Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following best describes the extraterritorial scope of the GDPR?

   • AIt applies to any organization that processes data of any person worldwide
   • BIt applies to organizations outside the EU if they process personal data of EU residents in connection with offering goods or services or monitoring their behavior
   • CIt applies only to organizations physically located within the European Union
   • DIt applies only to government organizations within the EU
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A covered entity experiences a breach of unsecured PHI affecting 300 individuals. The entity conducts a risk assessment and determines that there is a low probability that the PHI was compromised. What is the entity's obligation under the HIPAA Breach Notification Rule?

   • ANotify affected individuals within 60 days, but not HHS, because the breach affected fewer than 500 individuals.
   • BNotify affected individuals and HHS because the breach affected more than 200 individuals.
   • CNotify HHS within 60 days, but not affected individuals, because the breach affected fewer than 500 individuals.
   • DDocument the risk assessment and, if it concludes low probability of compromise, no notification is required.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Under the GDPR, which of the following organizations is required to designate a Data Protection Officer (DPO)?

   • AA hospital that processes large-scale health data of patients
   • BA company that processes data of 100 employees for payroll
   • CA small bakery that keeps a list of customer names for delivery
   • DA startup that processes email addresses for a newsletter
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following best describes the primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?

   • ATo standardize the format of credit card numbers across all payment networks
   • BTo ensure that organizations that store, process, or transmit cardholder data maintain a secure environment to protect that data
   • CTo provide a legal framework for consumers to dispute unauthorized credit card charges
   • DTo regulate the interest rates that financial institutions can charge on credit card transactions
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   A US-based healthcare provider stores patient medical records electronically. Which compliance standard is most directly applicable to the protection of this data?

   • AHIPAA
   • BSOX
   • CGDPR
   • DPCI DSS
   Reveal Solution Discussion Select an answer first