Top 30 Compliance Interview Questions and Answers
30 multiple-choice questions on Compliance, drawn from 30 bites out of the 47 tagged Compliance on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
In a hybrid cloud setup for a regulated business, which split of components is most appropriate?
Show the answer
Answer: b · Keep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud
Hybrid keeps sensitive, regulated, and hard-to-migrate systems in the controlled private environment while putting elastic, customer-facing workloads in the public cloud. The other options place regulated data in the cloud or misallocate the elastic and sensitive components.
Read the full bite: When hybrid cloud beats public or private
Question 2 of 30
Which implementation best satisfies GDPR for informed consent before a remote usability test?
Show the answer
Answer: c · Use a CMP to collect active consent, record it server-side, and gate the test interface until consent is confirmed
The correct approach requires active consent via a CMP, server-side recording for auditability, and blocking test access until consent is granted. A tempting distractor stores consent only in browser storage, which can be altered after the fact and lacks a verifiable server-side record.
Read the full bite: Implement verifiable informed consent before a remote usability test
Question 3 of 30
What is the primary advantage of adopting a systematic information security management system (ISMS) for research data?
Show the answer
Answer: a · It provides a continuous, structured approach to identify and mitigate data security risks.
The card emphasizes that an ISMS treats security as a "living system" and a "continuous process" for "systematically reducing" risks, making option A the core advantage. Option B is incorrect because the card explicitly states security is "not as a single tool like a firewall" and involves a holistic system of policies, procedures, and technical controls, not just technical tools.
Read the full bite: Securing Research Data with a Management System
Question 4 of 30
When handling a GDPR erasure request, what is the correct way to update aggregated analytics dashboards derived from the user's data?
Show the answer
Answer: d · Reprocess the underlying data pipeline to exclude the user and rebuild all affected metrics
The card states that aggregated dashboards must be fixed by reprocessing the underlying pipeline or using differential privacy, because simple subtraction fails for complex metrics like averages and funnels. Option B represents the common misconception of manually adjusting aggregates, which does not reliably remove the user's influence from derived metrics.
Read the full bite: How do you fulfill a GDPR erasure request across data stores?
Question 5 of 30
Which scenario is LEAST likely to require an Institutional Review Board (IRB) review?
Show the answer
Answer: c · An internal company survey to gauge employee satisfaction with new office amenities.
The card states that "Purely commercial activities, like internal-only product feedback or simple customer satisfaction surveys, might not require IRB review." The other options describe scenarios involving academic research, clinical trials, or public reporting, which typically fall under IRB purview due to their research nature, potential for publication, or sensitive data.
Read the full bite: Institutional Review Board (IRB): Your Research Ethics Checkpoint
Question 6 of 30
Under Google's Consent Mode, what happens when a user denies consent for analytics tracking?
Show the answer
Answer: a · Anonymous, cookieless pings are sent to Google for data modeling, without storing personal identifiers.
When consent is denied, Google's Consent Mode prevents the storage of cookies or personal identifiers. However, it still sends anonymous, cookieless pings to allow for data modeling, making option B (all data collection halts) a common misconception.
Read the full bite: Analytics Consent Management: Respecting User Choices
Question 7 of 30
A UX researcher is preparing to conduct interviews with participants residing in the EU. To align with GDPR's core principles, which approach is most critical?
Show the answer
Answer: d · Collecting only the personal data strictly necessary for the specific, defined research objectives.
The card emphasizes 'purpose limitation' and 'data minimization,' stating researchers should 'collect only what you need for a specific purpose' and 'minimize the data you collect to only what is necessary.' While consent is crucial, the card warns that 'A vague "for research purposes" is not enough' and GDPR is 'not just about getting a signature on a consent form,' highlighting the importance of other principles from the outset.
Read the full bite: GDPR for UX Research: Beyond the Consent Form
Question 8 of 30
What unique capability does an AWS Dedicated Host offer that is essential for specific software licensing and strict regulatory compliance?
Show the answer
Answer: b · Exclusive use of an entire physical server, with visibility into its underlying hardware.
Dedicated Hosts provide exclusive use of a physical server and visibility into its hardware, which is critical for 'bring your own license' (BYOL) software tied to physical cores and for meeting compliance requiring physical isolation. Option C describes EC2 Dedicated Instances, which offer isolation but lack the full server control and hardware visibility for per-core licensing.
Read the full bite: AWS Dedicated Hosts: Your Own Physical Server in the Cloud
Question 9 of 30
Which scenario highlights a key limitation of encryption at rest?
Show the answer
Answer: d · An authorized application, compromised by an attacker, reads sensitive data from storage.
The card explicitly states that encryption at rest "doesn't stop a compromised app with valid keys from reading" and advises "Do not rely on it to protect data from a compromised application with valid credentials." While encryption can have performance implications, the card notes that "performance overhead on modern systems is negligible."
Read the full bite: Encryption at Rest: Securing Your Data When It's Not Moving
Question 10 of 30
A team wants to instantly revoke the ability to decrypt a dataset during an incident, with full audit logs. Which key model best supports this?
