ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Under the U.S. and Canadian Cryptographic Module Validation Program (CMVP), cryptographic modules such as HSMs are tested against the Federal Information Processing Standard (FIPS) 140-2. The standard defines four increasing assurance levels; Level 3 adds physical tamper-resistance and identity-based authentication-controls commonly required for government workloads handling sensitive data. Therefore, the correct evidence is the provider's specific FIPS 140-2 Level 3 validation certificate and the associated CMVP report. A Common Criteria Evaluation Assurance Level (EAL) certificate, ISO/IEC 27018 statement, or a SOC 2 Type II report may attest to other security controls or privacy practices, but none of them verifies compliance with the cryptographic requirements of FIPS 140-2.