Risk Management and Compliance GCLD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is using a cloud provider's IaaS offering to host a custom application. They are subject to GDPR and need to ensure that personal data is processed securely. Which responsibility is the customer's in this IaaS model?

   • AConfiguring the virtual machine's operating system and firewall
   • BPatching the hypervisor
   • CManaging the underlying storage hardware
   • DEnsuring physical access controls at the data center
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare startup is moving a patient-facing web application to a cloud provider. The application stores protected health information (PHI) in a managed database service. The compliance team requires that the organization maintain full control over who can access the PHI and that all access be logged. Which responsibility must the startup retain to meet this requirement?

   • APatching the operating system of the database server
   • BManaging the physical security of the data center where the database runs
   • CEnsuring the database is replicated across multiple availability zones
   • DConfiguring identity and access management policies for the database service
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has identified that its cloud environment has a high risk of unauthorized access due to weak password policies. They want to implement a control that reduces this risk. Which control is most effective?

   • ARequiring multi-factor authentication (MFA) for all users
   • BProviding security awareness training
   • CIncreasing the frequency of password changes
   • DImplementing a longer password history requirement
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial institution is evaluating a cloud provider for hosting customer data. They require evidence that the provider's controls are independently validated. Which document should they request from the provider?

   • AThe provider's internal security policy
   • BA marketing white paper on cloud security
   • CA SOC 2 Type II report
   • DA list of the provider's certifications
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company must demonstrate to an auditor that its cloud provider has independent validation of its security controls. Which document should the company request from the provider?

   • ASOC 2 Type II report
   • BA list of the provider's customers
   • CThe provider's marketing materials
   • DThe provider's internal security policy
   Reveal Solution Discussion Select an answer first