Risk Management and Compliance GCLD Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational company is moving its data analytics platform to a cloud provider. The platform processes personal data of EU residents and is subject to GDPR. The company also has a requirement to keep data within the EU for data residency. They are considering using a SaaS analytics service. Which factor is most critical for the company to evaluate?

   • AThe provider's ability to restrict data processing to a specific EU region
   • BThe provider's uptime SLA
   • CThe provider's compliance with PCI DSS
   • DThe provider's use of encryption for data in transit
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which compliance framework is most relevant for a cloud service that processes credit card transactions?

   • ASOC 2
   • BGDPR
   • CPCI DSS
   • DHIPAA
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a cloud environment with multiple workloads. They have limited security staff and need to prioritize risk mitigation efforts. They have identified three risks: a critical vulnerability in a public-facing web server, a misconfigured storage bucket with sensitive data, and a lack of MFA for administrative accounts. Which risk should be addressed first?

   • AThe lack of MFA for administrative accounts
   • BThe misconfigured storage bucket
   • CThe critical vulnerability in the public-facing web server
   • DAll three risks should be addressed simultaneously
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A global e-commerce company processes credit card payments and stores cardholder data in a cloud environment. They are required to comply with PCI DSS. Which cloud service model would most likely reduce the scope of PCI DSS compliance for the customer?

   • AOn-premises, because the customer has full control over all systems
   • BSaaS, because the provider manages all security and compliance
   • CIaaS, because the customer controls the entire stack and can implement all controls
   • DPaaS, because the provider manages the platform and some security controls
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational company must store personal data of EU citizens in a cloud environment. The data protection officer requires that the data not leave the EU. Which cloud deployment consideration best meets this requirement?

   • ASelecting a cloud provider with a data center located in the EU
   • BUsing a private cloud deployment model
   • CEncrypting the data at rest and in transit
   • DObtaining the provider's ISO 27001 certification
   Reveal Solution Discussion Select an answer first