Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A US-based healthcare provider stores electronic protected health information (ePHI) in a cloud environment and transmits it between two clinics. The security team is defining access controls and audit logging requirements. Which regulatory framework directly imposes the most specific requirements for protecting ePHI in this scenario?

   • AHIPAA
   • BPCI DSS
   • CGDPR
   • DSOX
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A publicly traded company must comply with SOX. The IT department is reviewing network access to financial systems. Which control is most directly required by SOX?

   • AUse a single shared account for all financial system users
   • BAllow administrators to modify financial records without logging
   • CImplement audit trails that log access to financial systems
   • DDisable password expiration to reduce help desk calls
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company that operates in California and handles the personal information of California residents must comply with CCPA. The network defense team is updating the data inventory. Which requirement is unique to CCPA compared to GDPR?

   • AConduct a Data Protection Impact Assessment (DPIA)
   • BProvide a 'Do Not Sell My Personal Information' opt-out link
   • CReport data breaches within 72 hours
   • DAppoint a Data Protection Officer (DPO)
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A global e-commerce company processes EU customer data, accepts credit cards, and has a subsidiary that handles health-related products. The compliance team must implement a unified data protection program. Which approach best addresses the overlapping requirements of GDPR, PCI DSS, and HIPAA?

   • AImplement a defense-in-depth strategy with encryption, access controls, and data minimization, and map controls to each framework
   • BCreate separate, isolated networks for each data type and apply only the relevant framework to each
   • CComply only with PCI DSS because it is the most prescriptive
   • DComply only with GDPR because it is the most comprehensive
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company that stores credit card data is implementing a data retention policy. The compliance team notes that PCI DSS requires limiting retention of cardholder data. Which action aligns with PCI DSS?

   • AKeep all cardholder data indefinitely for potential fraud investigations
   • BRetain cardholder data only as long as needed for business or legal purposes, then securely delete it
   • CArchive cardholder data on backup tapes without encryption
   • DStore cardholder data in plain text to simplify access
   Reveal Solution Discussion Select an answer first