Cloud Engineer Regulatory Frameworks & Compliance 2

Question 1

Under HIPAA, which cloud storage configuration violates the minimum necessary standard?

Accepted Answer

Allowing all employees to access the full patient database for any reason

Answer

HIPAA's minimum necessary standard requires that access to PHI be limited to only what is needed for a specific job function.

Question 2

A cloud engineer must ensure EU citizen data processed in the US complies with GDPR. Which mechanism is most commonly used for this cross-border transfer?

Accepted Answer

Standard Contractual Clauses (SCCs)

Answer

Standard Contractual Clauses (SCCs) are the primary legal mechanism approved by the EU for transferring personal data to third countries.

Question 3

Which PCI DSS requirement specifically addresses the protection of stored cardholder data?

Accepted Answer

Requirement 3

Answer

PCI DSS Requirement 3 covers protection of stored cardholder data, including encryption and data retention policies.

Question 4

SOC 2 Type II differs from SOC 2 Type I primarily because it:

Accepted Answer

Tests controls over a period of time rather than a single point

Answer

SOC 2 Type II evaluates the operational effectiveness of controls over a review period (typically 6–12 months), while Type I is a point-in-time assessment.

Question 5

An organization subject to FedRAMP must use a cloud service that has achieved which authorization before storing federal data?

Accepted Answer

FedRAMP Authorization to Operate (ATO)

Answer

FedRAMP requires cloud services to obtain an Authorization to Operate (ATO) before federal agencies can use them to process, store, or transmit federal information.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Regulatory Frameworks & Compliance 2