Regulatory and Industry Compliance CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial institution is planning to use a public cloud for its loan application processing. The institution must comply with GLBA and state privacy regulations. The cloud provider offers a shared infrastructure. Which control is the institution required to implement to meet GLBA's Safeguards Rule?

   • AA firewall on every server, even if the cloud provider manages network security
   • BA data backup plan that stores copies in a different cloud region
   • CA written information security program that includes risk assessment and safeguards for customer information
   • DA guarantee from the cloud provider that no data breaches will occur
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A government agency is moving its systems to a cloud environment that is FedRAMP High authorized. The agency must also comply with FISMA. The agency's security team is responsible for maintaining the security of the system. Which of the following is the agency still responsible for, despite the FedRAMP authorization?

   • AConducting the initial FedRAMP assessment of the cloud service
   • BPatching the underlying infrastructure of the cloud service
   • CEnsuring the cloud provider's data centers are physically secure
   • DConfiguring the cloud service to meet the agency's specific security requirements
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which method is commonly used to continuously monitor cloud resources for compliance with regulatory standards?

   • AUser awareness training
   • BAnnual penetration testing
   • CAutomated policy scanning
   • DPeriodic manual audits
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A company is subject to a data sovereignty law that requires certain data to remain within the country's borders. The company uses a cloud provider that offers a region in that country, but the provider's support team has remote access to the infrastructure from another country. The company is concerned that this remote access could violate the data sovereignty requirement. What should the company do?

   • AIgnore the concern because remote access is a standard practice
   • BMove all data to an on-premises data center to avoid the issue
   • CReview the provider's data handling and remote access policies to ensure they comply with the law
   • DAssume that the provider's region in the country automatically satisfies the data sovereignty law
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company must provide evidence to an auditor that its cloud environment continuously meets a regulatory standard. The company wants to automate the collection of compliance evidence and generate reports on demand. Which approach should the company use?

   • ARely on the cloud provider's SOC 2 report as the only evidence
   • BManually collect screenshots of the cloud console each month
   • CUse a cloud-native compliance monitoring tool that continuously checks configurations and generates audit reports
   • DPerform a one-time audit at the end of the year
   Reveal Solution Discussion Select an answer first