Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An EU-based online retailer is subject to GDPR. The security team is configuring network monitoring and incident response. Which practice is most directly required by GDPR?

   • AConducting annual security awareness training for all employees
   • BNotifying the supervisory authority within 72 hours of becoming aware of a personal data breach
   • CInstalling antivirus software on all servers
   • DPerforming weekly backups of all databases
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A retail company that accepts credit cards is implementing network security controls. Which requirement is directly imposed by PCI DSS?

   • AAppointing a Data Protection Officer (DPO)
   • BConducting a data protection impact assessment (DPIA) for every new system
   • CPerforming background checks on all employees annually
   • DEncrypting cardholder data during transmission over open, public networks
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A hospital is subject to HIPAA and also processes credit card payments for patient copays. The network team is designing a new network segment for the payment system. The compliance officer wants to minimize the scope of PCI DSS while maintaining HIPAA compliance. Which design best achieves this?

   • APlace the payment system in a separate VLAN with strict firewall rules and no access to ePHI systems
   • BIntegrate the payment system into the hospital's main network to simplify management
   • CUse the same servers for ePHI and payment processing to reduce hardware costs
   • DOutsource payment processing to a third party and ignore PCI DSS
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A US-based software company has no healthcare or financial operations but collects personal data from users in California. Which regulatory framework is most likely to apply to the company's data handling practices?

   • ASOX
   • BCCPA
   • CPCI DSS
   • DHIPAA
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial institution is implementing network access controls to comply with both SOX and PCI DSS. Which control best satisfies both frameworks' requirements?

   • AUsing shared accounts for all employees to simplify administration
   • BImplementing role-based access control with unique user IDs and periodic access reviews
   • CDisabling audit logging to reduce storage costs
   • DGranting all employees full access to all systems to improve efficiency
   Reveal Solution Discussion Select an answer first