DOMAIN 4 -COMPLIANCE IMPACT ON CLOUD CONTRACTS, COMPLIANCE SCOPE

Question 1

_______ validates awareness of and adherence to corporate obligations (e.g., corporate social responsibility, ethics, applicable laws, regulations, contracts, strategies and policies).

Answer 1

Compliance

Question 2

_______ are a key tool for proving (or disproving) compliance

Answer 2

Audits

Question 3

________ is a tool of governance; it is how an organization assesses, remediates, and proves it is meeting these internal and external obligations.

Answer 3

Compliance management

Question 4

_________, in particular, typically have strong implications for information technology and its
governance, especially in terms of monitoring, management, protection, and disclosure

Answer 4

Regulations

Question 5

________ are thus an important tool to assure compliance, and evaluation and testing of these controls is a core activity for security professionals

Answer 5

Security controls

Question 6

As with security, compliance in the cloud is a ______ model.

Answer 6

shared responsibility

Question 7

the customer is always ultimately responsible for their own ________.

Answer 7

compliance

Question 8

Cloud customers, particularly in ________, must rely more on third-party attestations of the provider to understand their compliance alignment and gaps.

Answer 8

public cloud

Question 9

Many cloud providers are certified for various regulations and industry requirements, such as PCI
DSS, SOC1, SOC2, HIPAA, best practices/frameworks like CSA CCM, and global/regional regulations like the EU GDPR. These are sometimes referred to as _______audits.

Answer 9

pass-through

Question 10

A pass-through audit is a form of ______

Answer 10

compliance inheritance

Question 11

compliance inheritance. In this model all or some of the cloud provider’s ________ undergo an audit to a compliance standard. The provider takes responsibility for the costs and maintenance of these certifications.

Answer 11

infrastructure and services

Question 12

It is still the responsibility of the customer to build _____ applications and services on the cloud

Answer 12

compliant

Question 13

This means the provider’s infrastructure/services are not within scope of a customer’s ________. But everything the customer builds themselves is still within scope.

Answer 13

audit/ assessment

Question 14

Not all features and services within a given cloud provider are necessarily compliant and ______ with respect to all regulations and standards.

Answer 14

certified/audited