The Impact of Regulations on Security Regulations CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which regulation is specifically focused on the protection of personal data of individuals within the European Union and has direct implications for security testing of systems that process such data?

   • ASOX
   • BGLBA
   • CHIPAA
   • DGDPR
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a risk-based testing approach, how do regulatory requirements typically influence the prioritization of security tests?

   • AThey require that all tests be prioritized solely by technical severity.
   • BThey decrease the priority of tests that are not explicitly required by regulations.
   • CThey require that all tests be prioritized solely by business impact.
   • DThey increase the priority of tests that address compliance-mandated controls.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A security test team is testing a new feature for a healthcare application that will allow patients to access their medical records online. The application must comply with HIPAA and the team must also consider the GDPR if the application is used by EU patients. The team has limited time and must decide which compliance requirements to test first. Which approach is most appropriate?

   • APrioritize testing of GDPR requirements because it is more comprehensive than HIPAA.
   • BPrioritize testing of HIPAA requirements because the application is primarily for US patients.
   • CTest only the requirements that are most likely to be audited by regulators.
   • DTest both HIPAA and GDPR requirements, but focus on the areas where the regulations overlap, such as data access controls and breach notification.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A security test team is testing a new feature that allows users to download their personal data from a cloud service. The service is used by customers in the EU and the US. The team must ensure GDPR compliance for EU users. The test lead wants to use real user data to test the export function. Which approach is most compliant?

   • AUse synthetic data that mimics the structure of personal data, and verify the export format and completeness.
   • BUse real user data from EU customers, but anonymize it before testing.
   • CUse real user data from US customers only, since GDPR does not apply to them.
   • DUse real user data from EU customers, but only after obtaining explicit consent from each user.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice is essential when handling personal data during security testing to comply with privacy regulations?

   • AStoring personal data in unencrypted files for easy access during testing.
   • BLimiting access to personal data to only those testers who need it for their tasks.
   • CUsing production data without any modification to ensure realism.
   • DEmailing personal data to all team members for review.
   Reveal Solution Discussion Select an answer first