Regulatory Compliance & Legal Framework Flashcards
7 cards from real GCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Legal Framework flashcards as text
A company operating in multiple states must comply with various U.S. state privacy laws. Which state law is considered the most influential model for other state privacy legislation?
Answer: California Consumer Privacy Act (CCPA) and its CPRA amendment
The CCPA and its amendment, the CPRA, are the most influential U.S. state privacy laws, establishing many rights and obligations that other states have since modeled.
Under SOC 2 compliance, which Trust Services Criteria category directly addresses whether a system's controls protect against unauthorized access?
Answer: Security (Common Criteria)
The Security (Common Criteria) category is the only mandatory TSC category in SOC 2 and directly covers protection of systems against unauthorized access, use, or disclosure.
Which GCP feature enables organizations to restrict data residency so that covered data is stored and processed only within specific geographic regions?
Answer: Organization Policy constraints (resource location restriction)
Organization Policy constraints such as `gcp.resourceLocations` restrict where GCP resources can be created, helping organizations meet data residency and sovereignty requirements.
Under GDPR, what is the legal term for transferring personal data from the EU to a country that the European Commission has deemed to have adequate privacy protections?
Answer: Adequacy decision transfer
An adequacy decision issued by the European Commission means personal data can flow freely to that third country without additional safeguards.
A GCP customer wants to validate that their cloud environment meets CIS Benchmark recommendations. Which GCP tool provides automated assessment against CIS Benchmarks?
Answer: Security Command Center (Security Health Analytics)
Security Command Center's Security Health Analytics includes built-in detectors that assess GCP resources against CIS Benchmark controls and surface misconfigurations.
Under HIPAA's Minimum Necessary Standard, covered entities accessing PHI must:
Answer: Limit access and use to only what is required to accomplish the intended purpose
The Minimum Necessary Standard requires that covered entities make reasonable efforts to limit PHI access to only what is necessary to accomplish the intended purpose.
An organization must implement controls to comply with CJIS (Criminal Justice Information Services) Security Policy when accessing FBI criminal justice data in GCP. Which requirement is unique to CJIS compared to general cloud security standards?
Answer: Mandatory background checks and security awareness training for personnel with access to CJI
CJIS uniquely requires that personnel with access to Criminal Justice Information (CJI) pass FBI-approved background checks and complete CJIS security awareness training.