Regulatory and Industry Compliance CSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A company is migrating a legacy application to the cloud and must comply with a regulatory framework. The company has implemented several controls, but the compliance team has identified that some controls are partially implemented. The team must decide whether to remediate the gaps or accept the risk. The company has limited budget and the regulatory deadline is approaching. What should the compliance team do first?

   • ARemediate all gaps immediately regardless of cost
   • BDelay the migration until all gaps are fully remediated
   • CAccept all risks without remediation
   • DPrioritize the gaps based on the level of risk and the effort required to remediate
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A U.S.-based healthcare organization is migrating its patient records system to a public cloud. The compliance officer states that the organization must ensure that all protected health information (PHI) is encrypted and that access is logged. The cloud provider offers encryption by default and logging capabilities, but the organization must configure and enable them. Which compliance responsibility does this scenario best illustrate?

   • AThe provider must sign a business associate agreement (BAA) and then all compliance obligations transfer to the provider.
   • BThe provider is solely responsible for ensuring that all PHI is encrypted and logged because it owns the infrastructure.
   • CThe organization must store PHI only in an on-premises data center to satisfy HIPAA encryption and logging requirements.
   • DThe customer is responsible for configuring the encryption and logging features to meet HIPAA requirements.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A cloud customer stores payment card data in a cloud environment. Which regulatory framework directly imposes requirements for protecting cardholder data and applies to any organization that stores, processes, or transmits such data?

   • AGDPR
   • BHIPAA
   • CSOX
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A cloud security team wants to automatically generate audit-ready compliance reports from their cloud environment. Which category of tool would best support this?

   • ANetwork monitoring tools
   • BData backup tools
   • CProject management tools
   • DCompliance automation tools
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company that processes credit card transactions uses a cloud environment. The company must demonstrate PCI DSS compliance to its acquiring bank. The compliance team wants to automate the generation of compliance reports. Which approach is most effective?

   • AAsk the cloud provider to provide a PCI DSS compliance report for the customer's environment
   • BCreate a manual report from spreadsheets and screenshots of the cloud console
   • CUse a cloud-native compliance reporting tool that continuously checks configurations and generates reports on demand
   • DWait until the annual audit and prepare the report at that time
   Reveal Solution Discussion Select an answer first