Full-Stack Development Regulatory Frameworks & Compliance 2

Question 1

Under HIPAA's Security Rule, which safeguard category requires organizations to implement policies and procedures for managing workforce access to ePHI?

Accepted Answer

Administrative Safeguards

Answer

Administrative Safeguards cover workforce training, access management policies, and security management processes for ePHI.

Question 2

A developer builds an API that collects location data from EU users. Under GDPR, which legal basis most commonly applies when the user explicitly agrees to location tracking for personalized ads?

Accepted Answer

Consent

Answer

Consent is the correct legal basis when a user explicitly agrees to a specific processing purpose like personalized advertising.

Question 3

Which PCI DSS requirement mandates that cardholder data must be encrypted when transmitted over open, public networks?

Accepted Answer

Requirement 4

Answer

PCI DSS Requirement 4 specifically addresses protecting cardholder data in transit over open or public networks using strong cryptography.

Question 4

A company stores user passwords using MD5 hashing without a salt. Which compliance standard is most likely to flag this as a violation?

Accepted Answer

PCI DSS

Answer

PCI DSS Requirement 8 mandates strong cryptographic controls for authentication credentials, ruling out weak algorithms like unsalted MD5.

Question 5

What is the maximum fine under GDPR for the most serious violations, such as unlawful processing of data?

Accepted Answer

€20 million or 4% of global annual turnover

Answer

GDPR's upper tier penalty is €20 million or 4% of global annual turnover, whichever is higher, for the most serious infringements.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Regulatory Frameworks & Compliance 2