A medical organization recently started accepting payments over the phone. The manager is concerned about the impact of the storage of different types of data. Which of the following types of data incurs the highest regulatory constraints?

An organization suspects it has had a breach, and it is trying to determine the potential impact.
The organization knows the following:
- The source of the breach is linked to an IP located in a foreign
country.
- The breach is isolated to the research and development servers.
- The hash values of the data before and after the breach are
unchanged.
- The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)

The primary difference in concern between remediating identified vulnerabilities found in general- purpose IT network servers and that of SCADA systems is that:

Clients are unable to access a company's API to obtain pricing data.
An analyst discovers sources other than
clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs?

The human resources division is moving all of its applications to an IaaS cloud. The Chief Information Officer (CIO) has asked the security architect to design the environment securely to prevent the IaaS provider from accessing its data-at-rest and data-in-transit within the infrastructure. Which of the following security controls should the security architect recommend?