Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Under the GDPR, when is a Data Protection Impact Assessment (DPIA) required?

   • AWhen the organization is a data processor
   • BWhen processing is likely to result in a high risk to the rights and freedoms of individuals
   • CWhen the organization has more than 250 employees
   • DWhen processing involves any personal data of EU residents
   Reveal Solution Discussion Select an answer first
2. 7expert · hard · select all that apply

   An EU resident submits a request to a social media platform to delete all personal data the platform has collected about them. The platform uses the data for targeted advertising and also shares it with third-party data brokers. Under GDPR, which of the following actions must the platform take? (Select all that apply.)

   • ADelete the individual's personal data without undue delay.
   • BInform third-party data brokers that the individual has requested erasure of their data.
   • CProvide the individual with a copy of all personal data in a machine-readable format.
   • DNotify the supervisory authority of the erasure request.
   • ERestrict processing of the individual's data until the erasure request is fully processed.
   Check answers Discussion Select an answer first
4. 8foundation · easy

   Under the HIPAA Security Rule, which of the following is a technical safeguard?

   • AProviding workstation security policies
   • BAssigning a security official
   • CImplementing unique user identification for accessing ePHI
   • DConducting a risk analysis
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of the Health Insurance Portability and Accountability Act (HIPAA)?

   • ATo standardize the electronic health record (EHR) software used by hospitals
   • BTo protect the privacy and security of individuals' health information
   • CTo regulate the cost of health insurance premiums for all Americans
   • DTo ensure that all healthcare providers accept the same insurance plans
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An EU data subject requests that a social media platform rectify inaccurate personal data. The platform believes the data is accurate and refuses the request. The data subject then files a complaint with the supervisory authority. What is the supervisory authority likely to do?

   • AInvestigate the complaint and, if the platform's refusal is unjustified, order the platform to rectify the data.
   • BImmediately fine the platform for failing to rectify the data.
   • CDismiss the complaint because the platform has the right to refuse requests it believes are inaccurate.
   • DRequire the data subject to take the platform to court before the authority can act.
   Reveal Solution Discussion Select an answer first