VCP Regulatory Compliance & Legal Framework 4

Question 1

Which international standard provides a framework for information security management systems (ISMS) that is commonly used alongside VMware deployments to achieve certification?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 specifies requirements for establishing, implementing, and maintaining an ISMS, providing the governance framework under which VMware security controls are documented and audited.

Question 2

PCI DSS Requirement 6.4 requires that public-facing web applications be protected against known attacks. Which VMware solution can fulfill this by acting as a virtual WAF for workloads?

Accepted Answer

NSX Advanced Load Balancer (Avi) with WAF profile

Answer

NSX Advanced Load Balancer (Avi Networks) includes a WAF module that inspects HTTP traffic and blocks OWASP Top 10 attacks, satisfying PCI DSS Req 6.4.

Question 3

When configuring vCenter Server for compliance with CIS Benchmark recommendations, which default setting should be changed to reduce attack surface?

Accepted Answer

Disable the managed object browser (MOB)

Answer

The CIS VMware ESXi and vCenter benchmarks recommend disabling the Managed Object Browser (MOB) as it exposes internal API objects and is not needed in production.

Question 4

A regulated financial firm requires that all VM snapshots containing customer data be retained for exactly 7 years per SEC Rule 17a-4. Which storage capability supports immutable retention?

Accepted Answer

vSAN datastore with WORM-compliant object storage backend

Answer

SEC Rule 17a-4 requires WORM (Write Once Read Many) storage; integrating vSAN with a compliant WORM object storage backend ensures records cannot be altered or deleted during the retention period.

Question 5

Under HIPAA, a VMware cloud provider hosting ePHI workloads for a hospital must sign which agreement before the hospital may share patient data with them?

Accepted Answer

Business Associate Agreement (BAA)

Answer

HIPAA requires a Business Associate Agreement (BAA) between a covered entity and any vendor (business associate) that creates, receives, maintains, or transmits ePHI on their behalf.

VCP - VMware Certified Professional Practice Test

VCP - VMware Certified Professional Practice Test

VCP Regulatory Compliance & Legal Framework 4