivers the service, such as storage replication and hardware failure handling. The consumer remains responsible for their data, access, and configuration.

Question 13Fundamental principles and concepts of cloud computing

Which term describes the ability of a consumer to provision computing capabilities, such as server time and storage, without requiring human interaction with the provider?

  1. Measured service
  2. On-demand self-service Correct answer.
  3. Rapid elasticity
  4. Broad network access

Explanation

On-demand self-service means the consumer can provision capabilities unilaterally through a portal or API without human interaction with the provider. Elasticity concerns scaling, metering concerns billing, and network access concerns connectivity.

Question 14Fundamental principles and concepts of cloud computing

Which scenario best demonstrates resource pooling with location independence?

  1. The provider publishes the physical address of every storage array to consumers
  2. A consumer knows the exact rack and data center hosting each virtual machine
  3. Each tenant is pinned to a dedicated physical host in a named data center
  4. Virtual machines are drawn from shared capacity and the consumer has no knowledge or control over exact resource location Correct answer.

Explanation

Resource pooling means computing resources are pooled to serve multiple consumers, with different physical and virtual resources dynamically assigned, and the consumer generally has no knowledge or control over the exact location. Knowing or controlling exact location contradicts location independence.

Question 15Fundamental principles and concepts of cloud computing

An organization adopts a SaaS HR system and must decide what remains in its security scope. Which item remains a consumer responsibility?

  1. Patching the SaaS application server
  2. Maintaining the provider's physical data center
  3. Managing user identities, roles, and access within the SaaS application Correct answer.
  4. Operating the provider's database engine

Explanation

In SaaS the provider manages the application, platform, and infrastructure, but the consumer still governs its own users, identities, roles, and data. Server patching, facilities, and the database engine belong to the provider.

Question 16Fundamental principles and concepts of cloud computing

Which pair of NIST essential characteristics most directly supports a consumer running workloads from laptops, tablets, and branch offices over standard networks?

  1. Resource pooling and multi-tenancy
  2. Measured service and rapid elasticity
  3. Rapid elasticity and location independence
  4. Broad network access and on-demand self-service Correct answer.

Explanation

Broad network access makes capabilities available over the network through standard mechanisms and heterogeneous client platforms, while on-demand self-service lets consumers provision without provider interaction. The other pairs address metering, scaling, or pooling rather than client reach and self-provisioning.

Question 17Fundamental principles and concepts of cloud computing

What is a primary security concern created by multi-tenancy in a public cloud?

  1. Physical servers must be shipped to each tenant
  2. The provider must publish tenant data to satisfy transparency
  3. Tenants must disable encryption to share storage
  4. A flaw in isolation controls could allow one tenant to access another tenant's data Correct answer.

Explanation

Because tenants share underlying resources, the correctness of isolation mechanisms such as hypervisors, network segmentation, and access controls is critical; a flaw can lead to cross-tenant data exposure. Transparency does not require publishing data, encryption is not disabled, and servers are not shipped to tenants.

Question 18Fundamental principles and concepts of cloud computing

Which statement correctly distinguishes scalability from elasticity?

  1. Scalability applies only to storage, while elasticity applies only to compute
  2. Both terms mean the same thing and are interchangeable
  3. Scalability is the ability to handle growth in workload, while elasticity is the ability to scale automatically and rapidly in response to changing demand Correct answer.
  4. Elasticity is the ability to handle growth, while scalability is automatic shrinkage

Explanation

Scalability is the capacity of a system to handle a growing amount of work by adding resources, while elasticity emphasizes automatic, rapid matching of resources to current demand, including scale-in. The two are related but not interchangeable.

Question 19Fundamental principles and concepts of cloud computing

Which cloud deployment model is provisioned for open use by the general public and owned by a business, academic, or government organization?

