Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Under FERPA, when a security breach involves education records, what is the primary obligation of the educational institution?

   • ANotify the local media within 72 hours
   • BNotify parents and eligible students of the breach
   • CReport the breach to the state attorney general
   • DReport the breach to the Department of Homeland Security
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When an incident is subject to multiple compliance frameworks with conflicting notification requirements, what is the best approach?

   • AChoose the framework that is easiest to comply with
   • BFollow the most stringent requirement that is legally applicable
   • CNotify only the regulatory authority that has the highest fines
   • DIgnore all frameworks until a formal investigation begins
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational e-commerce company stores EU customer personal data in an Azure region in Ireland. During a routine security review, you discover that an attacker exfiltrated a database containing EU customer email addresses and order histories. The breach was detected on a Friday afternoon. What is the most immediate compliance-driven action your incident response team must take?

   • ANotify the card brands immediately because the database contains order histories that may include payment card data.
   • BNotify each affected EU customer within 72 hours of discovery, regardless of the risk level, to avoid penalties.
   • CNotify the Irish Data Protection Commission within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.
   • DWait until the investigation is complete to determine whether any notification is required, since premature notification could cause unnecessary panic.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Under the GDPR, a data controller must notify the relevant supervisory authority of a personal data breach. What is the maximum time allowed for this notification after becoming aware of the breach?

   • A24 hours
   • B7 days
   • C72 hours
   • D30 days
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An organization is subject to both GDPR and PCI-DSS. During an incident involving personal data and cardholder data, what should the organization do first?

   • ANotify the affected individuals first, regardless of other requirements
   • BNotify the card brands immediately, ignoring GDPR requirements
   • CIdentify all applicable requirements and prioritize the most urgent notifications
   • DWait for legal counsel to decide before taking any action
   Reveal Solution Discussion Select an answer first