A U.S.-based healthcare provider stores electronic protected health information (ePHI) in a public cloud. The provider's compliance officer wants to ensure the cloud configuration meets the minimum security requirements mandated by U.S. law. Which action is most directly required by the applicable regulation?

Implement administrative, physical, and technical safeguards for ePHI, including encryption and access controls.

Obtain explicit opt-in consent from every patient before storing any health data in the cloud.

Restrict all ePHI storage to on-premises servers to avoid cloud-specific risks.

Ensure the cloud provider is certified under ISO/IEC 27001 before transferring any ePHI.

A security analyst discovers that a former employee still has access to the company's cloud storage. The analyst also finds that the former employee downloaded sensitive customer data before leaving. The company is subject to GDPR. What is the most urgent action?

Change all passwords but do not investigate the data download.

Contact the former employee and ask them to delete the data.

Revoke the former employee's access immediately and assess whether the data breach must be reported to the supervisory authority.

Ignore the incident because the employee was authorized before leaving.

A government contractor must align its security program with a widely used U.S. federal framework that provides a common language for managing cybersecurity risk. Which framework is the contractor most likely to adopt?

NIST Cybersecurity Framework (CSF)

What is the primary ethical obligation of an ethical hacker when conducting a penetration test?

Use the same tools as malicious hackers to ensure realism

Obtain explicit written authorization before testing

Report all vulnerabilities to the public immediately

Ensure the test causes no disruption to business operations

EC-CouncilEthical Hacking Essentials

Domain 1Objective 4

Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 9)

Part of the Information Security and Ethical Hacking Foundations domain, which makes up ~16% of our current practice bank.

46questions here

10free pages

4concepts

Questions 41–45

41application · medium
A U.S.-based healthcare provider stores electronic protected health information (ePHI) in a public cloud. The provider's compliance officer wants to ensure the cloud configuration meets the minimum security requirements mandated by U.S. law. Which action is most directly required by the applicable regulation?
Select an answer first
42expert · hard
A security analyst discovers that a former employee still has access to the company's cloud storage. The analyst also finds that the former employee downloaded sensitive customer data before leaving. The company is subject to GDPR. What is the most urgent action?
Select an answer first
43application · medium
A government contractor must align its security program with a widely used U.S. federal framework that provides a common language for managing cybersecurity risk. Which framework is the contractor most likely to adopt?
Select an answer first
44foundation · easy
Which regulation applies to organizations that handle cardholder data and requires them to maintain a secure network, protect cardholder data, and implement access control measures?
Select an answer first
45foundation · easy
What is the primary ethical obligation of an ethical hacker when conducting a penetration test?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 9)

Questions 41–45

A security analyst discovers that a former employee still has access to the company's cloud storage. The analyst also finds that the former employee downloaded sensitive customer data before leaving. The company is subject to GDPR. What is the most urgent action?

A government contractor must align its security program with a widely used U.S. federal framework that provides a common language for managing cybersecurity risk. Which framework is the contractor most likely to adopt?

Which regulation applies to organizations that handle cardholder data and requires them to maintain a secure network, protect cardholder data, and implement access control measures?

What is the primary ethical obligation of an ethical hacker when conducting a penetration test?

Keep studying — Information Security and Ethical Hacking Foundations