Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A regional hospital discovers that an unencrypted laptop containing the protected health information (PHI) of 400 patients was stolen from a physician's car. The hospital's security team has confirmed that the data was not encrypted and there is no evidence of actual access or use. Under HIPAA, what must the hospital do?

   • ANotify the local media within 60 days because the breach involves more than 500 patients.
   • BReport the incident to the FBI and the Federal Trade Commission because the laptop was stolen.
   • CConduct a risk assessment to determine the probability that PHI was compromised, and if the risk is low, no notification is required.
   • DNotify the Secretary of HHS within 60 days and affected individuals without unreasonable delay, regardless of the risk assessment.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   During the post-incident activity phase, what do compliance frameworks often require organizations to do?

   • ADocument the incident and preserve evidence for potential audits or investigations
   • BDelete all logs related to the incident to protect privacy
   • CImmediately resume normal operations without review
   • DNotify all employees of the incident, regardless of role
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A U.S.-based e-commerce company that sells to EU customers detects a breach of its customer database. The database contains names, email addresses, and payment card numbers of EU residents. The company's legal team confirms GDPR applies. The breach was discovered on a Monday at 10:00 AM, and the company completes its initial assessment by Tuesday at 2:00 PM. What is the company's most immediate compliance obligation under GDPR?

   • AWait until the full forensic investigation is complete before notifying any authority to ensure the notification contains accurate details.
   • BNotify the relevant supervisory authority within 72 hours of discovery unless the breach is unlikely to result in a risk to individuals' rights and freedoms.
   • CNotify all affected EU customers immediately via email, regardless of the risk level, because GDPR mandates individual notification for any breach involving personal data.
   • DNotify the payment card brands within 24 hours because the database contains payment card numbers, and PCI-DSS has a stricter timeline than GDPR.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A merchant discovers that a hacker inserted malicious code into its e-commerce website that captured credit card numbers during checkout. The merchant's incident response plan does not include specific steps for PCI-DSS compliance. What should the merchant do first?

   • ANotify the PCI Security Standards Council immediately to report the compromise.
   • BNotify affected customers within 72 hours because the breach involves cardholder data.
   • CWait for the acquiring bank to contact the merchant after they detect fraudulent transactions.
   • DActivate the incident response plan, contain the breach, and notify the acquiring bank and card brands as soon as possible.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company that provides cloud-based software to school districts and also processes credit card payments for its services discovers a breach that affects student education records and cardholder data. The company's legal team asks which compliance frameworks are likely to apply. Which combination is correct?

   • AGDPR and HIPAA, because the company processes student data and payments.
   • BFERPA and PCI-DSS, because the breach involves education records and cardholder data.
   • CHIPAA and FISMA, because the company provides cloud services and processes payments.
   • DPCI-DSS and FISMA, because the company processes payments and provides cloud services.
   Reveal Solution Discussion Select an answer first