SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
CCSP · Domain 6

Legal, Risk and Compliance practice questions

Legal, Risk and Compliance is worth 13% of the CCSP exam — the lightest of the 6 domains. Legal requirements and cloud-specific risks, privacy, audit in the cloud, enterprise risk management, and outsourcing and contract design. Official weighting 13%. 6 fully worked examples are further down this page, answers included.

Exam weight
13%
the lightest of the 6 domains
Questions
200
across 5 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 6 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Legal, Risk and Compliance questions, fully explained

Questions from the CCSP bank mapped to domain 6, with the answer key and the reasoning behind every option. None of them repeat the examples on the main CCSP practice page.

Question 1Legal, Risk and Compliance

Ravi will be the first responder when a cloud-hosted system is suspected of compromise. He wants guidance on recognising potential digital evidence and gathering and protecting it so it stays admissible, before any examination of it begins. Which standard addresses this?

Choose one.

  • a
    ISO/IEC 27042

    ISO/IEC 27042 covers the later stage: analysing and interpreting digital evidence that has already been acquired.

  • b
    ISO/IEC 27037 Correct

    ISO/IEC 27037 gives guidelines for the identification, collection, acquisition and preservation of digital evidence, including the role of the digital evidence first responder.

  • c
    ISO/IEC 27041

    ISO/IEC 27041 is about assuring that investigative methods are suitable and adequate, not about handling the evidence itself on scene.

  • d
    ISO/IEC 27050

    ISO/IEC 27050 addresses electronic discovery in litigation, a broader legal process than first response to a compromise.

The concept

ISO/IEC 27037 covers the first-response handling of digital evidence: identification, collection, acquisition and preservation.

Why that’s the answer

Ravi's tasks all happen before examination: spotting what might be evidence, gathering it and keeping it intact. Those are the four activities ISO/IEC 27037 is written for, and the standard names the digital evidence first responder (DEFR) as the person who performs them. Analysis (27042) and method assurance (27041) come into play later or alongside, and 27050 is the eDiscovery series.

How to reason it out
  1. Place the activity in the investigation timeline: before examination.
  2. Match identify, collect, acquire and preserve to ISO/IEC 27037.
  3. Reject the standards for later analysis, method assurance or litigation discovery.

Exam tip: First response to digital evidence (identify, collect, acquire, preserve) = ISO/IEC 27037.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

Question 2Legal, Risk and Compliance

A forensics team plans to use a newly written script to extract artefacts from virtual machine snapshots. Counsel asks for documented evidence that the method has been tested and produces reliable results before it is relied on in a case. Which standard gives guidance for providing that assurance?

Choose one.

  • a
    ISO/IEC 27042

    ISO/IEC 27042 guides analysing and interpreting evidence; it assumes the methods used are already fit for purpose.

  • b
    ISO/IEC 27037

    ISO/IEC 27037 covers identifying, collecting, acquiring and preserving evidence, not validating a new extraction method.

  • c
    ISO/IEC 27043

    ISO/IEC 27043 sets out the overall investigation principles and processes; the detailed guidance on method assurance sits in 27041.

  • d
    ISO/IEC 27041 Correct

    ISO/IEC 27041 gives guidance on assuring the suitability and adequacy of incident investigative methods, including validating tools and processes before use.

The concept

ISO/IEC 27041 deals with assurance that investigative methods are suitable and adequate.

Why that’s the answer

Counsel is not asking how to collect or analyse evidence but whether the method itself can be trusted. That is method validation, the subject of ISO/IEC 27041. A court may challenge results produced by an untested tool, so the team documents the method's requirements, tests it and records that it meets them. 27042 (analysis), 27037 (evidence handling) and 27043 (overall process) each refer to that assurance rather than define it.

How to reason it out
  1. Identify what is being questioned: the method, not the evidence.
  2. Recall that validating investigative methods is ISO/IEC 27041.
  3. Distinguish it from the analysis, handling and overall-process standards.

Exam tip: Can the tool or method be trusted? ISO/IEC 27041.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

Question 3Legal, Risk and Compliance

Disk images and log exports from a cloud tenant have been acquired and preserved. Investigators must now examine them, interpret what they show and reach conclusions that another competent examiner could reproduce from the same material. Which standard guides this stage?

Choose one.

