Question 1

Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include:

Options :

A : Organization chart of the CSP

B : Policies and procedures of the cloud customer

C : Audits, assessments and independent verification of compliance certifications with agreement terms

D : Regulatory guidelines impacting the cloud customer

Answer: C

Question 2

Which of the following is the PRIMARY component to determine the success or failure of an organization’s cloud compliance program?

Options :

A : Defining the metrics and indicators to monitor the implementation of the compliance program

B : Determining the risk treatment options to be used in the compliance program

C : Mapping who possesses the information and data that should drive the compliance goals

D : Selecting the external frameworks that will be used as reference

Answer: C

Question 3

Which of the following is a cloud-native solution designed to counter threats that do not exist within the enterprise?

Options :

A : Policy based access control

B : Attribute based access control

C : Rule based access control

D : Role based access control

Answer: A

Question 4

"Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls." Which of the following types of controls BEST matches this control description?

Options :

A : Network Security

B : Change Detection

C : Virtual Instance and OS Hardening

D : Network Vulnerability Management

Answer: A

Question 5

What should be an organization’s control audit schedule of a cloud service provider’s business continuity plan and operational resilience policy?

Options :

A : Annual

B : Quarterly

C : Monthly

D : Semi-annual

Answer: A