Unit 5: Compliance and Cloud Security Operations - Practice Quiz

1 What is the main purpose of compliance in a Security Operations Center (SOC)?

2 Why can regulatory compliance be difficult for organizations operating in multiple countries?

3 What type of information is commonly protected by healthcare data regulations?

4 What should a healthcare organization do after discovering a reportable data breach?

5 What is a key security concern for financial services organizations?

6 Which control helps protect access to financial systems?

7 Why is incident response important for energy and utility organizations?

8 What is an important first activity during an incident involving a utility system?

9 What is the purpose of a continuous incident readiness assessment?

10 Which activity can help test an organization's incident readiness?

11 What does a SIEM system commonly do with security logs?

12 How can a SIEM support compliance audits?

13 What is cloud security primarily concerned with protecting?

14 What is the main purpose of a Cloud Access Security Broker (CASB)?

15 Which capability is commonly associated with a CASB?

16 What is the purpose of container sandboxing?

17 What does configuration drift mean in a cloud environment?

18 What is the purpose of encryption keys?

19 What is a multicloud environment?

20 How can APIs support cloud security operations?

21 A SOC must demonstrate that privileged account activity is reviewed every week. Which approach provides the strongest compliance evidence?

22 An auditor finds that the SOC collects security logs but has no documented retention schedule. What is the most important compliance risk?

23 A multinational company discovers a breach affecting customers in several countries. What should the SOC do first to address differing notification requirements?

24 A global SOC wants one incident-response process while countries impose different data-residency rules. Which design best addresses both needs?

25 A hospital employee accidentally sends a patient file to the wrong external recipient. Which fact is most important when assessing the breach impact?

26 A healthcare SOC detects repeated access to patient records by an employee outside the employee's assigned department. What is the most appropriate initial response?

27 A bank detects an unusual transfer initiated through a compromised employee account. Which SOC action best supports both containment and financial compliance?

28 A payment processor wants to reduce the systems included in an assessment of cardholder data controls. Which change is most effective?

29 Malware is detected on a workstation that supports an electric utility's operational network. Immediate shutdown could disrupt service. What should guide the containment decision?

30 A tabletop exercise shows that SOC analysts cannot contact the legal team outside business hours. What is the best corrective action?

31 Which metric best measures whether repeated incident-readiness exercises are improving the SOC's response capability?

32 An organization must alert on unauthorized changes to critical financial records. Which SIEM configuration best supports this requirement?

33 A SIEM report must serve as audit evidence that failed administrator logins are reviewed. Which feature is most important?

34 A cloud-hosted database is exposed because a customer configured public access. Which concept should the SOC use when assigning responsibility?

35 Employees are uploading sensitive files to unsanctioned cloud storage services. Which CASB capability most directly addresses this issue?

36 A SOC is concerned that a compromised container could access the host operating system. Which control most directly reduces this risk?

37 An approved cloud template requires storage encryption, but an administrator later disables encryption manually. Which capability should detect this condition?

38 A company encrypts cloud data but stores encryption keys in the same database as the ciphertext. What improvement best reduces the impact of a database compromise?

39 A SOC receives identity alerts from two cloud providers and an on-premises directory. What is the best way to detect account abuse across these environments?

40 A SOC automation tool uses a cloud provider's API to isolate compromised virtual machines. Which control is most important for the API credentials?

41 A multinational organization discovers that its SOC playbooks classify an incident only by technical severity. Which change most directly improves compliance-oriented incident handling?

42 A breach affects EU residents, customers in a U.S. state with a sector-specific privacy law, and employees in a country requiring local breach investigation. What is the most defensible SOC response?

43 A cloud provider stores centralized SOC logs in one region, but several jurisdictions restrict certain personal data from leaving their territory. Which control best addresses the conflict?

44 A healthcare SOC confirms that an attacker accessed an encrypted database containing patient records, but the encryption key was not exposed. Which assessment is most important before concluding that notification is unnecessary?

45 A hospital uses a managed service provider that can access protected health information during incident response. Which SOC design most reduces accountability ambiguity after a breach?

46 A bank detects anomalous transfers from a privileged service account. Which evidence set provides the strongest basis for both containment and regulatory defensibility?

47 A financial institution wants to reduce false positives without weakening monitoring for suspicious account activity. Which approach best preserves compliance evidence quality?

48 During a suspected attack on an electric utility, IT indicators suggest ransomware while the operational technology network remains stable. What should the SOC prioritize initially?

49 An energy company cannot collect endpoint agents from safety-certified control devices. Which compensating monitoring strategy is most appropriate?

50 A readiness assessment shows that the SOC has documented playbooks, but analysts cannot retrieve current contact information or restore required evidence from backups. What conclusion is most accurate?

51 Which assessment result most strongly indicates that an incident response program is improving rather than merely generating more exercises?

52 An auditor asks the SOC to prove that privileged access reviews were performed quarterly. Which SIEM capability provides the strongest support?

53 A SIEM normalizes timestamps from systems using different time zones, but several source devices have unreliable clocks. What is the most important compliance risk?

54 In a cloud environment, a production workload is rebuilt from an image after an incident, causing the original instance's volatile evidence to disappear. Which operating model best addresses this risk?

55 A CASB identifies uploads of sensitive documents to an unsanctioned cloud application. Which response is least likely to create an availability problem while still reducing exposure?

56 A container executes untrusted code and attempts to access the host through a kernel vulnerability. Which control most directly limits the impact of a successful container escape?

57 A compliant infrastructure template is deployed, but a later manual change exposes a storage bucket publicly. Which detection design provides the earliest reliable signal?

58 An organization encrypts regulated data with a cloud key-management service, but application administrators can both deploy workloads and retrieve key material. Which weakness remains?

59 A company has identical security policies across two clouds, but one provider logs control-plane actions differently and the private data center uses another identity system. What is the strongest SOC approach?

60 A SOAR platform uses a cloud API to disable a compromised identity. The API token has broad permissions and no expiration. Which remediation most directly reduces automation risk?