  • a
    ISO/IEC 27042 Correct

    ISO/IEC 27042 gives guidelines for the analysis and interpretation of digital evidence, including the competence of examiners and the need for repeatable, reproducible conclusions.

  • b
    ISO/IEC 27037

    ISO/IEC 27037 ends with preservation; the stage described here begins after it.

  • c
    ISO/IEC 27041

    ISO/IEC 27041 assures that methods are suitable; it does not guide the examination and interpretation itself.

  • d
    ISO/IEC 27050

    ISO/IEC 27050 concerns electronic discovery for legal proceedings, not the forensic analysis of acquired images.

The concept

ISO/IEC 27042 covers the analysis and interpretation of digital evidence.

Why that’s the answer

The evidence is already acquired and preserved, so the work left is examination and interpretation. ISO/IEC 27042 addresses exactly that: how analysis is conducted, how conclusions are drawn and reported, and how another competent examiner should be able to reach the same results. 27037 has already done its job at this point, 27041 concerns the trustworthiness of methods, and 27050 is the eDiscovery series.

How to reason it out
  1. Note that acquisition and preservation are complete.
  2. Map examination and interpretation to ISO/IEC 27042.
  3. Rule out the earlier-stage and method-assurance standards.

Exam tip: After preservation comes analysis and interpretation: ISO/IEC 27042.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

Question 4Legal, Risk and Compliance

A security manager wants one overarching model for incident investigations, from readiness work before any incident, through initial response and evidence work, to closing the investigation. The more detailed evidence-handling and analysis guidance should fit inside it. Which standard provides that model?

Choose one.

  • a
    ISO/IEC 27035

    ISO/IEC 27035 covers information security incident management (detect, report, assess, respond, learn); it does not set out the investigation process into which the forensic standards fit.

  • b
    ISO/IEC 27043 Correct

    ISO/IEC 27043 gives incident investigation principles and processes, an overarching model spanning readiness, initialisation, acquisition and investigation that the other forensic standards slot into.

  • c
    ISO/IEC 27037

    ISO/IEC 27037 is one of the detailed pieces inside the model: identifying, collecting, acquiring and preserving evidence.

  • d
    ISO/IEC 27042

    ISO/IEC 27042 is another detailed piece inside the model: analysing and interpreting evidence.

The concept

ISO/IEC 27043 is the umbrella standard for incident investigation principles and processes.

Why that’s the answer

The manager wants the frame, not one of its parts. ISO/IEC 27043 describes investigation process classes from readiness through to the investigative processes and their conclusion, and the more specific standards (27037 for evidence handling, 27042 for analysis, 27041 for method assurance) fit within it. ISO/IEC 27035 is the tempting near-twin: it manages security incidents operationally, but it is not the investigation model.

How to reason it out
  1. Notice the request is for an overarching process model.
  2. Recall that 27043 is the umbrella for 27037, 27041 and 27042.
  3. Separate investigation (27043) from incident management (27035).

Exam tip: Umbrella investigation process = ISO/IEC 27043; incident management = ISO/IEC 27035.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

Question 5Legal, Risk and Compliance

Under the US CLOUD Act, which data must a US-based cloud provider disclose when it is served with a valid US warrant?

Choose one.

  • a
    Data in its US data centres; copies held abroad go through treaty channels

    This was the provider argument in the Microsoft Ireland case; the CLOUD Act settled it the other way by making storage location irrelevant.

  • b
    Data belonging to US citizens, in whichever country the data is stored

    The Act turns on what the provider possesses, holds or controls, not on the nationality of the customer.

  • c
    Data the customer has not encrypted with keys held outside the provider

    Encryption does not exempt data from the Act; the provider discloses what it holds, which for customer-encrypted data is ciphertext.

  • d
    Data in its possession, custody or control, wherever the data is stored Correct

    The Act requires disclosure of data within the provider's possession, custody or control regardless of whether it is located inside or outside the United States.

The concept

The CLOUD Act (2018) makes US providers disclose data they control, wherever it is stored.

Why that’s the answer

Before the Act, the Microsoft Ireland dispute asked whether a US warrant could reach email stored in Ireland. Congress answered with the CLOUD Act: a provider must disclose data in its possession, custody or control regardless of where the data sits. So the location of a data centre does not decide the question; the provider's control does. Customer-held encryption keys change what the provider can produce, not whether the obligation applies.

