Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which office within the U.S. Department of Education is responsible for enforcing FERPA and handling complaints related to education record privacy?

   • AOffice for Civil Rights (OCR)
   • BFamily Policy Compliance Office (FPCO)
   • CFederal Trade Commission (FTC)
   • DNational Institute of Standards and Technology (NIST)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small healthcare clinic that also processes credit card payments for patient co-pays discovers a breach that exposed both PHI and cardholder data. The clinic is subject to both HIPAA and PCI-DSS. What is the clinic's primary challenge in incident handling?

   • ACoordinating the different notification requirements and timelines of HIPAA and PCI-DSS, while preserving evidence for both investigations.
   • BEnsuring that the incident response plan is approved by the Department of Health and Human Services before any notification is made.
   • CDeciding whether to notify the supervisory authority under GDPR, because the clinic may have EU patients.
   • DDetermining which framework takes precedence, because HIPAA overrides PCI-DSS when PHI is involved.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A global online retailer that stores EU customer data and processes credit card payments discovers a breach that exposed both personal data and cardholder data. The incident response team has confirmed the breach and is planning notifications. Which approach best satisfies both GDPR and PCI-DSS obligations?

   • ANotify the card brands first because PCI-DSS has stricter timelines, then notify the GDPR supervisory authority within 72 hours.
   • BNotify affected individuals within 72 hours to satisfy both GDPR and PCI-DSS, and skip the supervisory authority notification.
   • CWait for the forensic investigation to complete before making any notifications to avoid conflicting reports.
   • DNotify the GDPR supervisory authority within 72 hours, and notify the acquiring bank and card brands as soon as possible, while also assessing whether individual notifications are required.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mid-sized retailer that accepts credit cards discovers that malware on its point-of-sale (POS) system may have captured cardholder data. The retailer's incident response plan is outdated and does not mention PCI-DSS. Which action is most directly required by PCI-DSS in this situation?

   • ANotify the acquiring bank and the card brands as soon as possible, and begin a forensic investigation to determine the scope of the compromise.
   • BNotify affected cardholders within 72 hours, as required by PCI-DSS.
   • CWait for the card brands to contact the retailer after they detect fraudulent transactions.
   • DSubmit a written report to the PCI Security Standards Council within 30 days.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A small business that accepts credit cards discovers that a third-party vendor that processes their card payments was breached. The vendor confirms that the business's customers' card data may have been exposed. The business does not store card data itself. Which PCI-DSS obligation applies to the business?

   • AThe business must notify affected customers within 72 hours, because the vendor is not a PCI-DSS compliant entity.
   • BThe business must still report the compromise to its acquiring bank and card brands, because the breach affects its customers' card data, even if the data was stored by the vendor.
   • CThe business has no obligation because the vendor is responsible for all PCI-DSS compliance and reporting.
   • DThe business must notify the PCI Security Standards Council directly, because the vendor is not a PCI-DSS compliant entity.
   Reveal Solution Discussion Select an answer first