Regulatory and Industry Compliance CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A company operating in the European Union must ensure that personal data of EU citizens is stored and processed within the EU. Which concept does this requirement reflect?

   • AData minimization
   • BData sovereignty
   • CData residency
   • DData classification
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A financial institution is considering a cloud service for processing transactions. Which compliance framework is specifically designed for the financial services industry and is commonly referenced in cloud adoption?

   • APCI DSS
   • BGLBA
   • CFedRAMP
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A government agency requires that its data be subject to the laws of its own country, even when stored in a cloud. Which concept is this?

   • AData sovereignty
   • BData encryption
   • CData retention
   • DData residency
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare organization uses a cloud-based electronic health record (EHR) system. The organization must provide evidence of HIPAA compliance to auditors. The compliance team wants to automate the collection of access logs and configuration changes. Which approach best supports continuous compliance monitoring and audit reporting?

   • ADisable logging to reduce storage costs and avoid exposing sensitive data in logs
   • BManually export logs from the cloud console each month and store them in a secure folder
   • CEnable cloud provider's native logging and use a third-party tool to aggregate logs and generate compliance reports
   • DRely on the cloud provider's compliance certifications as evidence of HIPAA compliance
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a cloud provider's software-as-a-service (SaaS) application for customer relationship management. The company is subject to a regulation that requires it to ensure that user access is reviewed periodically. The SaaS provider manages the underlying infrastructure and application. Who is responsible for conducting the user access reviews?

   • AThe company, because it controls user accounts and permissions
   • BThe SaaS provider, because it manages the application
   • CNo one, because SaaS applications are exempt from access review requirements
   • DBoth the company and the provider are equally responsible
   Reveal Solution Discussion Select an answer first