Regulatory and Industry Compliance CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A global company is deploying a new HR system in the cloud. The company has employees in multiple countries, including countries with strict data sovereignty laws. The compliance team must ensure that employee data is stored only in approved countries. Which action is most important to achieve this?

   • ARelying on the cloud provider's global network to automatically route data to the nearest data center
   • BEncrypting all employee data with strong encryption algorithms
   • CSelecting cloud regions that are located in the approved countries and configuring data residency policies
   • DUsing a single cloud region for all employees to simplify management
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A multinational healthcare provider is migrating its patient records system to a public cloud. The organization operates in the EU and the US. The compliance team must ensure that personal health data of EU residents is stored and processed only within the EU, while US patient data can reside in the US. Which approach best satisfies the data residency requirement?

   • AStore all data in the US region and rely on the cloud provider's encryption to protect EU data.
   • BDeploy the application in a single cloud region in the EU and use that region for all data, regardless of patient origin.
   • CUse separate cloud regions for EU and US data, with the application configured to route each patient's data to the region that matches their residency.
   • DStore all data in the EU region but allow US support staff to access the data remotely for troubleshooting.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A company uses a cloud platform to store customer data. Under the shared responsibility model, which compliance obligation is most likely the responsibility of the cloud customer?

   • AEnsuring the physical security of the data center
   • BMaintaining the network infrastructure of the cloud region
   • CPatching the hypervisor that hosts virtual machines
   • DImplementing encryption for data at rest in the customer's storage accounts
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A healthcare organization uses a cloud-based system to store and process PHI. The organization is subject to HIPAA and must provide evidence of compliance to auditors. The organization has implemented logging and monitoring, but the audit team wants to see a report that shows who accessed PHI and when. The organization's cloud provider offers a native logging service. What is the best way to generate this report?

   • ADisable logging to reduce the risk of exposing PHI in logs
   • BAsk the cloud provider to generate the report on the organization's behalf
   • CUse the cloud provider's native logging service to collect access logs and then use a third-party reporting tool to generate the report
   • DManually review the logs each month and create a summary report
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is migrating to the cloud and must comply with a regulatory standard. The company has implemented several security controls, but the compliance team is unsure whether all requirements are met. They need to identify which specific requirements are not yet satisfied. What should the compliance team do?

   • AReview the cloud provider's marketing materials
   • BAsk the cloud provider to guarantee compliance
   • CWait for the annual external audit
   • DMap each regulatory requirement to the current controls and identify gaps
   Reveal Solution Discussion Select an answer first