Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   Which of the following GDPR violations would likely result in the lower tier of fines (up to €10 million or 2% of global annual turnover)?

   • ATransferring personal data to a non-EU country without safeguards
   • BFailing to maintain proper records of processing activities
   • CProcessing personal data without a legal basis
   • DViolating data subject rights, such as the right to erasure
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A healthcare organization operates a patient portal that allows patients to pay their medical bills online using credit cards. The portal stores both payment card data and patients' medical records. The organization is subject to both HIPAA and PCI DSS. Which statement accurately describes how the organization should approach compliance?

   • AThe organization only needs to comply with HIPAA because it is a healthcare provider.
   • BThe organization can choose to comply with either standard, as they are mutually exclusive.
   • CThe organization must comply with both HIPAA and PCI DSS because the portal handles both PHI and cardholder data.
   • DThe organization only needs to comply with PCI DSS because the portal processes payments.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An EU citizen discovers that a social media platform is processing their personal data for targeted advertising without their consent. The individual wants to prevent the platform from using their data for this purpose. Which GDPR right is the individual exercising?

   • ARight to object to processing.
   • BRight to erasure.
   • CRight to rectification.
   • DRight to data portability.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A regional healthcare clinic processes credit card payments for patient co-pays and also stores electronic health records (EHRs) that include patient names and diagnoses. The clinic wants to ensure it meets the applicable compliance requirements for both types of data. Which combination of standards must the clinic address?

   • AHIPAA only, because the clinic is a healthcare provider and patient data is more sensitive than card data.
   • BPCI DSS only, because the clinic processes card payments and the EHRs are not transmitted electronically.
   • CGDPR, because patient diagnoses are personal data and the clinic must protect the privacy of all individuals.
   • DBoth PCI DSS and HIPAA, because the clinic handles cardholder data and protected health information.
   Reveal Solution Discussion Select an answer first