Question 860
An insurance platform is deployed across provinces with different privacy reporting obligations and a shared retention setting. Before acting, which evidence should the project team examine FIRST to assess the stated need?
Explanation
Correct Answer
Inspect data subjects' locations, hosting regions, contractual transfers, retention policies, and applicable regulatory requirements. This checks the relevant condition before the team intervenes. Privacy and residency obligations can vary by jurisdiction; technical cloud-region availability does not establish legal permission to transfer data. The controlled response is: Review country and regional privacy requirements before moving, processing or disclosing personal data across borders. Situation: An insurance platform is deployed across provinces with different privacy reporting obligations and a shared retention setting.
Incorrect Answers
Inspect data inventory, PII or PHI fields, purpose of processing, authorized recipients, and protection requirements. That evidence would investigate Personally identifiable information and health data, not the main uncertainty in this situation. To decide the current case, examine: Inspect data subjects' locations, hosting regions, contractual transfers, retention policies, and applicable regulatory requirements. Situation: An insurance platform is deployed across provinces with different privacy reporting obligations and a shared retention setting.
Inspect deployment architecture, shared-responsibility terms, maintenance needs, vendor guarantees, and administrator duties. That evidence would investigate SaaS PaaS and IaaS cloud responsibility, not the main uncertainty in this situation. To decide the current case, examine: Inspect data subjects' locations, hosting regions, contractual transfers, retention policies, and applicable regulatory requirements. Situation: An insurance platform is deployed across provinces with different privacy reporting obligations and a shared retention setting.
Inspect classification rules, intellectual property exposure, access groups, sharing permissions, and audit records. That evidence would investigate Data classification and need-to-know permissions, not the main uncertainty in this situation. To decide the current case, examine: Inspect data subjects' locations, hosting regions, contractual transfers, retention policies, and applicable regulatory requirements. Situation: An insurance platform is deployed across provinces with different privacy reporting obligations and a shared retention setting.