  1. Private cloud
  2. Public cloud Correct answer.
  3. Hybrid cloud
  4. Community cloud

Explanation

A public cloud is provisioned for open use by the general public and may be owned, managed, and operated by a business, academic, or government organization or a combination. Private and community clouds restrict access, and hybrid combines models.

Question 20Fundamental principles and concepts of cloud computing

A regulated firm requires that its cloud provider's controls be independently assessed against a recognized standard. Which artifact should the firm primarily request from the provider?

  1. The provider's source code repository
  2. An independent audit report or certification against a recognized standard Correct answer.
  3. A list of the provider's other customers
  4. The provider's internal marketing brochure

Explanation

Independent audit reports and certifications provide third-party assurance that the provider's controls meet a recognized standard, which the firm can use for due diligence and compliance. Marketing materials, source code, and customer lists do not provide such assurance.

Question 21Fundamental principles and concepts of cloud computing

Which statement best describes the concept of vendor lock-in in cloud computing?

  1. A provider locks a consumer's account until payment is received
  2. A consumer is legally prohibited from using more than one provider
  3. A consumer becomes dependent on provider-specific services or interfaces, making migration costly Correct answer.
  4. A provider prevents any other consumer from using the same hardware

Explanation

Vendor lock-in arises when dependence on proprietary APIs, data formats, or services raises the cost and effort of moving to another provider. The other options describe billing disputes, single-tenancy, and contractual restrictions, none of which define lock-in.

Question 22Fundamental principles and concepts of cloud computing

A consumer deletes data in a cloud storage service and wants assurance the data cannot be recovered by others. Which cloud-specific concern applies?

  1. Denial of service
  2. Hypervisor escape
  3. Account hijacking
  4. Data remanence and secure deletion Correct answer.

Explanation

Data remanence is the risk that residual copies of data remain on shared media after deletion, so secure deletion and cryptographic erasure controls are needed. Hypervisor escape, denial of service, and account hijacking concern isolation, availability, and credential compromise.

Question 23Fundamental principles and concepts of cloud computing

Which statement about the NIST definition of cloud computing is accurate?

  1. It requires the use of public cloud only
  2. It defines cloud computing solely by the use of virtual machines
  3. It describes five essential characteristics, three service models, and four deployment models Correct answer.
  4. It prohibits multi-tenancy for security reasons

Explanation

The widely referenced NIST definition describes five essential characteristics, three service models (SaaS, PaaS, IaaS), and four deployment models (private, community, public, hybrid). It does not mandate public cloud, prohibit multi-tenancy, or reduce cloud to virtual machines.

Question 24Fundamental principles and concepts of cloud computing

A team wants to run event-driven code without provisioning or managing servers, paying only for execution time. Which service model fits best?

  1. Software as a Service
  2. Function as a Service Correct answer.
  3. Infrastructure as a Service
  4. Platform as a Service

Explanation

Function as a Service, a serverless model, executes code in response to events without the consumer provisioning or managing servers, and billing is typically based on execution time and invocations. IaaS and PaaS require managing more of the runtime, and SaaS delivers finished applications.

Question 25Fundamental principles and concepts of cloud computing

Which combination of characteristics most directly enables a consumer to run a workload across regions and survive the loss of a single data center?

  1. On-demand self-service and multi-tenancy
  2. Measured service and broad network access
  3. Pay-per-use billing and vendor lock-in
  4. Resource pooling with location independence and rapid elasticity Correct answer.

Explanation

Resource pooling with location independence lets the provider place and move resources across locations, and rapid elasticity allows capacity to be re-provisioned elsewhere, supporting resilience across regions. Metering, self-service, and billing do not by themselves provide geographic resilience.

Question 26Fundamental principles and concepts of cloud computing

Which cloud characteristic describes a provider's ability to pool and reassign physical resources dynamically so that consumers are unaware of the exact hardware serving their workloads?

  1. Measured service with pay-per-use billing
  2. On-demand self-service provisioning
  3. Rapid elasticity with automatic scale-in
  4. Resource pooling with location independence Correct answer.

