IBM Cloud for Financial Services v2 Specialty (S2000-023) Practice Exam

Meridian Capital Trust is onboarding an ISV-delivered analytics platform onto IBM Cloud for Financial Services. The CISO wants to confirm which party owns the control for ‘encryption of data at rest using customer-managed keys’ under the shared-responsibility model.

1. IBM solely owns the control because IBM provides Key Protect
2. The ISV solely owns the control because the ISV hosts the application
3. The consuming enterprise and the ISV share the control — the ISV enables CMK support, the enterprise supplies and rotates the keys
4. The control is not applicable on IBM Cloud for Financial Services

An architect at Castlebridge Re must ensure that an IBM Cloud Object Storage bucket holding actuarial data can be accessed only from a specific VPC and only by a specific privileged group, even if an IAM policy would otherwise permit broader access.

1. Context-based restrictions with a network zone and endpoint type
2. IAM service-to-service authorization
3. A bucket-level ACL set to private
4. A separate account with only the intended users invited

A payments microservice must be deployed on IBM Cloud for Financial Services. The delivery team wants to use only services already recognized as validated for the Framework, to avoid re-running costly compliance assessments. Where should they check validated-service eligibility?

1. The IBM Cloud catalog filter for Financial Services Validated
2. The team’s internal wiki of past approvals
3. The billing usage report
4. The container registry image scan results

An automated nightly process must rotate credentials across several services in a single IBM Cloud account. The security lead wants to avoid long-lived service IDs with API keys and instead use a workload identity that trusts the compute environment.

1. A shared functional user with MFA enforced
2. A service ID with a long-lived API key and rotation every 30 days
3. A trusted profile federated to the compute workload identity
4. Classic infrastructure keys stored in a secrets manager

During a posture review, the Security and Compliance Center flags a profile out of compliance because resources in one resource group violate a rule. The control owner must show an auditor that the finding has been triaged. Which step produces defensible evidence?

1. Delete the failing resources and ignore the finding
2. Change the finding status to resolved in a spreadsheet
3. Modify the profile to remove the rule
4. Add an attachment exemption with a documented justification and expiration

A privileged-access engineer must give an external auditor read-only visibility into configuration evidence for a single resource group for two weeks, with no standing access beyond that window.

1. Invite the auditor as an account administrator for two weeks
2. Add the auditor to the owner role with a calendar reminder to remove them
3. Share a privileged IAM API key by encrypted email
4. Grant a time-bound access group membership scoped to the resource group with viewer role

A platform team finds that several deployed services in a development resource group are not evaluated by any Security and Compliance Center profile, even though they should be covered by the organization’s standard scope. What is the likely cause?

1. The scope of the profile attachment does not include the development resource group
2. Security and Compliance Center is region-locked and development is in a different region
3. The services do not emit Activity Tracker events
4. The IAM policies on the services block evaluation

An architect is drafting a landing-zone reference for a new capital-markets tenant and needs to separate production, non-production, and security-tooling workloads while still allowing a single centralized log destination.

1. A single account with resource groups for each environment
2. An enterprise with separate accounts per environment and a dedicated security account, all linked to a central logging instance
3. Three unrelated accounts with no enterprise parent
4. A single account with tags to separate environments

A compliance officer must show that all administrative API calls against a critical Cloud Object Storage instance over the past quarter are captured in tamper-evident storage, preserved outside the account that generated the events.

1. Activity Tracker events routed to a COS bucket in the same account with object lock disabled
2. Activity Tracker events routed to a separate dedicated security account’s COS bucket with object lock enabled
3. A logging tenant in the same account, with 30-day retention
4. Local syslog on the application servers

A capital-markets trading firm asks which NIST 800-53 control family the Framework’s control reference maps to for the requirement that all privileged session activity be recorded for later review.

1. Access Control (AC)
2. Audit and Accountability (AU)
3. System and Communications Protection (SC)
4. Configuration Management (CM)