Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A multinational corporation with headquarters in the US processes personal data of EU residents for its HR operations. The company does not have an establishment in the EU but offers services to EU customers. The company's data protection officer (DPO) is reviewing GDPR compliance obligations. Which obligation is most likely to apply to this company?

   • AThe company is exempt from GDPR because it is based in the US.
   • BThe company must obtain a data protection impact assessment (DPIA) for all processing activities.
   • CThe company must appoint a representative in the EU.
   • DThe company must transfer all EU data to a data center within the EU.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A covered entity discovers that an unencrypted laptop containing the electronic protected health information (ePHI) of 800 patients was stolen from an employee's car. The entity has not yet determined whether the data was actually accessed. Under the HIPAA Breach Notification Rule, what is the entity's immediate obligation?

   • ANotify local media outlets immediately because the breach affects more than 500 individuals.
   • BNotify affected individuals within 60 days of discovery of the breach.
   • CNotify the Department of Health and Human Services (HHS) within 10 days of discovery.
   • DConduct a risk assessment to determine if there is a low probability that PHI was compromised.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A multinational healthcare technology company develops a mobile app that allows EU patients to schedule appointments and pay for services using credit cards. The app stores patient health records, payment card data, and EU residents' personal data. The company is based in the US and has no EU establishment. The security team is tasked with identifying the applicable compliance frameworks. Which set of standards must the company address?

   • APCI DSS and GDPR only, because HIPAA only applies to US-based healthcare providers.
   • BHIPAA, PCI DSS, and GDPR, because the app handles PHI, cardholder data, and EU personal data.
   • CGDPR only, because the app is primarily for EU patients and does not involve US healthcare operations.
   • DHIPAA and PCI DSS only, because the company is based in the US and GDPR does not apply.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an administrative safeguard required by the HIPAA Security Rule?

   • AInstalling physical locks on server room doors
   • BImplementing a security awareness and training program for workforce members
   • CImplementing audit controls to record access to ePHI
   • DUsing encryption to protect ePHI in transit
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which GDPR data subject right allows an individual to request that their personal data be deleted?

   • ARight to rectification
   • BRight to erasure ('right to be forgotten')
   • CRight to restrict processing
   • DRight to data portability
   Reveal Solution Discussion Select an answer first