How to reason it out
  1. Identify the test the Act uses: possession, custody or control.
  2. Note that storage location and customer nationality are not the test.
  3. Remember encryption affects what is produced, not the duty itself.

Exam tip: CLOUD Act: if a US provider controls the data, location does not shield it.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

Question 6Legal, Risk and Compliance

A German retailer chose a US-headquartered provider's Frankfurt region, believing that keeping its data in the EU places it beyond the reach of US authorities. Asked to review this, which assessment should the cloud security professional give?

Choose one.

  • a
    US warrants can reach it once an EU court approves the transfer request

    The CLOUD Act does not make US warrants depend on an EU court's approval; that confuses it with the treaty route.

  • b
    US warrants can still reach it through the provider's control of the data Correct

    Under the CLOUD Act, a US provider must disclose data it controls regardless of where it is stored, so EU residency does not remove US reach.

  • c
    US warrants lose effect while the data stays in the provider's EU regions

    This is the belief being reviewed; the CLOUD Act made storage location irrelevant for US providers.

  • d
    US warrants can reach it if the retailer itself has a subsidiary in the US

    The retailer's own corporate footprint is not what gives US authorities reach here; the provider's control of the data is.

The concept

Data residency is not data sovereignty: a US provider's control of data brings it within US legal reach.

Why that’s the answer

The retailer confused where data is stored with whose law can compel it. Because the provider is US-based, the CLOUD Act lets US authorities require it to disclose data it controls in any region. The provider may then face conflicting obligations (for example under GDPR Article 48), which is exactly the legal risk the retailer should evaluate, along with technical measures such as holding encryption keys outside the provider.

How to reason it out
  1. Separate the storage location from the provider's nationality.
  2. Apply the CLOUD Act test of possession, custody or control.
  3. Conclude that residency alone does not remove US reach.

Exam tip: Choosing a region decides where data sits, not which governments can compel the provider.

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics — the lesson that teaches this.

What CCSP domain 6 tests, topic by topic

The official exam guide breaks Legal, Risk and Compliance into 5 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published CCSP practice questions per topic in Legal, Risk and Compliance
TopicWhat it coversQuestions
Articulate legal requirements and unique risks within the cloud environmentOfficial CCSP sub-domain 6.1 (Aug-2026 outline): Conflicting international legislation; Evaluation of legal risks specific to cloud computing; Legal framework and guidelines; eDiscovery (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance); Forensics requirements (e.g., Cloud Security Alliance (CSA), International Organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27037:2012/27041:2015/ 27042:2015/27043:2015).40
Understand privacy issuesOfficial CCSP sub-domain 6.2 (Aug-2026 outline): Difference between contractual and regulated private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII)); Country-specific legislation related to private data; Jurisdictional differences in data privacy; Standard privacy requirements (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27018, Generally Accepted Privacy Principles (GAPP), General Data Protection Regulation (GDPR)); Privacy Impact Assessments (PIA).40
Understand audit process, methodologies, and required adaptations for a cloud environmentOfficial CCSP sub-domain 6.3 (Aug-2026 outline): Internal and external audit controls; Impact of audit requirements; Identify assurance challenges of virtualization and cloud; Types of audit reports; Restrictions of audit scope statements; Gap analysis; Audit planning; Internal Information Security Management System (ISMS); Internal information security controls system; Policies; Identification and involvement of relevant stakeholders; Specialized compliance requirements for highly-regulated industries; Impact of distributed Information Technology (IT) model.40
Understand implications of cloud to enterprise risk managementOfficial CCSP sub-domain 6.4 (Aug-2026 outline): Assess providers risk management programs (e.g., controls, methodologies, policies, risk profile, risk appetite); Difference between data roles (e.g., owner, controller, custodian, processor, stewards); Regulatory transparency requirements (e.g., breach notification, Sarbanes-Oxley (SOX), General Data Protection Regulation (GDPR)); Risk treatment (i.e., avoid, mitigate, transfer, share, accept); Different risk frameworks; Metrics for risk management; Assessment of risk environment (e.g., service, vendor, infrastructure, business).40
Understand outsourcing and cloud contract designOfficial CCSP sub-domain 6.5 (Aug-2026 outline): Business requirements (e.g., Service-Level Agreement (SLA), Master Service Agreement (MSA), Statement Of Work (SOW)); Vendor management (e.g., vendor assessments, vendor lock-in risks, vendor viability, escrow); Contract management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance, data ownership, security requirements); Supply-chain management (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27036).40
Total200

