GCP Regulatory Compliance & Legal Framework 4

Question 1

Under the International Traffic in Arms Regulations (ITAR), which type of cloud data storage arrangement could expose a company to ITAR violations?

Accepted Answer

Allowing foreign nationals to access controlled technical data without authorization

Answer

ITAR defines 'export' to include giving foreign nationals access to controlled defense-related technical data, even within the U.S., without proper authorization.

Question 2

A healthcare SaaS provider uses GCP to process PHI. To comply with HIPAA, the provider must ensure GCP has signed a:

Accepted Answer

Business Associate Agreement (BAA)

Answer

HIPAA requires a signed Business Associate Agreement between covered entities or business associates and any cloud service provider that creates, receives, maintains, or transmits PHI on their behalf.

Question 3

The NIST Cybersecurity Framework (CSF) organizes security activities into five core functions. Which function focuses on detecting the occurrence of a cybersecurity event?

Accepted Answer

Detect

Answer

The 'Detect' function of the NIST CSF encompasses activities that enable timely discovery of cybersecurity events through continuous monitoring and anomaly detection.

Question 4

An organization must comply with the Sarbanes-Oxley Act (SOX). Which GCP capability is most directly relevant to meeting SOX's internal control requirements for financial reporting?

Accepted Answer

Immutable Cloud Audit Logs with access controls

Answer

SOX Section 302 and 404 require reliable audit trails and internal controls; immutable audit logs with strict access controls provide evidence of those controls for financial systems.

Question 5

Which principle in data privacy law states that only the minimum amount of personal data necessary for the specified purpose should be collected?

Accepted Answer

Data minimization

Answer

Data minimization, codified in GDPR Article 5(1)(c), requires that personal data be adequate, relevant, and limited to what is necessary for the processing purpose.

GCP Test Practice Test

GCP Test Practice Test

GCP Regulatory Compliance & Legal Framework 4