CCP Compliance, Legal, & Ethical Issues 3

Question 1

The EU-US Data Privacy Framework replaced which previous mechanism that was invalidated by the Schrems II ruling?

Accepted Answer

Privacy Shield

Answer

The EU-US Privacy Shield was invalidated by the Court of Justice of the EU in the Schrems II decision due to US surveillance law concerns.

Question 2

Under HIPAA, a covered entity discovers a breach affecting 600 individuals. What is the notification deadline to the Secretary of HHS?

Accepted Answer

Within 60 days of year-end, or immediately if over 500

Answer

Breaches affecting 500+ individuals in a state must be reported to HHS within 60 days of discovery; smaller breaches are reported in annual logs within 60 days of year-end.

Question 3

Which concept in cybersecurity law holds that an organization may be liable for failing to implement reasonable security measures even without a specific breach occurring?

Accepted Answer

Negligence

Answer

Negligence in cybersecurity law means failing to exercise reasonable care in protecting systems and data, which can establish liability independent of an actual breach.

Question 4

A company collects children's data through a mobile app. Which US federal law imposes parental consent requirements?

Accepted Answer

COPPA

Answer

The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information from children under 13.

Question 5

Which PCI DSS requirement specifically addresses the protection of stored cardholder data?

Accepted Answer

Requirement 3 – Protect stored cardholder data

Answer

PCI DSS Requirement 3 mandates that organizations protect stored cardholder data through encryption, masking, and data minimization practices.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Compliance, Legal, & Ethical Issues 3