4.5 - Cloud compliance and frameworks
Cloud+ CV0-004 objective 4.5 covers compliance controls and frameworks in the cloud. A CASB (cloud access security broker) sits between users and cloud apps to enforce security policy and give visibility over shadow IT and data movement. PCI DSS is the standard that specifically governs the protection of cardholder payment data, required for any merchant handling cards. CIS Benchmarks are a widely used framework of secure configuration baselines for hardening cloud systems and services. SOC 2 is a report that attests a service provider's controls meet trust criteria - such as security and availability - over a period, giving customers assurance. You should also know GDPR, HIPAA, ISO 27001 and audits. Expect scenario questions that describe brokering cloud access, protecting card data, applying hardening baselines, or attesting provider controls, and ask which framework or standard - CASB, PCI DSS, CIS or SOC 2 - applies.
Broker between users and cloud apps, enforce policy = CASB. Card payment data = PCI DSS. Secure config baselines to harden = CIS Benchmarks. Report attesting provider controls over time = SOC 2.
Practice questions
1. Which control sits between users and cloud apps to enforce security policy and visibility?
- CASB (correct answer)
- WAF
- IDS
- VPN
A CASB (Cloud Access Security Broker) mediates access to cloud services, enforcing DLP, access and compliance policies. A WAF protects web apps from injection/XSS.
2. Which regulation specifically governs the protection of cardholder payment data?
- HIPAA rules
- PCI DSS (correct answer)
- GDPR privacy
- SOC 2 report
PCI DSS sets security requirements for handling payment card data. HIPAA covers health information; GDPR covers EU personal data; SOC 2 reports on service controls.
3. Which framework of secure configuration baselines is widely used to harden cloud systems?
- CIS Benchmarks (correct answer)
- OSI model
- TCP handshake
- RAID levels
CIS Benchmarks are consensus secure-configuration baselines used to harden operating systems, containers and cloud services. The OSI model and RAID are unrelated concepts.
4. Which report attests that a service provider's controls meet trust criteria over a period?
- PCI DSS
- SOC 2 (correct answer)
- GDPR
- ISO 9001
A SOC 2 report attests to a service provider's controls around security, availability and confidentiality over time. PCI DSS covers card data; GDPR is an EU privacy law, not an attestation.
5. An EU healthcare provider must protect personal data of residents. Which law chiefly applies?
- PCI DSS
- GDPR (correct answer)
- SOC 2
- FedRAMP
GDPR governs the protection and privacy of EU residents' personal data, including health data, with strict consent and breach rules. PCI DSS covers cards; SOC 2 is a controls attestation.
6. A law requiring citizens' data to be stored within national borders is an example of:
- Key rotation
- Load shedding
- Data sovereignty (correct answer)
- Rate limiting
Data sovereignty and residency rules require data to physically reside in and be governed by a specific jurisdiction, driving region choice. Key rotation and rate limiting are unrelated controls.