Legal, Risk and Compliance practice questions

Implement client-side encryption with a key management service.

Why wrong: Client-side encryption adds complexity but is not required by GDPR if server-side encryption is already in place.

Automatically delete backups older than 30 days.

Why wrong: Backup retention policies are operational, not a specific GDPR accountability control.

Apply data masking to all personal data fields before storage.

Why wrong: Data masking is used for non-production environments, not for meeting accountability.

Delete the file immediately.

Why wrong: Deleting the file removes evidence needed for investigation.

Enable default encryption on the bucket.

Why wrong: Encryption protects data at rest but does not prevent public access.

Revoke the developer's IAM credentials.

Why wrong: Revoking credentials does not change the bucket ACL; the bucket remains public.

The customer.

Why wrong: Customers are responsible for patching their own virtual machines, not the hypervisor.

The regulatory authority.

Why wrong: Regulators set standards but do not manage infrastructure.

A third-party auditor.

Why wrong: Auditors verify compliance but do not perform patching.

The CSP must store data in a specific geographic location.

Why wrong: HIPAA does not mandate geographic storage locations.

The CSP must perform quarterly penetration tests.

Why wrong: HIPAA does not specify frequency of penetration tests.

The CSP must encrypt all data at rest using AES-256.

Why wrong: Encryption is an addressable implementation specification, not a mandatory requirement.

Change the DNS to point to a different IP address.

Why wrong: This is a slow reaction and does not stop the attack from the same source.

Increase the compute capacity of the web servers.

Why wrong: Scaling up may help absorb traffic but does not mitigate the attack and can be expensive.

Block the IP address in the WAF.

Why wrong: Blocking an IP may affect legitimate users sharing that IP, and attackers can easily change IPs.

Ignore the risk until it materializes.

Why wrong: Ignoring risk is not a recognized risk management strategy.

Accept the risk because the likelihood is low.

Why wrong: High impact risks are rarely accepted without mitigation.

Transfer the risk to a third party.

Why wrong: Risk transfer (e.g., insurance) may be considered, but not the first step.

Enable detailed audit logging of all data access.

Why wrong: Logging does not prevent access; it only records it.

Implement strict IAM policies for CSP employees.

Why wrong: IAM policies are under CSP control; the customer cannot enforce them.

Enable server-side encryption with customer-provided keys.

Why wrong: The CSP still manages the encryption process and may have access to keys.

Strategy to avoid vendor lock-in with the CSP.

Why wrong: Vendor lock-in is a procurement concern, not a BCP requirement.

A detailed risk assessment for all cloud services.

Why wrong: Risk assessment is part of risk management, not BCP.

Network topology diagrams of the cloud environment.

Why wrong: While helpful, diagrams are not a required element of a BCP.

Physical security of data centers.

Why wrong: Physical security is the responsibility of the CSP.

Patching the hypervisor.

Why wrong: The hypervisor is managed by the CSP.

Business continuity plan.

Why wrong: BCP is part of business continuity management, not ISMS.

Annual penetration testing.

Why wrong: Penetration testing may be a control but is not a required component of ISMS.

Encryption of all data at rest.

Why wrong: Encryption is a security control, not a component of ISMS.

Add a Deny statement for the 10.0.0.0/16 range.

Why wrong: This would deny access to the entire corporate network, including the security subnet.

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Why wrong: Deny statements can override Allow, but it's simpler to modify the Allow condition.

Remove the Condition element to allow access from any IP.

Why wrong: This would open access to all IPs, violating the requirement.

The user is trying to access the bucket from a different AWS region.

Why wrong: Cross-region access is allowed by default; region mismatch is not an issue.

The bucket policy explicitly denies access to the 'Analysts' group.

Why wrong: A deny in bucket policy would also cause AccessDenied, but the log does not indicate a bucket policy denial.

The bucket requires server-side encryption and the request did not include encryption headers.

Why wrong: Encryption mismatch would produce a different error, not AccessDenied.

Disable automated backups and rely on point-in-time recovery.

Why wrong: Disabling backups is not a compliance solution and may violate data retention policies.

Enable encryption on the RDS instance and use encrypted replicas.

Why wrong: This does not address the unencrypted backups and logs.

Enable encryption on the S3 bucket only, since backups are the main concern.

Why wrong: This ignores the CloudWatch Logs which may contain ePHI.

Accept the provider's data residency feature as sufficient compliance.

Why wrong: Data residency alone does not ensure GDPR compliance for cross-border data access.

Pseudonymize all customer data before uploading to the cloud.

Why wrong: Pseudonymization does not exempt data from transfer restrictions.

Encrypt all data and store the keys on-premises.

Why wrong: Encryption does not eliminate the need for a legal transfer mechanism.

Implement virtual LANs (VLANs) and firewall rules between tenants.

Why wrong: Network controls do not prevent side-channel attacks at the processor level.

Use hardware security modules (HSMs) for key management.

Why wrong: HSMs protect key storage but not execution side channels.

Enforce strict API rate limiting for each tenant.

Why wrong: Rate limiting does not mitigate side-channel vulnerabilities.

Take daily snapshots of the database and object storage.

Why wrong: Daily snapshots exceed RPO.

Maintain a cold standby server that is provisioned only during a disaster.

Why wrong: Cold standby has high RTO.

Use asynchronous replication for the database to reduce latency.

Why wrong: Asynchronous replication may not achieve 1-hour RPO.

Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

Why wrong: Vulnerability assessments are good practice but not the first priority over incident response.

Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

Why wrong: Key management is important but not the most critical compliance gap.

Implement a data classification policy to label all data assets according to sensitivity.

Why wrong: Data classification is useful but does not directly address the lack of incident response.

Sarbanes-Oxley Act (SOX)

Why wrong: SOX addresses financial reporting and corporate governance.

Health Insurance Portability and Accountability Act (HIPAA)

Why wrong: HIPAA applies to protected health information in the US.

Payment Card Industry Data Security Standard (PCI DSS)

Why wrong: PCI DSS applies to payment card data, not general PII.

Change management procedures

Why wrong: Change management is not directly impacted by access termination.

Encryption of data at rest

Why wrong: Encryption is not directly related to access termination.

Physical access controls

Why wrong: Physical access controls are separate from logical access.

The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

Why wrong: The condition key is supported and commonly used.

The policy does not apply to requests made by the AWS root account user.

Why wrong: Bucket policies apply to all principals, including root.

The bucket policy has a syntax error; the Allow and Deny statements cannot be combined in the same policy.

Why wrong: It is valid to have both Allow and Deny statements in the same policy.