Regulatory and Industry Compliance CSE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A company that processes both healthcare data and credit card payments is moving to the cloud. The compliance team needs to ensure that the cloud environment meets the requirements of both HIPAA and PCI DSS. What is the most important consideration?

   • AThe cloud environment must be configured to meet the requirements of both standards simultaneously
   • BThe company should use separate cloud environments for each type of data
   • CThe cloud provider is responsible for ensuring compliance with both standards
   • DThe company should choose one standard to follow and ignore the other
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A software company that develops a SaaS product for schools must comply with COPPA and FERPA. The company is migrating its application to a cloud provider. The compliance team has mapped the application's data flows and identified that student records are stored in a database that is also used for non-student data. What is the most significant compliance gap?

   • ALack of data segregation between student and non-student data
   • BInsufficient encryption of data in transit
   • CThe cloud provider is not located in the same country as the school
   • DNo multi-factor authentication for administrators
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A financial services company is evaluating a cloud provider for a new application that will process credit card transactions. The compliance team requires that the provider's environment supports the company's obligation to maintain a network that is protected by a firewall and to restrict access to cardholder data. Which industry-specific compliance standard is most directly relevant to these requirements?

   • ASOC 2
   • BHIPAA
   • CGDPR
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A cloud-based software company provides a platform for managing clinical trials. The company must comply with GCP (Good Clinical Practice) and HIPAA. The company's compliance team wants to automate the monitoring of access to clinical trial data. The team has implemented logging, but the logs are stored in the same cloud account as the clinical data. Which of the following is the most important additional control to implement?

   • AStore logs in a separate, immutable storage location that is access-controlled
   • BRetain logs for at least one year
   • CAllow all researchers to access the logs for transparency
   • DEncrypt the logs with the same encryption key as the clinical data
   Reveal Solution Discussion Select an answer first