Examkin

Question

Difficulty: HardRegulatory Compliance and Legal Requirements Management

A multinational fintech enterprise headquartered in Canada hosts its core payment processing and accounting platform in an IaaS cloud environment. The platform processes customer credit card transactions while also storing records subject to Sarbanes-Oxley (SOX) compliance for financial reporting integrity. Which of the following compliance actions and technical security controls must the organization enforce to satisfy these legal and regulatory frameworks? (Select TWO.)

  1. Implement strict access control policies, segregation of duties, and immutable logging for database systems housing financial statements.Answer
  2. B
    Transfer legal liability and user data governance obligations to the cloud service provider through the IaaS service level agreement.
  3. Isolate the Cardholder Data Environment (CDE) through network segmentation and enforce strong encryption on stored primary account numbers.Answer
  4. D
    Rely on perimeter network firewalls as the primary technical control to mitigate application-layer software flaws within custom accounting modules.

Answer

The organization must implement strict access control policies, segregation of duties, and immutable logging for financial reporting systems (SOX requirement), and isolate the Cardholder Data Environment (CDE) while encrypting stored account numbers (PCI-DSS requirement).
Establishing strict access control policies, segregation of duties, and audit logging for financial databases directly satisfies SOX Section 404 mandates regarding internal control over financial reporting. Simultaneously, isolating the Cardholder Data Environment (CDE) and encrypting primary account numbers directly aligns with PCI-DSS requirements for protecting payment data.

Step-by-Step Solution

1
Analyze regulatory scope requirements for Sarbanes-Oxley (SOX) Act compliance.
Identify that SOX focuses on internal financial reporting controls, access tracking, data integrity, and auditing of financial systems.
SOX Section 404 requires verifiable internal controls over financial disclosures.
2
Analyze regulatory scope requirements for Payment Card Industry Data Security Standard (PCI-DSS).
Identify that processing credit card data mandates Cardholder Data Environment (CDE) scope reduction via segmentation and encryption of primary account numbers (PAN).
PCI-DSS enforces specific technical controls to reduce card fraud and scope exposure.
3
Evaluate distractors against cloud responsibility models and security control types.
Disqualify offloading compliance liability to an IaaS provider and using network firewalls to fix code bugs.
Data governance remains with the tenant in IaaS, and network firewalls do not solve application software code flaws.

Key Concept

Regulatory Compliance Alignment and Mandatory Control Verification
Rate this question

Topics

Regulatory Compliance and Legal Requirements Management

More questions from this topic