Revise Legal, Risk and Compliance before you drill it

CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and ForensicsExpect scenario questions in which a cloud security professional advises legal, risk or compliance colleagues: deciding whether a region choice, key arrangement or contract clause actually treats a stated legal risk, what to do first when two countries' laws conflict, who carries eDiscovery duties and when they start, and how to collect cloud evidence defensibly in each service model. Shorter recall items ask you to match a task or stage to the right standard (ISO/IEC 27037, 27041, 27042, 27043, 27035 or a part of 27050), a scenario to a body of law or standard of proof, or a purpose to an international instrument such as the Budapest Convention, the Wassenaar Arrangement or the Hague Evidence Convention. Wrong options are usually real controls or real standards that fail on the stated constraint, so read for the party, the stage and the risk named.CCSP Privacy Issues: GDPR, HIPAA, PIPEDA, ISO/IEC 27018, GAPP and PIAsExpect short recall items on exact terms (which GAPP principle, which DPDP Act role, which GDPR article or principle) where the distractors are neighbouring terms, and scenario items set in a cloud migration where several answers are lawful or sensible and the stated constraint decides: the data's holder, the people's location, the purpose, the timing in the project, or the need for a single mechanism. Many scenarios test the misconception that moving data to a region or encrypting it changes which law applies or who is accountable. Sequencing items reward assessing privacy impact before acting on notices, certificates or tests.CCSP Cloud Audit: SOC 1, 2 and 3 Reports, SSAE, ISAE, Gap Analysis and Audit PlanningExpect short recall items that turn on exact report and standard names (which SOC report, which type, which SSAE section or ISAE standard, which ISMS document, which policy layer) with neighbouring terms as distractors, and scenario items in which several actions are reasonable and one stated constraint decides: who needs the assurance, which criteria and period a report covers, whether a subservice provider was carved out, which layer the customer runs, who is independent of whom, or what the local law allows. Sequencing items reward the step that comes first in the process, such as defining objectives before scope or confirming what is permitted before collecting evidence, and many scenarios test the misconception that a provider's report or certificate covers more than its scope.CCSP Enterprise Risk Management in the Cloud: Data Roles, Risk Treatment and FrameworksExpect short recall items on exact terms, where the distractors are neighbouring terms: which data role, which element of a provider's risk program, which framework, which kind of metric, appetite versus tolerance. Scenario items, often a named person advising on a migration, offer several workable actions and let the stated constraint decide: who is accountable as opposed to who operates or pays, which party notifies whom and when the clock starts, whether the activity is optional, whether residual risk is still above appetite, cost, and which part of an assessment is missing or must be redone. Many test the misconception that a contract, an insurance policy, an attestation or the provider's own appetite moves the customer's accountability.CCSP Outsourcing and Cloud Contract Design: SLA, MSA, SOW, Escrow and ISO/IEC 27036Expect recall items on contract vocabulary (which document holds which terms, lock-in versus lock-out, what escrow verification proves, what an indemnity does, which part of ISO/IEC 27036 covers cloud) and scenario items set in contract negotiation or vendor management, where several options are genuine contract terms and the details of the scenario decide which fits best: the business outcome at stake, the customer's own capabilities, a regulator's demand, the provider's multitenant model, where the process has reached, or how a key term is defined.

Other CCSP domains

Domain 1: Cloud Concepts, Architecture and Design17% of the exam · 269 questionsDomain 2: Cloud Data Security20% of the exam · 306 questionsDomain 3: Cloud Platform & Infrastructure Security17% of the exam · 252 questionsDomain 4: Cloud Application Security16% of the exam · 245 questionsDomain 5: Cloud Security Operations17% of the exam · 258 questionsAll CCSP practice questionsMixed sessions across all 6 domains — the way the real exam interleaves them.

Legal, Risk and Compliance: your questions

Legal, Risk and Compliance is domain 6 of the CCSP exam guide and carries 13% of the scored content — the lightest of the 6 domains. On a 150-question paper that works out to roughly 20 questions, though ISC2 does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official CCSP exam guide.