Explain the Impact of Compliance Frameworks on Incident Handling 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   During an incident, an organization must determine which compliance frameworks apply. Which framework is primarily concerned with protecting cardholder data and is enforced by the payment card industry rather than by a government agency?

   • AHIPAA
   • BFISMA
   • CPCI-DSS
   • DGDPR
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A private college that does not receive federal funding discovers a breach of its student records system. The college's legal team is unsure whether FERPA applies. Which factor is most important in determining FERPA applicability?

   • AWhether the college has a privacy policy, because FERPA applies only to institutions that have adopted a privacy policy.
   • BWhether the college is accredited, because FERPA applies to all accredited institutions.
   • CWhether the college is a nonprofit, because FERPA applies only to nonprofit educational institutions.
   • DWhether the college receives funding from the U.S. Department of Education, because FERPA applies to educational institutions that receive such funding.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a mandatory component of PCI-DSS incident response requirements?

   • ANotifying all affected customers within 24 hours
   • BMaintaining an incident response plan and testing it at least annually
   • CDeleting all cardholder data after an incident
   • DPerforming a risk assessment for every incident
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A healthcare organization discovers a breach of unsecured PHI affecting more than 500 individuals. Under HIPAA, which of the following notifications is required in addition to notifying the affected individuals?

   • ANotification to the Federal Trade Commission
   • BNotification to the state attorney general only
   • CNotification to the Secretary of HHS and prominent media outlets
   • DNotification to the local police department
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational company that processes credit card payments and sells to EU customers discovers a breach that exposed both EU customer personal data and payment card data. The company is subject to both GDPR and PCI-DSS. The breach occurred on a Friday evening. The company's incident response team is debating the order of notifications. What is the best approach?

   • ANotify the relevant supervisory authority under GDPR within 72 hours and notify the acquirer and card brands under PCI-DSS as soon as possible, while preserving evidence.
   • BNotify the card brands first because PCI-DSS has a stricter timeline than GDPR, and delay GDPR notification until the forensic investigation is complete.
   • CNotify the supervisory authority and the card brands only after the incident is fully contained, to avoid revealing sensitive information.
   • DNotify affected individuals first because GDPR requires individual notification within 24 hours, and then notify the card brands.
   Reveal Solution Discussion Select an answer first