Explanation

Resource pooling means the provider serves multiple consumers from a shared pool of configurable resources, assigning and reassigning physical and virtual resources dynamically according to demand. The consumer generally has no knowledge or control over the exact location of the provided resources, which is why location independence is part of this characteristic. The other options describe separate NIST essential characteristics rather than pooling.

Question 27Fundamental principles and concepts of cloud computing

A security architect is mapping a public cloud IaaS workload to the shared responsibility model. Which control area remains primarily the consumer's responsibility even though the provider supplies the underlying compute platform?

  1. Physical security of the data center perimeter
  2. Guest operating system patching and host-based hardening Correct answer.
  3. Disposal of decommissioned provider storage media
  4. Hypervisor and firmware maintenance on the host

Explanation

In IaaS the provider secures the facility, hardware, and virtualization layer, while the consumer remains accountable for everything from the guest operating system upward, including patching, hardening, identity configuration, and data protection. Physical controls and hypervisor maintenance sit with the provider because the consumer has no access to them. Disposal of provider media is likewise a provider control.

Question 28Fundamental principles and concepts of cloud computing

An enterprise is comparing cloud deployment options and wants the NIST-aligned distinction between a private cloud and a community cloud. Which statement captures that distinction correctly?

  1. A private cloud excludes multi-tenancy, whereas a community cloud is functionally identical to a public cloud.
  2. A private cloud is always owned by the consuming organization, whereas a community cloud is always owned by a government body.
  3. A private cloud is provisioned for exclusive use by a single organization, whereas a community cloud is provisioned for use by a specific group of consumers with shared concerns. Correct answer.
  4. A private cloud must be hosted on consumer premises, whereas a community cloud is always hosted by a third-party provider.

Explanation

NIST distinguishes deployment models by the consumer population, not by ownership or physical location. A private cloud is for exclusive use by one organization comprising multiple consumers, and it may be owned, managed, and operated by the organization or a third party, on or off premises. A community cloud serves a specific community of consumers from organizations that share concerns such as mission, security requirements, or compliance.

Question 29Fundamental principles and concepts of cloud computing

A workload runs on a public cloud and must survive the loss of an entire geographic area while keeping recovery objectives measurable. Which design choice aligns with the cloud principle of designing for failure rather than assuming component reliability?

  1. Rely on the provider's service-level agreement as the sole guarantee that individual virtual machines will not fail.
  2. Increase single-instance size and enable periodic snapshots taken once per quarter to cover regional outages.
  3. Consolidate all tiers into one large instance per region to simplify monitoring and reduce the number of failure points to track.
  4. Deploy redundant instances across multiple availability zones and regions, and regularly test failover against defined RTO and RPO targets. Correct answer.

Explanation

Cloud architectures assume that any component, including an availability zone, can fail, so resilience is achieved through redundancy across fault domains and through rehearsed failover. Spreading instances across zones and regions addresses geographic loss, and testing against recovery time and recovery point objectives turns the design into a measurable capability. Provider SLAs describe commitments and credits, not a technical guarantee against instance failure.

Question 30Information security policy for cloud computing and documented information management

In a cloud governance framework, which document sits at the highest level and establishes the organization's overall intent, direction and commitment to protecting information hosted in cloud services?

  1. The cloud service level agreement
  2. The cloud security policy Correct answer.
  3. The cloud asset inventory
  4. The cloud incident response plan

Explanation

The information security policy is the top-level management statement of intent and direction; all standards, procedures and guidelines for cloud services must align with and derive authority from it. Lower-level documents such as SLAs, response plans and inventories are operational instruments that implement the policy rather than establish it.

Question 31Information security policy for cloud computing and documented information management

Which characteristic distinguishes a cloud security standard from a cloud security procedure?

