Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How do compliance frameworks typically influence the detection phase of incident handling?

   • AThey may require specific monitoring and logging controls to detect potential incidents
   • BThey prohibit the use of automated detection tools
   • CThey mandate that all incidents be detected within 24 hours
   • DThey require immediate containment before any detection occurs
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A company experiences a data breach that compromises personal data. Under GDPR, when must the company notify the affected individuals directly?

   • AOnly if the supervisory authority requests it
   • BWhenever any personal data is involved in a breach, regardless of risk
   • CWhen the breach is likely to result in a high risk to the rights and freedoms of individuals
   • DOnly when the breach involves financial data
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Under FISMA, which organization is the primary federal entity that federal agencies must report security incidents to?

   • AFederal Trade Commission (FTC)
   • BOffice of Management and Budget (OMB)
   • CDepartment of Homeland Security (DHS) directly
   • DUS-CERT (now CISA)
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Under HIPAA, a covered entity must notify affected individuals of a breach of unsecured protected health information (PHI). What is the general deadline for this notification?

   • AWithin 72 hours of discovery
   • BImmediately upon discovery, with no exceptions
   • CWithout unreasonable delay and in no case later than 60 days after discovery of the breach
   • DWithin 10 business days
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A global online retailer that processes credit card payments and sells to EU customers discovers a breach that exposed both EU customer personal data and payment card data. The company is subject to both GDPR and PCI-DSS. The breach occurred on a Friday evening. What should the company do first?

   • ANotify the relevant supervisory authority under GDPR within 72 hours and notify the acquirer and card brands under PCI-DSS as soon as possible, while preserving evidence.
   • BNotify the card brands first because PCI-DSS has a stricter timeline than GDPR, and delay GDPR notification until the forensic investigation is complete.
   • CNotify the supervisory authority and the card brands only after the incident is fully contained, to avoid revealing sensitive information.
   • DNotify affected individuals first because GDPR requires individual notification within 24 hours, and then notify the card brands.
   Reveal Solution Discussion Select an answer first