Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A cloud service provider hosts a multi-tenant platform for healthcare clients. To help clients meet HIPAA compliance, which control should the provider implement?

   • AEncrypting all data with a single shared key
   • BSigning Business Associate Agreements (BAAs) with each healthcare client
   • CProviding clients with administrative access to all other tenants' data
   • DAllowing clients to disable audit logging to reduce costs
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which regulatory framework is primarily focused on protecting the privacy of personal data for individuals within the European Union?

   • ASOX
   • BGDPR
   • CHIPAA
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Under the GDPR, what is a key compliance requirement for organizations that process personal data of EU residents?

   • AImplementing appropriate technical and organizational measures to protect personal data
   • BObtaining explicit consent from data subjects before processing their personal data
   • CAppointing a Data Protection Officer (DPO) in every organization regardless of size
   • DEnsuring that all personal data is stored exclusively within the European Union
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which statement correctly contrasts the applicability of SOX and GDPR?

   • ASOX is voluntary, while GDPR is mandatory
   • BSOX applies to all companies worldwide, while GDPR applies only to EU-based companies
   • CSOX focuses on data privacy, while GDPR focuses on financial reporting
   • DSOX applies to publicly traded companies in the US, while GDPR applies to organizations processing personal data of EU residents
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A multinational corporation operates in the EU, California, and the U.S. It processes personal data of EU citizens, California residents, and credit card transactions. The compliance team wants to implement a single privacy policy. Which approach best satisfies GDPR, CCPA, and PCI DSS?

   • AComply only with CCPA because it is the most recent
   • BComply only with GDPR because it is the most comprehensive
   • CAdopt the most restrictive privacy practices from each framework and apply them globally
   • DApply GDPR only to EU citizens, CCPA only to California residents, and PCI DSS only to card data
   Reveal Solution Discussion Select an answer first