  1. A standard applies only to providers, while a procedure applies only to customers
  2. A standard is optional guidance, while a procedure is mandatory
  3. A standard is mandatory and states what must be done, while a procedure is mandatory and states how it is done step by step Correct answer.
  4. A standard is approved by the board, while a procedure is never formally approved

Explanation

Standards translate policy into mandatory, measurable requirements (for example, minimum encryption strength for data at rest in cloud storage), whereas procedures describe the sequential steps and responsibilities for meeting those requirements. Both are typically mandatory, differing in level of detail rather than in obligation.

Question 32Information security policy for cloud computing and documented information management

An organization is drafting its cloud security policy. Which element is essential to make the policy enforceable and auditable?

  1. A list of every cloud provider currently on the market
  2. Defined roles and responsibilities together with a review and approval cycle Correct answer.
  3. A detailed technical configuration guide for each cloud service
  4. A copy of the provider's internal audit reports

Explanation

A policy becomes enforceable and auditable when it assigns accountability and specifies who approves it, how often it is reviewed and how exceptions are handled. Provider market lists, configuration guides and third-party audit reports are supporting material, not policy content.

Question 33Information security policy for cloud computing and documented information management

What is the primary purpose of a document control procedure in a cloud security management system?

  1. To guarantee that cloud providers retain logs for at least ten years
  2. To define the technical architecture of the cloud landing zone
  3. To ensure documented information is approved, current, available and protected from unauthorized change Correct answer.
  4. To replace the need for management review of cloud services

Explanation

Document control ensures that documented information is reviewed and approved before use, kept current, available where needed and protected against loss or unauthorized modification, including version control and retention rules. It does not set retention periods for provider logs, substitute for management review or define architecture.

Question 34Information security policy for cloud computing and documented information management

Which statement best describes the role of guidelines within a cloud security documentation set?

  1. They record the results of internal audits for a given period
  2. They provide recommended, non-binding advice on how to approach a situation where discretion is allowed Correct answer.
  3. They impose mandatory requirements that must be met without exception
  4. They are contracts that bind the cloud provider to specific penalties

Explanation

Guidelines offer recommended practices and advice; they help staff make consistent choices but do not create mandatory requirements. Mandatory requirements belong in policies and standards, audit results belong in records and penalties belong in contracts.

Question 35Information security policy for cloud computing and documented information management

A cloud security policy states that data classified as confidential must be encrypted at rest. Which document type is the most appropriate place to specify AES-256 as the minimum algorithm?

  1. The business continuity plan
  2. A cloud security standard or technical baseline Correct answer.
  3. The corporate code of conduct
  4. The service level agreement with the provider

Explanation

Specific, measurable technical requirements such as a minimum algorithm are the domain of standards and baselines, which operationalize the policy statement. The code of conduct addresses behavior, the SLA records service commitments and the continuity plan addresses recovery.

Question 36Information security policy for cloud computing and documented information management

Which of the following is a record rather than a policy document within a cloud security management system?

  1. A standard defining password length for cloud consoles
  2. A guideline for selecting cloud regions
  3. A completed access review sign-off for a cloud tenant Correct answer.
  4. A procedure for provisioning cloud accounts

Explanation

Records are evidence that activities were performed and results achieved, such as completed reviews, approvals and logs. Standards, procedures and guidelines are documents that prescribe requirements or methods, so they are not records.

Question 37Information security policy for cloud computing and documented information management

Why should a cloud security policy explicitly address the shared responsibility model?

  1. Because it transfers all liability for data breaches to the provider
  2. Because it clarifies which security controls the customer must document and operate versus those inherited from the provider Correct answer.
  3. Because it allows the customer to skip incident notification obligations
  4. Because it removes the need for the customer to perform risk assessments

Explanation

Cloud accountability is divided between provider and customer, so the policy must make clear which controls the organization owns and must therefore document, monitor and evidence. The model does not shift liability wholesale, eliminate risk assessment or waive notification duties.

