A retail company processes credit card payments and must comply with PCI DSS. The company uses a cloud infrastructure with many virtual servers. The compliance team wants to automate the verification of security configurations across all servers. Which tool or technique is most appropriate?

Manual configuration reviews by the security team each quarter

Cloud provider's default security settings without any customization

A spreadsheet tracking server configurations and compliance status

Infrastructure as code (IaC) templates that enforce secure baseline configurations

A hospital uses a cloud-based patient portal. The hospital is subject to HIPAA and must sign a Business Associate Agreement (BAA) with the cloud provider. The hospital's security team is configuring the portal. Which responsibility remains with the hospital even after signing the BAA?

Maintaining the cloud provider's compliance certifications

Ensuring that the cloud provider's physical data centers are secure

Patching the underlying hypervisor that hosts the portal

Configuring user access controls and authentication for the portal

A global e-commerce company is expanding into a new country that has strict data sovereignty laws, requiring that all personal data of its citizens be stored and processed within the country. The company currently uses a cloud provider that does not have a data center in that country. The company's compliance team is evaluating options. Which approach is most likely to satisfy the data sovereignty requirement?

Use the existing cloud provider and rely on the provider's commitment to comply with local laws

Use a cloud provider that has a data center in the country and configure all data to be stored and processed there

Use the existing cloud provider and encrypt all data before storing it

Use a hybrid approach: store data on-premises in the country and use the cloud for processing only

EC-CouncilCloud Security Essentials

Domain 8Objective 1

Regulatory and Industry Compliance CSE Practice Questions (Page 2)

Part of the Cloud Compliance and Governance domain, which makes up ~13% of our current practice bank.

44questions here

9free pages

7concepts

Questions 6–10

6application · medium
A retail company processes credit card payments and must comply with PCI DSS. The company uses a cloud infrastructure with many virtual servers. The compliance team wants to automate the verification of security configurations across all servers. Which tool or technique is most appropriate?
Select an answer first
7application · medium
A government agency is moving its systems to a cloud environment and must comply with federal security standards. The agency requires continuous monitoring and reporting of security controls. Which compliance framework is most likely to be applicable?
Select an answer first
8application · medium
A hospital uses a cloud-based patient portal. The hospital is subject to HIPAA and must sign a Business Associate Agreement (BAA) with the cloud provider. The hospital's security team is configuring the portal. Which responsibility remains with the hospital even after signing the BAA?
Select an answer first
9expert · hard
A global e-commerce company is expanding into a new country that has strict data sovereignty laws, requiring that all personal data of its citizens be stored and processed within the country. The company currently uses a cloud provider that does not have a data center in that country. The company's compliance team is evaluating options. Which approach is most likely to satisfy the data sovereignty requirement?
Select an answer first
10foundation · easy
Which type of tool is specifically designed to automate the enforcement of compliance policies across cloud resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Regulatory and Industry Compliance CSE Practice Questions (Page 2)

Questions 6–10

A retail company processes credit card payments and must comply with PCI DSS. The company uses a cloud infrastructure with many virtual servers. The compliance team wants to automate the verification of security configurations across all servers. Which tool or technique is most appropriate?

A government agency is moving its systems to a cloud environment and must comply with federal security standards. The agency requires continuous monitoring and reporting of security controls. Which compliance framework is most likely to be applicable?

A hospital uses a cloud-based patient portal. The hospital is subject to HIPAA and must sign a Business Associate Agreement (BAA) with the cloud provider. The hospital's security team is configuring the portal. Which responsibility remains with the hospital even after signing the BAA?

Which type of tool is specifically designed to automate the enforcement of compliance policies across cloud resources?

Keep studying — Cloud Compliance and Governance