Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a common compliance requirement imposed by PCI DSS on organizations that handle cardholder data?

   • APerforming annual penetration testing and quarterly network scans
   • BConducting background checks on all employees annually
   • CEncrypting all data stored on any server in the organization
   • DImplementing multi-factor authentication for all system users
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company subject to GDPR wants to use a US-based cloud provider for data storage. The provider offers encryption and access controls. Which additional measure is necessary to ensure GDPR-compliant data transfers?

   • AObtaining explicit consent from each data subject for the transfer
   • BStoring all data in the EU to avoid transfer issues
   • CRelying solely on the provider's encryption and access controls
   • DImplementing Standard Contractual Clauses (SCCs) or another valid transfer mechanism
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital is implementing a new patient portal that allows patients to access their health records online. Which HIPAA requirement is most directly relevant to this system?

   • AObtaining written consent from patients before every portal login
   • BEnsuring that all patient data is stored on-premises
   • CDeleting patient records after 30 days of inactivity
   • DProviding patients with access to their health records upon request
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial institution subject to PCI DSS is designing its network segmentation strategy to reduce the scope of compliance. Which network defense practice directly supports this compliance objective?

   • AEncrypting all data at rest using AES-256
   • BDeploying an intrusion detection system on every internal subnet
   • CImplementing firewall rules to isolate the cardholder data environment (CDE) from the rest of the network
   • DConducting quarterly vulnerability scans of all network devices
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital is subject to HIPAA and is implementing network access controls. The security administrator must ensure that only authorized personnel can access ePHI. Which control is most directly aligned with HIPAA's Security Rule?

   • ADisable logging to reduce storage costs
   • BUse shared accounts for all staff
   • CAllow all employees to access ePHI to improve efficiency
   • DImplement role-based access control (RBAC) to limit ePHI access to job-necessary roles
   Reveal Solution Discussion Select an answer first