CyberVista Test CyberVista Data Security and Privacy 2

Question 1

Under GDPR, organizations are required to report a personal data breach to the supervisory authority within:

Accepted Answer

72 hours of discovery

Answer

24 hours of discovery

Answer

48 hours of discovery

Answer

7 days of discovery

Question 2

The California Consumer Privacy Act (CCPA) grants California residents the right to:

Accepted Answer

Know what personal information is collected and request its deletion

Answer

Demand encryption of their stored personal data

Answer

Sue companies for any data collection without consent

Answer

Opt out of all data processing activities

Question 3

Which of the following is considered Protected Health Information (PHI) under HIPAA?

Accepted Answer

A patient's name combined with their medical diagnosis

Answer

Aggregated, de-identified patient statistics

Answer

General wellness information in a fitness app

Answer

Anonymized clinical trial data

Question 4

Privacy by Design (PbD) is a framework that requires privacy to be:

Accepted Answer

Embedded into system design from the outset rather than retrofitted

Answer

Added to systems as a patch after deployment

Answer

Enforced solely through legal compliance audits

Answer

Managed exclusively by the legal and compliance department

Question 5

The 'Right to be Forgotten' (Right to Erasure) under GDPR allows individuals to:

Accepted Answer

Request deletion of their personal data under certain conditions

Answer

Prevent any data from being collected about them in the first place

Answer

Sue organizations for historical data breaches

Answer

Access all data an organization holds about them at any time

Question 6

Which role under GDPR is responsible for ensuring that an organization's data processing activities comply with the regulation?

Accepted Answer

Data Protection Officer (DPO)

Answer

Chief Information Security Officer (CISO)

Answer

Chief Privacy Officer (CPO)

Answer

Information Assurance Manager (IAM)

Question 7

An organization collects customer email addresses only for order confirmations but later uses them for marketing campaigns without re-obtaining consent. This violates which privacy principle?

Accepted Answer

Purpose limitation

Answer

Data minimization

Answer

Storage limitation

Answer

Data accuracy