Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Cyber Priv FA3
| Question | Answer |
|---|---|
| Under HIPAA, covered entities must notify affected individuals without unreasonable delay. | True |
| Which organizations must comply with HIPAA breach notification rules? | Hospitals, Health insurance companies, Healthcare clearinghouses |
| A phishing campaign successfully tricks employees into clicking malicious links. Which immediate step is best? | Containment |
| A ransomware attack encrypts a company’s HR system. Employees cannot work. What should the organization do first? | Contain the affected HR system |
| If a hacker uses fake “Bank Login” emails to steal credentials, what ETSI indicator is this? | Phishing |
| A company that encrypts sensitive data but still gets breached is not legally required to notify authorities under any law. | False |
| Which IRP step is critical for maintaining evidence integrity in potential legal investigations? | Identification and containment |
| ETSI incident indicators are only applicable in Europe and have no global relevance. | False |
| In the Equifax breach, stolen data included credit card details and Social Security numbers. | True |
| Which are common consequences of poor breach notification? | Regulatory fines, Loss of customer trust, Litigation costs |
| Which breach led to the exposure of 500 million hotel guest records, including passport details? | Marriott |
| A company immediately notifies customers about a suspected breach even before confirming it. This may cause panic but fulfills notification duties. | True |
| Which breach case showed that acquisition due diligence should include cybersecurity checks? | Marriott |
| What is the main purpose of incident assessment? | Determine scope, impact, and severity |
| An organization creates policies, forms a Computer Security Incident Response Team (CSIRT), and trains employees. Which IRP phase does this represent? | Preparation |
| In breach response, what role does public relations (PR) play? | Managing external communications |
| Which Philippine authority enforces data privacy regulations and breach notifications? | National Privacy Commission |
| Which of the following are responsibilities of Data Protection Authorities (DPAs)? | |
| A bank notifies customers within 24 hours of detecting unauthorized ATM withdrawals. This demonstrates strong compliance with incident response. | True |
| An organization implementing phishing awareness training after an attack is practicing “Lessons Learned.” | True |
| A company hires a digital forensics team to analyze a breached database. Which phase of IRP is this? | Identification and Investigation |
| After containment, which step involves ensuring malware remnants are fully removed? | Eradication |
| An online shopping site was hacked, and stolen card details were sold on the dark web. Which ETSI indicator best applies? | Intrusion |
| Under the Philippine Data Privacy Act (DPA 2012), who must organizations notify during a major breach? | National Privacy Commission and affected individuals |
| A phishing email campaign should be classified as an intrusion in ETSI categories. | False |
| A company creates an incident logbook documenting actions during a breach. This practice belongs to which IRP phase? | Identification and Containment |
| A delay of several years in notifying users about stolen account credentials characterizes which case? | Yahoo |
| Which laws mandate breach notification obligations? | GDPR, HIPAA, Philippine DPA 2012 |
| An attacker modifies DNS records to redirect users to fake sites. Which ETSI indicator best applies? | Website Forgery |
| Which breach case demonstrates the importance of encryption of sensitive fields like passport numbers? | Marriott |
| Which of the following penalties was imposed on Equifax for its delayed breach notification? | Up to $700 million settlement |
| A phishing email campaign should be classified as an intrusion in ETSI categories. | False |
| A financial firm discovers hackers exploiting an unpatched vulnerability. What must be done after containment? | Eradicate the root cause |
| Which breach highlighted vulnerabilities in web applications through malicious JavaScript? | British Airways |
| Which breach response step can be legally required across GDPR, HIPAA, and DPA 2012? | Breach notification to regulators and affected individuals |
| A company tests its breach notification procedures by running a simulation. This falls under which IRP phase? | Preparation |
| A company hires a digital forensics team to analyze a breached database. Which phase of IRP is this? | Identification and Investigation |
| In breach notifications under the Philippine DPA 2012, which information must be provided? | Measures taken by the organization |
| Which ETSI indicator involves overwhelming a server with traffic to disrupt services? | DoS Attack |
| Which actions are part of the Containment phase in IRP? | Isolating affected systems; Blocking malicious IP addresses |
