Cloud Security & Compliance Flashcards

Which Informatica Cloud feature generates a complete lineage graph showing how data flows from source to target, helping compliance teams demonstrate data traceability for regulatory audits?

Answer: Enterprise Data Catalog data lineage

Enterprise Data Catalog automatically harvests and visualizes end-to-end data lineage, enabling compliance teams to trace data movement for regulatory requirements.

A security policy requires that Informatica Cloud Secure Agents run as a non-root, least-privilege OS user. What is the primary security benefit of this configuration?

Answer: Limits the blast radius if the agent process is compromised

Running the Secure Agent as a least-privilege OS user limits what an attacker can access or damage if the agent process is exploited.

What distinguishes SOC 2 Type II from SOC 2 Type I in the context of evaluating Informatica Cloud's security compliance posture?

Answer: Type II tests controls over a period of time while Type I tests at a single point in time

SOC 2 Type II evaluates whether controls operated effectively over an audit period (typically 6-12 months), whereas Type I only verifies that controls exist at a specific date.

In Informatica Intelligent Cloud Services, which setting prevents users in one sub-organization from viewing or accessing assets owned by a different sub-organization?

Answer: Cross-org asset sharing disabled by default via sub-org isolation

Sub-organization isolation in IICS ensures that users can only see and access assets within their own sub-org unless explicit sharing is configured.

When integrating Informatica Cloud with AWS S3, which approach follows the principle of least privilege for granting the Secure Agent access to S3 buckets?

Answer: Creating an IAM role with specific S3 bucket permissions attached to the agent EC2 instance

Attaching an IAM role with scoped S3 permissions to the EC2 instance running the Secure Agent avoids long-lived credentials and restricts access to only necessary buckets.

Which Informatica Cloud capability allows an organization to enforce that all data written to a cloud data warehouse target is encrypted at rest using a customer-managed encryption key (CMEK)?

Answer: Configuring CMEK in the target platform and using the IICS connector that passes through the platform's native encryption

CMEK is managed at the target platform layer (e.g., Snowflake, BigQuery); the IICS connector writes data through the platform's native API which applies the customer-managed key transparently.

A compliance officer needs to generate a report showing all Informatica Cloud users who have the 'Admin' role, along with the date they were granted that role. Which IICS feature supports this?

Answer: User management audit log export

IICS maintains an audit log of user administration events including role assignments, which administrators can export for compliance reporting.