CRISC Question 403

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  If a cloud services vendor refuses to accept liability for a sensitive data breach, the best control is to ensure that they cannot access the data in the first place.

• Chose C1

  C. Using field-level encryption with a vendor-supplied key. The best option to reduce the risk associated with a sensitive data breach in this scenario is to use "C. Using field-level encryption with a vendor-supplied key." Field-level encryption involves encrypting specific fields of sensitive data before they are stored or transmitted, and the encryption key is typically managed by the vendor. This approach ensures that even if the vendor experiences a data breach, the sensitive data remains encrypted and unreadable without the proper decryption key. This can significantly reduce the impact of a data breach and protect the confidentiality of the sensitive information. Options A (engaging a third party to validate operational controls), B (using the same cloud vendor as a competitor), and D (ensuring the vendor does not know the encryption key) are also important considerations for risk management, but they may not provide the same level of protection against a data breach as field-level encryption with proper key management.

• Chose A1

  I think its A because the vendor is relying on the contract which in this case does not include data encryption. so A is the best remaining option. no respect for ISACA.