Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital is considering sharing patient health information with a local public health agency to support a disease surveillance program. The hospital wants to ensure compliance with the HIPAA Privacy Rule. Which condition must be met for this disclosure to be permitted?

   • AThe disclosure must be for public health activities, such as disease surveillance, as permitted by HIPAA.
   • BThe hospital must sign a business associate agreement with the public health agency.
   • CThe hospital must de-identify the data before sharing it with the public health agency.
   • DThe hospital must obtain written authorization from each patient before disclosing PHI.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large retailer is preparing for its annual PCI DSS assessment. The security team has implemented strong access controls, encryption, and monitoring, but the assessor identifies a gap: the company does not have a formal process for regularly testing security systems and processes. Which PCI DSS requirement is the company failing to meet?

   • ARequirement 12: Maintain a policy that addresses information security for all personnel.
   • BRequirement 11: Regularly test security systems and processes.
   • CRequirement 10: Track and monitor all access to network resources and cardholder data.
   • DRequirement 6: Develop and maintain secure systems and applications.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A European bank is planning to launch a new mobile app that will process biometric data (fingerprint scans) from EU customers for authentication. The bank's data protection officer (DPO) is concerned about the high-risk nature of this processing. Under GDPR, what must the bank do before proceeding with the processing of biometric data?

   • AObtain approval from the supervisory authority before processing any biometric data.
   • BConduct a Data Protection Impact Assessment (DPIA) because the processing involves biometric data, which is considered high risk.
   • CObtain explicit consent from each customer before processing biometric data.
   • DAppoint a Data Protection Officer (DPO) before proceeding.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A European e-commerce company processes credit card payments and also collects personal data of its customers. Which compliance standards are most likely applicable to its operations?

   • AGDPR and HIPAA
   • BPCI DSS and GDPR
   • CHIPAA and PCI DSS
   • DPCI DSS only
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A merchant's web application accepts credit card payments and stores cardholder data in a database. During a PCI DSS assessment, the assessor finds that the application is vulnerable to SQL injection attacks. Which PCI DSS requirement is the merchant failing to meet?

   • ARequirement 6: Develop and maintain secure systems and applications.
   • BRequirement 8: Identify and authenticate access to system components.
   • CRequirement 3: Protect stored cardholder data.
   • DRequirement 11: Regularly test security systems and processes.
   Reveal Solution Discussion Select an answer first