CSC Cybersecurity Regulations & Legal Frameworks 3

Question 1

A healthcare organization shares patient billing data with a third-party payment processor. Under HIPAA, the payment processor is classified as a:

Accepted Answer

Business associate

Answer

A third party that performs functions involving PHI on behalf of a covered entity is classified as a business associate and must sign a Business Associate Agreement (BAA).

Question 2

SOX Section 404 specifically requires management and external auditors to report on the effectiveness of:

Accepted Answer

Internal controls over financial reporting

Answer

SOX Section 404 mandates that management assess and auditors attest to the effectiveness of internal controls over financial reporting (ICFR).

Question 3

Which GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Accepted Answer

Purpose limitation

Answer

The purpose limitation principle under GDPR Article 5(1)(b) states that personal data must be collected for specified, explicit, and legitimate purposes only.

Question 4

Under PCI DSS, which entities are required to undergo an annual on-site assessment by a Qualified Security Assessor (QSA)?

Accepted Answer

Level 1 merchants processing over 6 million transactions annually

Answer

PCI DSS Level 1 merchants, those processing more than 6 million card transactions per year, are required to undergo annual on-site QSA assessments.

Question 5

The Computer Fraud and Abuse Act (CFAA) defines 'protected computer' as:

Accepted Answer

Any computer used in or affecting interstate commerce or communication

Answer

The CFAA defines 'protected computer' broadly to include any computer used in or affecting interstate or foreign commerce or communication, covering virtually all internet-connected systems.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Cybersecurity Regulations & Legal Frameworks 3