Review: Understanding Cloud Governance (Applied)

A district moves its learning management system to the cloud. The system stores K-12 student grades and attendance. Which privacy law governs this data?

• COPPA

• HIPAA

• FERPA

• BIPA

Answer explanation

FERPA governs student education records like grades and attendance. HIPAA covers health data, and COPPA targets online services for children under 13.

A clinic plans to host patient records in a public cloud. What should the team verify first about the provider?

• Competitive storage pricing tiers

• Custom branding support options

• Health data compliance attestation

• Free data egress transfer policy

Answer explanation

Before storing protected health information, confirm the provider holds a recognized compliance attestation for health data. Pricing and branding do not reduce regulatory exposure.

A European retailer asks where its customer records will physically reside before signing a cloud contract. Which concept is the customer protecting?

• Data deduplication

• Data replication

• Data residency

• Data tiering

Answer explanation

Data residency addresses the legal jurisdiction where data is physically stored. Replication and tiering describe how copies are placed for performance or cost, not legal location.

An auditor asks the cloud team to align security controls with an internationally recognized information security management standard. Which framework fits?

• Web application risk catalog

• Payment card data security standard

• IT service management library

• International information security standard

Answer explanation

ISO 27001 is the international standard for information security management systems. Payment card standards target card data, and service management libraries cover IT operations, not security management.

A team uses a prebuilt facial recognition API trained on a dataset the vendor will not disclose. What is the primary ethical risk?

• Higher per-call pricing

• Reduced regional availability

• Hidden bias in predictions

• Longer API response times

Answer explanation

When training data is undisclosed, the model may carry hidden bias that produces unfair outcomes for certain groups. Latency and cost are operational concerns, not ethical ones.

An AI triage tool denies patient care and no one can explain the model's decision. Which ethical principle was violated?

• Redundancy

• Transparency

• Portability

• Elasticity

Answer explanation

Transparency requires that AI decisions be explainable to affected parties. Redundancy, portability, and elasticity are technical cloud properties, not ethical principles.

Diego, a junior cloud admin, must give a contractor permissions to read logs from one storage account only. The built-in Reader role grants read on all resources. What should Diego do?

• Add the contractor to the Global Administrators group

• Assign the built-in Reader role at the subscription scope

• Grant Owner on the storage account temporarily

• Create a custom role limited to that storage account

Answer explanation

When built-in roles are too broad, a custom role scoped to the single resource enforces least privilege. Owner and Global Admin grant far more than needed.

A cloud admin enables a system requiring a password plus a one-time code from the user's phone. What is being configured?

• Multifactor authentication

• Federated identity management

• Conditional access logging

• Single sign-on access

Answer explanation

Combining a password with a phone-generated code uses two distinct factors, which defines multifactor authentication. Single sign-on simplifies login but does not require multiple verification factors.

Three former employees still have active cloud accounts after offboarding. Which account hygiene step is required?

• Reset passwords and keep accounts active

• Move accounts to a guest directory

• Downgrade accounts to read-only access

• Disable or remove the departed users' accounts

Answer explanation

Accounts for departed employees must be disabled or removed to eliminate the attack surface. Resetting passwords or reducing permissions still leaves usable identities in the system.

A company encrypts customer files in cloud object storage so a stolen physical disk reveals nothing readable. Which protection is in use?

• Encryption in transit

• Tokenization in motion

• Encryption at rest

• Session key hashing

Answer explanation

Encryption at rest protects data stored on physical media. Encryption in transit protects data moving across a network, such as during an upload or download.