Question 38Information security policy for cloud computing and documented information management

An organization wants to allow a business unit to use a cloud service that does not meet its encryption standard, while keeping the deviation visible and time-bound. What is the most appropriate mechanism?

  1. A note in the provider's service description
  2. An undocumented verbal agreement between the business unit and the cloud team
  3. An immediate amendment of the policy to permit the weaker configuration permanently
  4. A formally documented and approved policy exception with an owner, justification and expiry date Correct answer.

Explanation

Exception management keeps deviations controlled: each exception needs documented justification, approval at the right authority, an accountable owner and a defined expiry or review date. Verbal agreements and permanent weakening of the policy remove oversight, and the provider's description is not the organization's decision record.

Question 39Information security policy for cloud computing and documented information management

A cloud security policy has been approved, but staff continue to follow an older version stored on a shared drive. Which document control failure does this represent?

  1. Failure to define a recovery time objective
  2. Failure to perform a business impact analysis
  3. Failure to classify information assets
  4. Failure to control versions and prevent use of superseded documents Correct answer.

Explanation

Document control requires that only current, approved versions are available at points of use and that superseded versions are withdrawn or clearly marked. Stale copies circulating on shared drives indicate a version and distribution control failure, not classification, impact analysis or recovery planning issues.

Question 40Information security policy for cloud computing and documented information management

Which approach best ensures that a cloud security policy remains relevant as services and threats evolve?

  1. Freezing the policy for its entire lifecycle to preserve stability
  2. Scheduling periodic reviews at defined intervals and after significant changes such as new cloud deployments or major incidents Correct answer.
  3. Delegating all policy content to the cloud provider's template
  4. Reviewing the policy only when an auditor requests it

Explanation

Policies must be reviewed at planned intervals and when significant changes occur, such as adopting a new service model, entering a new market or suffering a major incident. Auditor-driven, outsourced or frozen policies lose alignment with the organization's actual risk environment.

Question 41Information security policy for cloud computing and documented information management

A cloud provider's terms state that the provider may change its subcontractors with notice. Which documented information should the customer maintain to manage the resulting risk?

  1. An internal memo stating that subcontractor risk is out of scope
  2. A list of the customer's own office locations
  3. A record of the review and acceptance of subcontractor changes against the customer's security requirements Correct answer.
  4. A copy of the provider's marketing brochure

Explanation

When a provider can change subcontractors, the customer needs evidence that each change was reviewed against its requirements, including data location, security posture and notification obligations. Marketing material, scope exclusions and office lists do not provide that assurance.

Question 42Information security policy for cloud computing and documented information management

What distinguishes documented information that must be retained as evidence from documented information that must be maintained as a living document?

  1. Retained information is always stored in the cloud, while maintained information is always on paper
  2. Retained information provides proof that activities occurred, while maintained information must be kept current and updated Correct answer.
  3. Retained information is written by auditors, while maintained information is written by providers
  4. Retained information is optional, while maintained information is legally required

Explanation

Maintained documented information, such as policies, standards and procedures, must be kept up to date and available for use. Retained documented information, such as logs, approvals and review results, serves as evidence of conformity and must be protected for the required period.

Question 43Information security policy for cloud computing and documented information management

A cloud security policy mandates that all data stores be tagged by classification. Which action best demonstrates that the documented requirement is being followed?

  1. Producing periodic reports showing tagging coverage and remediation of untagged stores Correct answer.
  2. Mentioning tagging in the annual management review minutes
  3. Including tagging in the onboarding presentation for new staff
  4. Publishing the tagging requirement on the intranet

Explanation

Conformity is demonstrated by evidence that the requirement is actually met and monitored, such as coverage metrics and remediation tracking. Publishing, training and discussing the requirement support awareness but do not by themselves prove compliance.

Question 44Information security policy for cloud computing and documented information management

Why should a cloud security policy define the organization's approach to data residency and sovereignty?

