Cloud Engineer Regulatory Frameworks & Compliance 3

Question 1

A cloud engineer is designing a system for a bank. Which compliance framework specifically addresses IT controls for financial institutions in the US?

Accepted Answer

SOX (Sarbanes-Oxley Act)

Answer

SOX requires publicly traded companies, including banks, to implement strong IT controls around financial reporting and data integrity.

Question 2

Which NIST framework provides a risk-based approach to managing cybersecurity risk across an organization?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) provides five core functions—Identify, Protect, Detect, Respond, Recover—as a flexible, risk-based approach to cybersecurity.

Question 3

In cloud compliance, what is the primary purpose of a Business Associate Agreement (BAA)?

Accepted Answer

To define HIPAA responsibilities between a covered entity and cloud provider

Answer

A BAA is a HIPAA-required contract between a covered entity and a business associate that outlines each party's responsibilities for protecting PHI.

Question 4

Under GDPR, what is the maximum time frame for notifying supervisory authorities of a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires that data controllers notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.

Question 5

Which cloud compliance concept refers to the division of compliance responsibilities between a cloud provider and its customer?

Accepted Answer

Shared Responsibility Model

Answer

The Shared Responsibility Model defines which security and compliance obligations belong to the cloud provider versus the customer, varying by service type (IaaS, PaaS, SaaS).

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Regulatory Frameworks & Compliance 3