Nutanix Exam Regulatory Compliance & Legal Framework 2

Question 1

Under HIPAA, which Nutanix feature helps ensure that ePHI stored in a cluster remains protected from unauthorized access by internal staff?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC restricts access to sensitive data based on job roles, satisfying HIPAA's minimum necessary access principle for ePHI.

Question 2

Which Nutanix capability directly supports PCI DSS Requirement 10 by providing immutable logs of all administrator actions?

Accepted Answer

Audit log retention via Syslog forwarding

Answer

PCI DSS Requirement 10 mandates tracking and monitoring of all access to network resources, which Nutanix satisfies through Syslog-forwarded, tamper-evident audit logs.

Question 3

A company subject to GDPR wants to ensure data deleted upon a subject access request cannot be recovered. Which Nutanix feature is most relevant?

Accepted Answer

Secure data shredding / crypto-erase on decommission

Answer

GDPR's right to erasure requires that data be irrecoverably deleted, which is achieved through crypto-erase or secure shredding rather than simple logical deletion.

Question 4

SOC 2 Type II compliance differs from SOC 2 Type I in that it:

Accepted Answer

Tests controls over a period of time rather than a single point in time

Answer

SOC 2 Type II evaluates the operational effectiveness of controls over a minimum six-month period, providing stronger assurance than the point-in-time Type I.

Question 5

When deploying Nutanix in a FedRAMP High environment, which encryption standard is mandated for data at rest?

Accepted Answer

AES-256

Answer

FedRAMP High requires FIPS 140-2 validated cryptographic modules, with AES-256 being the accepted standard for data-at-rest encryption.

Nutanix Exam Practice Test

Nutanix Exam Practice Test

Nutanix Exam Regulatory Compliance & Legal Framework 2