  1. Because data residency has no effect on the choice of service model
  2. Because legal and regulatory obligations may restrict where data and metadata can be stored or accessed Correct answer.
  3. Because sovereignty requirements only apply to public sector organizations
  4. Because providers always store data in the customer's home country by default

Explanation

Data residency and sovereignty requirements can determine permissible regions, provider jurisdictions and access paths, including for backups, logs and support staff. Assuming default in-country storage or limiting the issue to public sector bodies can lead to non-compliance.

Question 45Information security policy for cloud computing and documented information management

Which element is most important when defining the scope statement of a cloud security policy?

  1. Identifying the cloud services, service models, business units and locations to which the policy applies Correct answer.
  2. Specifying the brand of hardware used by the provider
  3. Describing the provider's data center cooling systems
  4. Listing the names of all employees who have cloud accounts

Explanation

A clear scope states which cloud services, delivery models, entities and geographic locations are covered, and may state exclusions with justification. Account lists, provider facility engineering and hardware brands are not scope-defining elements of the policy.

Question 46Information security policy for cloud computing and documented information management

An auditor finds that a cloud security procedure was changed without any record of who approved the change or when. Which control was most directly ineffective?

  1. Network segmentation of cloud workloads
  2. Supplier financial monitoring
  3. Capacity management for cloud resources
  4. Change control over documented information Correct answer.

Explanation

Changes to documented information must be reviewed and approved before release, with the nature and date of changes identifiable. The missing approval record points directly to ineffective change control over documentation, not to capacity, segmentation or financial monitoring.

Question 47Information security policy for cloud computing and documented information management

Which set of attributes best supports retrievability of cloud security records during an audit?

  1. Server serial number, rack position and cooling zone
  2. Provider logo, marketing tagline and product name
  3. Unique identifier, date, author, classification and retention period Correct answer.
  4. Employee home address, salary and performance rating

Explanation

Records must be identifiable, legible and retrievable, which requires metadata such as a unique identifier, creation date, author, classification and retention period. Branding, personal data unrelated to the record and physical facility details do not support retrieval.

Question 48Information security policy for cloud computing and documented information management

A cloud security policy requires that all exceptions be reported to top management quarterly. Which practice best evidences compliance with this requirement?

  1. Recording exceptions only in the ticketing system without aggregation
  2. Sending exception details informally in chat messages to individual managers
  3. Relying on staff to remember to mention exceptions during meetings
  4. Maintaining a consolidated exception register with quarterly submission records and management acknowledgement Correct answer.

Explanation

A consolidated register with submission records and acknowledgement provides traceable evidence that exceptions were reported and reviewed at the required level. Informal chats, unaggregated tickets and reliance on memory do not demonstrate the reporting obligation was met.

Question 49Information security policy for cloud computing and documented information management

Which statement correctly describes how legal and regulatory requirements should be reflected in cloud security documentation?

  1. They should be communicated verbally to cloud architects only
  2. They should be identified, recorded in a compliance register and translated into specific documented requirements and controls Correct answer.
  3. They should be delegated entirely to the provider's compliance team
  4. They should be reviewed only after a regulator imposes a penalty

Explanation

Legal and regulatory obligations must be identified and recorded, then mapped to concrete requirements and controls so that conformity can be demonstrated. Verbal communication, full delegation and post-penalty review leave the organization unable to show compliance.

Question 50Information security policy for cloud computing and documented information management

In a cloud security management system, what is the primary reason for maintaining a documented inventory of information assets hosted in cloud services?

  1. To replace the need for access control lists
  2. To increase the provider's storage billing accuracy
  3. To determine which assets require protection, classification and associated documentation controls Correct answer.
  4. To satisfy the provider's marketing reporting needs

Explanation

An asset inventory identifies what information exists in cloud environments and who owns it, enabling classification, risk assessment and the application of appropriate controls and documentation. It is not a billing, access control or marketing instrument.