3.2 Designing for Compliance PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses a cloud provider's AI service to process customer data. The company provides the data and the AI service processes it to generate insights. Under GDPR, what is the role of the cloud provider?

   • AData subject
   • BData protection officer
   • CData controller
   • DData processor
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses a SaaS provider to manage customer relationship data. The company is the data controller and the SaaS provider is the data processor. A customer requests deletion of their personal data. Who is responsible for ensuring the deletion is completed?

   • AThe customer, because they requested the deletion and must confirm it is done.
   • BThe company, because it is the data controller and must instruct the processor to delete the data.
   • CThe SaaS provider, because it holds the data and must comply with deletion requests directly.
   • DBoth are equally responsible and must independently delete the data.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What does the principle of data sovereignty primarily dictate?

   • AData must be encrypted at all times
   • BData must be stored in the cloud provider's home country
   • CData is subject to the laws of the jurisdiction where it is physically stored or processed
   • DData must be owned by the government
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which US regulation imposes requirements on websites and online services that collect personal information from children under 13?

   • AFERPA
   • BHIPAA
   • CCCPA
   • DCOPPA
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare startup stores electronic protected health information (ePHI) in Cloud Storage and BigQuery. They must demonstrate HIPAA compliance to a potential enterprise customer. The customer requires evidence that access to ePHI is logged and that the logs are immutable. What should the startup configure?

   • AUse Cloud DLP to redact ePHI in logs before storing them.
   • BEnable VPC Flow Logs and export them to BigQuery for analysis.
   • CStore all logs in Cloud Logging's default retention without exporting.
   • DEnable Cloud Audit Logs for the project and store logs in a Cloud Storage bucket with object versioning and retention policy.
   Reveal Solution Discussion Select an answer first