Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A European e-commerce company processes customer payment card data and personal data of EU residents. The company wants to align with both GDPR and PCI DSS. Which combined requirement must the company satisfy?

   • AStore card data only on EU servers and use tokenization for all personal data.
   • BDelete all customer data after each transaction to minimize retention.
   • CObtain consent for marketing emails and encrypt cardholder data at rest and in transit.
   • DConduct an annual penetration test and appoint a Data Protection Officer (DPO).
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A global company stores customer data in multiple regions. The company receives a request from a customer in Germany to delete their personal data. The company also has a legal obligation to retain transaction records for tax purposes. How should the company respond?

   • ADelete all data immediately to comply with the GDPR request.
   • BAnonymize the data and keep it for analytical purposes.
   • CRefuse the deletion request because the company has a legal obligation to retain all data.
   • DDelete the personal data that is not subject to legal retention, and retain the transaction records as required by law.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A U.S.-based healthcare provider stores patient records in a cloud database and shares access with a third-party billing company. The provider wants to ensure that both organizations handle the data in a way that satisfies U.S. healthcare privacy rules. Which action is most directly required by the relevant regulation?

   • AAnonymize all data before storing it in the cloud
   • BRegister the cloud provider as a covered entity
   • CSign a business associate agreement with the billing company
   • DObtain explicit opt-in consent from each patient before sharing data
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small online retailer wants to improve its security posture but has limited budget and staff. The retailer is not required to comply with any specific regulation but wants a practical, risk-based approach to identify and prioritize security improvements. Which framework is most suitable?

   • ANIST Cybersecurity Framework
   • BPCI DSS full compliance
   • CHIPAA security rule
   • DISO/IEC 27001 certification
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A software developer in the United States discovers that a former employer's web application has a critical vulnerability that exposes customer data. The developer still has valid credentials to the system. Which action is most legally and ethically appropriate?

   • AIgnore the vulnerability because the developer no longer works there
   • BLog in and verify the vulnerability before reporting it
   • CNotify the former employer through a responsible disclosure channel
   • DPost the vulnerability details on a public forum to pressure the company
   Reveal Solution Discussion Select an answer first