D320 Managing Cloud Security - Set 1 - Part 3

Correct Answer: Data Breach Notification

GDPR requires organizations to notify individuals in the event of a data breach that affects their personal data. Purpose Limitation and Data Minimization are principles for data use and collection, while Integrity and Confidentiality protect data from unauthorized access.

Correct Answer: NIST SP 800-53

NIST SP 800-53 provides security and privacy controls specifically for U.S. government information systems. ISO/IEC 27001 is a general information security standard, PCI DSS is for payment card security, and HIPAA focuses on healthcare data protection.

Correct Answer: Incident Management

Incident Management focuses on addressing and resolving cloud service disruptions as quickly as possible. Capacity Management ensures that resources meet demand, Problem Management identifies root causes, and Service Level Management ensures SLA compliance.

Correct Answer: Role-Based Access Control (RBAC)

RBAC assigns permissions based on the user's role within the organization, ensuring that users can only access the resources they are authorized to use. Encryption protects data, Firewalls prevent unauthorized access, and IDS detects security breaches.

Correct Answer: Risk Avoidance

Risk Avoidance is the strategy of discontinuing an activity that poses too high a risk, effectively eliminating the risk. Risk Acceptance involves taking no action, Risk Mitigation reduces the risk, and Risk Transference shifts the risk to another party.

Correct Answer: SOC 2 Report

A SOC 2 report evaluates and reports on the effectiveness of security controls within a cloud providers environment, focusing on security, availability, processing integrity, confidentiality, and privacy. ISO/IEC 27001 and GDPR are broader certifications, and HIPAA is specific to healthcare.

Correct Answer: Integrity and Confidentiality

The Integrity and Confidentiality principle under GDPR ensures that personal data is processed in a secure manner, protecting it against unauthorized or unlawful processing. Lawfulness, Fairness, and Transparency address the fairness of data processing, while Data Minimization and Purpose Limitation focus on data use.

Correct Answer: Change Management

Change Management ensures that changes to cloud services are planned, tested, and implemented efficiently. Incident Management addresses disruptions, Problem Management identifies root causes, and Capacity Management ensures resources meet demand.

Correct Answer: Homomorphic Encryption

Homomorphic Encryption allows data to be processed while still encrypted, providing an added layer of security. Symmetric and Asymmetric encryption require decryption before processing, and Tokenization replaces sensitive data with tokens for protection.

Correct Answer: To assess the overall impact of risks on business functions

A Business Impact Analysis (BIA) assesses the overall impact of risks on business functions, helping organizations understand the consequences of potential disruptions. Quantitative Risk Analysis calculates financial loss, Risk Mitigation reduces risks, and Risk Prioritization is part of Risk Assessment.