CSC Regulatory Compliance & Legal Aspects 2

Question 1

Under HIPAA, what is the maximum annual civil penalty for violations in the 'willful neglect – not corrected' category?

Accepted Answer

$1,919,173

Answer

HHS adjusts HIPAA civil monetary penalties annually for inflation; the 2023 cap for willful neglect not corrected is $1,919,173 per violation category per year.

Question 2

Which legal doctrine holds that an organization must demonstrate it exercised reasonable care in protecting sensitive data to avoid negligence liability?

Accepted Answer

Duty of care

Answer

Duty of care requires organizations to take reasonable precautions to protect data; failure to meet this standard can establish negligence.

Question 3

The EU-US Data Privacy Framework (DPF) replaced which prior agreement that was invalidated by the Schrems II ruling?

Accepted Answer

Privacy Shield

Answer

The Court of Justice of the EU invalidated Privacy Shield in July 2020 (Schrems II); the DPF was adopted in 2023 as the replacement mechanism.

Question 4

A security consultant discovers that a client's retail POS system stores full PAN data after authorization. Which PCI DSS requirement is most directly violated?

Accepted Answer

Requirement 3 – Protect stored cardholder data

Answer

PCI DSS Requirement 3 prohibits storing sensitive authentication data (including full magnetic-stripe data) post-authorization.

Question 5

Which federal law specifically governs the export of cybersecurity tools and intrusion software under US export control regulations?

Accepted Answer

EAR / ECCN 4E001

Answer

The Export Administration Regulations (EAR) classify many cybersecurity tools under ECCN 4E001, requiring a license for export to controlled countries.

(CSC) Certified Security Consultant Practice Test

(CSC) Certified Security Consultant Practice Test

CSC Regulatory Compliance & Legal Aspects 2