Regulatory and Industry Compliance CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   For a regulatory audit, a cloud customer needs to provide evidence that access controls are working as required. What type of report is commonly generated from cloud provider logs and monitoring data to support this?

   • ANetwork diagram
   • BFinancial statement
   • CCompliance report
   • DMarketing report
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A healthcare organization plans to migrate patient records to a public cloud. Which industry-specific compliance standard is most directly applicable to the handling of protected health information (PHI) in the United States?

   • AGDPR
   • BHIPAA
   • CSOX
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company needs to demonstrate to an auditor that its cloud environment has been continuously compliant with a security standard over the past year. The company has enabled logging and monitoring. What should the company do to prepare for the audit?

   • AGenerate compliance reports from the monitoring system that show the compliance status over time
   • BVerbally assure the auditor that the environment is compliant
   • CProvide the auditor with the cloud provider's general security whitepaper
   • DDelete old logs to reduce storage costs
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is using a cloud provider's infrastructure-as-a-service (IaaS) offering. The company is subject to a regulatory framework that requires it to implement access controls and monitor user activity. The cloud provider is responsible for the security of the physical data center and the underlying hardware. Which compliance responsibility belongs to the company?

   • ASecuring the physical servers in the data center
   • BEnsuring the network infrastructure is protected from DDoS attacks
   • CPatching the hypervisor that runs the virtual machines
   • DConfiguring identity and access management (IAM) policies for its users
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services company is moving its customer transaction database to a cloud provider. The company must comply with PCI DSS. The cloud provider offers a managed database service. According to the shared responsibility model, which compliance obligation remains with the company?

   • AConfiguring network firewalls and access controls around the database
   • BEnsuring the physical security of the data center where the database is hosted
   • CPatching the underlying operating system of the database servers
   • DApplying security patches to the database engine software
   Reveal Solution Discussion Select an answer first