5.9 Identify Protected Data in a Network 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A hospital is implementing a new patient monitoring system that transmits heart rate data to a cloud analytics platform. The hospital must comply with HIPAA. Which control is most critical to implement?

   • AEncrypt the data in transit and at rest
   • BEnsure the data is not stored on-premises
   • CUse a public cloud provider without a BAA
   • DAllow all clinicians to access the data for efficiency
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A healthcare organization is merging with another hospital. The combined entity will have access to a large dataset of patient records from both organizations. The security team must ensure that the merged dataset complies with HIPAA. What is the most important step?

   • ANotify all patients of the merger and obtain consent for the data sharing.
   • BCombine the datasets into a single database and grant all staff access to improve patient care.
   • CConduct a risk assessment and implement safeguards such as encryption and access controls for the merged dataset.
   • DDelete all patient records that are not directly needed for ongoing treatment.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A clinic's network administrator is designing a backup solution. The backups contain patient treatment records. Which regulation must the administrator consider when storing these backups?

   • APCI DSS
   • BGDPR
   • CSOX
   • DHIPAA
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A hospital is considering using a cloud-based email service to send patient appointment reminders. The emails will include patient names and appointment details. Which action is required to comply with HIPAA?

   • AEncrypt the emails but do not sign a BAA
   • BSign a business associate agreement (BAA) with the cloud provider
   • CUse a public email service without any additional controls
   • DEnsure the emails are sent only during business hours
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A financial services company is subject to both GDPR and CCPA because it operates in the EU and California. The company collects customer data that includes names, email addresses, and transaction history. The security team must design a data retention policy that complies with both regulations. What is the most important consideration?

   • ARetain the data indefinitely to ensure compliance with both regulations.
   • BDelete the data immediately after collection to avoid any compliance obligations.
   • CStore the data in a country with no data protection laws to avoid compliance.
   • DImplement a retention schedule that deletes data when it is no longer needed for the purpose for which it was collected.
   Reveal Solution Discussion Select an answer first