Show the answer
Answer: a · Customer-managed keys in a KMS the team controls
Customer-managed keys let you set policy, audit usage, and disable the key to cut decryption on demand. Service-managed keys are opaque and offer no independent revocation or custom policy.
Read the full bite: Service-managed vs customer-managed vs BYOK keys
Question 11 of 30
Which approach best guarantees no new VM is ever launched with a public IP across all accounts?
Show the answer
Answer: d · An organization-level deny policy that blocks the attachment at creation time
A preventive org-level deny policy stops the violation before the resource is created and inherits to all accounts. A nightly scan is detective and leaves an exposure window before remediation.
Read the full bite: Automating a no-public-IP governance rule
Question 12 of 30
Which scenario most clearly requires a company to comply with GDPR?
Show the answer
Answer: d · A US company with all its servers in the US, but some users are French citizens living in France.
GDPR applies to any organization processing personal data of individuals inside the EU and EEA, regardless of the organization's location. Therefore, a US company with French users residing in France must comply. Truly anonymized data is exempt, and the location of the data subject (not their nationality) determines applicability.
Read the full bite: GDPR: Treating User Data as a Liability, Not an Asset
Question 13 of 30
A team uses a cloud provider's HIPAA-eligible database service and assumes the application is therefore compliant. What is the flaw in this reasoning?
Show the answer
Answer: c · Eligibility enables compliance, but correct configuration and controls remain the customer's responsibility
An eligible service can be used in a compliant way, but the customer must still configure isolation, encryption, access, and logging correctly. Eligibility never certifies the whole deployment automatically.
Read the full bite: Architecting for HIPAA or PCI DSS compliance
Question 14 of 30
A security team uses an SBOM to identify all instances of a newly discovered vulnerable library. What critical piece of information does the SBOM not directly provide regarding this vulnerability?
Show the answer
Answer: c · Whether the vulnerable library is actually called or configured in a way that makes the application exploitable.
The card states that an SBOM "tells you what components you have, but not if they are configured or used in a vulnerable way." This means it doesn't confirm if a vulnerable component is actually exploitable in the product's specific context. This additional context is typically provided by a VEX document, not the SBOM itself. The other options describe information that an SBOM is designed to provide.
Read the full bite: Software Bill of Materials (SBOM): An Ingredient List for Your Code
Question 15 of 30
When utilizing an Accessibility Conformance Report (ACR) for product evaluation, what is its fundamental characteristic?
Show the answer
Answer: a · It is a detailed, self-reported statement on a product's conformance to accessibility standards.
An ACR is a detailed, line-by-line, self-reported statement of how a product conforms to specific accessibility standards, acting as a 'nutrition label' for accessibility. It is explicitly stated not to be a simple pass/fail grade or a third-party certification.
Read the full bite: VPAT vs. ACR: The Nutrition Label for Accessibility
Question 16 of 30
Which task is a cloud audit trail LEAST suited for?
Show the answer
Answer: c · Monitoring an application's CPU and memory usage over time.
The card explicitly states that an audit trail is not a replacement for real-time application performance monitoring (APM) or metrics, which covers CPU and memory usage. The other options are all primary use cases for audit trails as described in the card.
Read the full bite: Cloud Audit Trail: The 'Who Did What' Record
Question 17 of 30
What is the primary security challenge a Cloud Security Posture Management (CSPM) solution is designed to address?
Show the answer
Answer: c · Continuous identification and prioritization of cloud resource misconfigurations and compliance deviations.
The card explicitly states CSPM was created to "prevent security gaps caused by misconfiguration, which is a leading cause of cloud breaches" and details its continuous evaluation against security rules and compliance. Distractor A describes real-time threat defense, which the card notes CSPM is not designed for.
Read the full bite: CSPM: A Single Pane of Glass for Cloud Security
Question 18 of 30
According to the card, what is the primary distinction between data sovereignty and data residency?
Show the answer
Answer: b · Data sovereignty refers to the legal jurisdiction governing data, and data residency is the physical location chosen for compliance.
The card defines data sovereignty as the data's "citizenship" or legal jurisdiction, and data residency as its physical "address" or storage location chosen to satisfy those legal rules. Option C incorrectly swaps these definitions, which is a common misunderstanding.
Read the full bite: Data Sovereignty: Your Data's Legal 'Citizenship'
Question 19 of 30
In the context of cloud security, what is the fundamental purpose of a compliance framework?
Show the answer
Answer: c · To provide a standardized set of auditable security controls for users to implement and verify.
A compliance framework defines specific, auditable security requirements that users must implement and verify, acting as a standardized rulebook. It does not automatically implement controls, nor does it solely certify cloud providers or replace all internal security policy development.
Read the full bite: Cloud Compliance Frameworks: Security as a Standard
Question 20 of 30
What is a key weakness of relying solely on a keyword blocklist to moderate ad copy?
Show the answer
Answer: c · It is easily evaded and cannot judge context, causing misses and false positives
Blocklists are trivially bypassed by character substitution and are context-blind, causing both evasions and false positives like the Scunthorpe problem. They are actually fast and need no training data, which is why the other options are wrong.
