Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital's incident response team is handling a ransomware attack that encrypted patient records. The hospital is subject to HIPAA. During the containment phase, the team wants to immediately wipe and reimage the affected servers to restore operations quickly. What should the team do first?

   • AWipe and reimage the servers immediately to contain the ransomware and restore patient care, because HIPAA prioritizes availability over evidence preservation.
   • BNotify the Secretary of HHS before taking any containment action, because HIPAA requires notification within 24 hours of a ransomware attack.
   • CPreserve forensic evidence from the affected servers before wiping them, because HIPAA and other frameworks require evidence preservation for investigations and notifications.
   • DDisconnect the servers from the network and then wipe them, because disconnecting is sufficient for evidence preservation.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A healthcare provider discovers that a former employee accessed the medical records of 600 patients without authorization over the past month. The provider's security team has confirmed the unauthorized access. Under HIPAA, which notification obligations apply?

   • ANotify the Secretary of HHS within 60 days and notify the media only if the breach involves more than 1,000 patients.
   • BNotify affected individuals within 72 hours and notify the Secretary of HHS within 10 business days.
   • CNotify affected individuals and the Secretary of HHS only if the breach involves more than 500 patients.
   • DNotify affected individuals without unreasonable delay, notify the Secretary of HHS within 60 days, and notify the media if more than 500 residents of a state or jurisdiction are affected.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which organization provides the detailed guidelines that federal agencies follow for incident reporting and handling under FISMA?

   • AInternational Organization for Standardization (ISO)
   • BInternet Engineering Task Force (IETF)
   • CNational Institute of Standards and Technology (NIST)
   • DAmerican National Standards Institute (ANSI)
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A university that receives federal funding discovers that a phishing attack compromised the email accounts of several faculty members, which contained student education records. The university's incident response team is determining its notification obligations. Which framework is most directly applicable?

   • AHIPAA, because the university receives federal funding and the email accounts may contain health information.
   • BFERPA, because the incident involves education records, and the university must notify affected students and their parents if they are dependents.
   • CPCI-DSS, because the university processes financial aid payments.
   • DFISMA, because the university receives federal funding and must report to US-CERT.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A healthcare provider that also processes credit card payments for patient co-pays discovers a breach that exposed both PHI and cardholder data. The provider is subject to both HIPAA and PCI-DSS. The provider's incident response team is planning the notification process. What is the best approach?

   • ANotify affected individuals and the Secretary of HHS under HIPAA within 60 days, and notify the acquirer and card brands under PCI-DSS as soon as possible, while preserving evidence.
   • BNotify the Secretary of HHS within 24 hours because the breach involves PHI, and notify the card brands within 72 hours.
   • CNotify affected individuals within 72 hours because the breach involves PHI, and notify the card brands within 10 days.
   • DNotify the card brands first because PCI-DSS has a stricter timeline than HIPAA, and delay HIPAA notification until the forensic investigation is complete.
   Reveal Solution Discussion Select an answer first