Compliance Standards CV0-004 Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   A cloud administrator is assessing a cloud environment for PCI DSS compliance. Which of the following is the most important first step?

   • AImplement encryption for all data at rest.
   • BConduct a penetration test.
   • CReview the SOC 2 report of the cloud provider.
   • DIdentify all systems that store, process, or transmit cardholder data.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When assessing a cloud environment for SOC 2 compliance, what is the primary focus?

   • AThe financial stability of the organization.
   • BThe controls in place to protect the confidentiality and availability of customer data.
   • CThe physical security of the data center.
   • DThe compliance of the organization with GDPR.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is evaluating a cloud provider that offers a SOC 2 Type II report and an ISO 27001 certificate. The company's compliance team wants to ensure that the provider's controls meet the company's specific requirements for data confidentiality. Which additional step is most appropriate?

   • AReview the SOC 2 report's Trust Services Criteria and the ISO 27001 Statement of Applicability
   • BConduct a vulnerability scan of the provider's network
   • CRequire the provider to sign a business associate agreement (BAA)
   • DRequest a copy of the provider's penetration test results
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a strategy for ongoing monitoring of PCI DSS compliance?

   • APerforming a one-time risk assessment.
   • BConducting quarterly vulnerability scans.
   • CReviewing logs annually.
   • DDisabling security alerts to reduce noise.
   Reveal Solution Discussion Select an answer first