ISC CCSP Practice Test - Questions Answers, Page 51

Wholesalers or distributors are generally not regulated, although the products they sell may be.

Avoidance halts the business process, mitigation entails using controls to reduce risk, acceptance involves taking on the risk, and transference usually involves insurance.

Legal controls are those controls that are designed to comply with laws and regulations whether they be local or international.

A cloud carrier is the intermediary who provides connectivity and transport of cloud services between cloud providers and cloud customers.

The primary purpose of the gap analysis is to begin the benchmarking process against risk and security standards and frameworks.

ISO 31000:2009 specifically focuses on design implementation and management. HIPAA refers to health care regulations, NIST 800-92 is about log management, and ISO 27017 is about cloud specific security controls.

The SOC 1 report focuses primarily on controls associated with financial services. While IT controls are certainly part of most accounting systems today, the focus is on the controls around those financial systems.

Hex GBL is a reference to a computer part in Terry Pratchett's fictional Discworld universe. The rest are not.

The hypervisor level, as a backend cloud infrastructure component, is not a unit where limits may be applied to control resource utilization. Limits can be placed at the service, virtual machine, and cloud customer levels within a cloud environment.