Read the full bite: Automatically moderate user-generated ad copy
Question 21 of 30
Which combination best enforces a 'no untagged public-IP VM' policy across a large organization?
Show the answer
Answer: d · Preventive policy at creation plus continuous detection and automated remediation
Layered preventive, detective, and corrective controls stop most violations, catch the rest quickly, and fix them automatically. Manual audits, one-time scripts, and documentation leave long windows of unenforced non-compliance.
Read the full bite: Enforce a cloud resource compliance policy
Question 22 of 30
An ad for a fitness app shows a close-up of a person's stomach with the headline, "Ashamed of your belly fat? Our AI coach can fix it." Based on the card, why would this ad likely be rejected?
Show the answer
Answer: b · It implies personal attributes and attempts to generate negative self-perception.
The card's canonical example explicitly states that an ad using "Ashamed of your belly fat?" would be rejected because it "violates policy by attempting to generate negative self-perception" and "targets a specific physical attribute in a way that can make users feel bad." While promoting unsafe products is also a violation, the card specifically identifies the negative self-perception messaging as the reason for rejection in this scenario.
Read the full bite: Ad Policy Compliance: Why Your Ads Get Rejected
Question 23 of 30
A research platform must run an A/B test in Germany and the US while respecting EU data residency. Which design best satisfies both compliance and low latency?
Show the answer
Answer: c · Ingest German events in-region, compute anonymized aggregates locally, and replicate only those summary statistics to a global analytics tier
Processing and aggregating data within the region before exporting only anonymized statistics keeps raw PII local and minimizes latency for participants. Option A is tempting because encryption feels sufficient, but GDPR requires logical or physical separation within the region rather than relying on access controls in a global store.
Read the full bite: Design a globally compliant, low-latency research backend architecture
Question 24 of 30
What is the main risk of placing the actively queried 7-day log window directly into a deep archive tier?
Show the answer
Answer: a · Retrieval is slow and costly, breaking the query SLA
Deep archive tiers trade cheap storage for slow, expensive retrieval, so active queries would miss their SLA. Archive tiers do store any object type and do not auto-delete without an expiration rule.
Read the full bite: Lifecycle storage tiering for compliance logs
Question 25 of 30
What is the fundamental flaw in loading all analytics scripts at page startup and using a banner only to hide them until the user accepts?
Show the answer
Answer: d · Tracking scripts execute before consent, meaning user data can be collected and profiled before opt-in.
GDPR mandates gating script execution, not just visibility; once a tracking script runs, profiling may already have occurred. Distractor A is wrong because strictly necessary cookies like session tokens are exempt and may load immediately without consent.
Question 26 of 30
What is the fundamental difference between database auditing and access control mechanisms like roles and permissions?
Show the answer
Answer: a · Auditing provides a reactive record of events, whereas access control offers proactive prevention.
Auditing provides a reactive record of events for accountability and forensics, like a security camera. Access control, however, is a proactive measure designed to prevent unauthorized actions from occurring in the first place, blocking access before it happens.
Read the full bite: Database Auditing: Your Database's Security Camera
Question 27 of 30
An iOS app keeps Apple's colors and fonts but replaces standard back navigation with a custom bottom toolbar. Which statement describes the HIG compliance risk?
Show the answer
Answer: c · It breaks user muscle memory for navigation gestures and hierarchy.
The card emphasizes that HIG covers interaction patterns, not just visuals; replacing standard navigation breaks the muscle memory users rely on. Distractor D repeats the exact visual-skin footgun the card warns against, while A misapplies HIG to cross-platform design.
Question 28 of 30
Which component is most crucial for ensuring a GDPR 'Right to be Forgotten' system can effectively locate all user data across a distributed architecture?
Show the answer
Answer: b · A centralized metastore index mapping user IDs to data locations
The card emphasizes that 'you cannot delete what you cannot find' and describes the metastore index as mapping a user ID to every physical location their data resides. While other components are essential for the overall system, the metastore is foundational for identifying all data to be deleted, making it crucial for locating data.
Read the full bite: Design a GDPR 'Right to be Forgotten' System
Question 29 of 30
Why is crypto-shredding often preferred over physical deletion for erasing one user's data from an immutable S3 data lake?
Show the answer
Answer: d · It avoids rewriting large interleaved objects by destroying the per-user key instead
Per-user encryption lets you render data unrecoverable by destroying a key, avoiding expensive rewrites of immutable files. It does not propagate downstream nor remove the audit-trail requirement, and other methods can also be lawful.
Read the full bite: Enforcing GDPR Right to be Forgotten at scale
Question 30 of 30
Which design best satisfies a GDPR erasure request without breaking immutable experiment lineage?
Show the answer
Answer: c · Use row-level provenance to identify affected models, exclude the records from dataset versions, retrain only impacted models, and retain lineage metadata for audit.
The correct approach uses row-level provenance to surgically remove personal data, retrain only affected models, and keep immutable metadata for auditors. Option B is tempting because it sounds like thorough erasure, but purging experiment logs actually destroys the audit trail and violates the need to retain lineage metadata while purging personal data.
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.