CSS Risk Management & Compliance 3

Question 1

The EU General Data Protection Regulation (GDPR) requires organizations to report a personal data breach to the relevant supervisory authority within what timeframe?

Accepted Answer

72 hours

Answer

GDPR Article 33 mandates that controllers notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible.

Question 2

A senior specialist implements data masking on production database exports used for testing. This control is BEST described as which type?

Accepted Answer

Preventive control

Answer

Data masking is a preventive control because it proactively reduces exposure of sensitive data before unauthorized access can occur.

Question 3

Which compliance framework is specifically designed for payment card data security and applies to all entities that store, process, or transmit cardholder data?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) mandates security requirements for any organization involved in payment card processing.

Question 4

In enterprise risk management, 'inherent risk' is BEST defined as:

Accepted Answer

Risk existing before any controls are implemented

Answer

Inherent risk is the level of risk present in the absence of any controls or mitigation measures.

Question 5

A healthcare organization must conduct a Security Risk Analysis under which federal regulation?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule (45 CFR § 164.308(a)(1)) requires covered entities and business associates to conduct an accurate and thorough Security Risk Analysis.

(CSS) Certified Senior Specialist Practice Test

(CSS) Certified Senior Specialist Practice Test

CSS Risk Management & Compliance 3