| Which IRP phase includes determining whether the event is a true security incident or a false alarm? | Identification |
| Which of the following are responsibilities of Data Protection Authorities (DPAs)? | Impose fines and penalties |
| What activities should organizations perform during the Preparation phase of IRP? | Draft incident response policies; Establish CSIRT teams; Conduct training and simulations |
| Which IRP phase ensures continuity of critical operations while incidents are addressed? | Containment |
| Failing to patch known vulnerabilities is an example of poor preparation in IRP. | True |
| Which IRP phase involves revising security controls after analyzing what went wrong? | Lessons Learned |
| Which steps ensure legal compliance in breach response? | Timely notification to regulators; Providing mitigation advice to victims; Documenting all actions taken |
| Which factor worsened Yahoo’s response to its breach? | Delay in disclosure to users |
| An attacker modifies DNS records to redirect users to fake sites. Which ETSI indicator best applies? | Website Forgery |
| What is the main lesson from the Equifax breach? | Patch systems promptly and notify quickly |
| If an organization keeps a detailed incident response log, it can be used as legal evidence later. | True |
| A company that encrypts sensitive data but still gets breached is not legally required to notify authorities under any law. | False |
| Which laws mandate breach notification obligations? | GDPR; HIPAA; Philippine DPA 2012 |
| Incident response plans should be tested annually or biannually to remain effective. | True |
| Which IRP step would involve reimaging systems and reinstalling clean applications? | Recovery |
| A bank notifies customers within 24 hours of detecting unauthorized ATM withdrawals. This demonstrates strong compliance with incident response. | True |
| A company encrypts sensitive databases, so even if breached, it may not need to notify authorities under GDPR. | True |
| A university suffers ransomware but recovers from backup. Which ETSI indicator applies? | Malware |
| Which Philippine regulation obliges companies to submit a breach notification within 72 hours? | DPA 2012 |
| An effective IRP requires coordination between technical teams, legal counsel, and communication staff. | True |
| A company failing to notify DPAs within 72 hours under GDPR may face heavy fines. | True |
| What is the most important factor in successful breach notifications? | Timeliness and accuracy of disclosure |
| The Philippine Data Privacy Act allows organizations to completely skip reporting if only 10 people are affected, even if sensitive data was stolen. | False |
| A company delays breach notification because it fears reputational harm. This complies with GDPR. | False |
| Which incident response best practice reduces downtime for critical services? | Maintain redundant systems for continuity |
| Which IRP phase ensures that chain of custody is preserved for evidence during forensic investigations? | Identification |
| A hospital ransomware attack encrypted patient files, but the hospital refused to notify regulators because backups restored data. This action is compliant with HIPAA. | False |
| Which of the following were highlighted as ETSI Security Incident Indicators? | Website Defacement |
| During an incident, the security team isolates affected servers to prevent further spread. This represents which IRP phase? | Containment |
| Which IRP step ensures systems are monitored after recovery to detect recurrence? | Post-Recovery Monitoring |
| Which factors determine whether a breach must be reported? | Number of individuals affected, Sensitivity of data exposed, Likelihood of harm |
| What is the main role of a DPA in breach cases? | Investigating and enforcing compliance |
| Which law emphasizes consumer rights to know, delete, and opt-out after a breach? | CCPA |
| Which law requires notification of a data breach to a supervisory authority within 72 hours? | GDPR |
| A company uses “tabletop exercises” to test its IRP. This technique belongs to which stage? | Preparation |
| Which breach taught the industry about risks in credit-reporting infrastructures? | Equifax |
| A Philippine hospital loses unencrypted laptops containing patient records. Which step must follow immediately after containment? | Notify NPC and affected patients |
| Reinstalling clean software | Restoring data from verified backups, Monitoring for re-infection, Reinstalling clean software |
| A retail company in California experiences a breach affecting customer names and addresses. Which law applies primarily? | CCPA |
| Which best practices apply during the Lessons Learned phase? | Update security policies; Revise training programs; Analyze logs and response effectiveness |
| An organization’s systems are patched, but attackers return because stolen credentials weren’t revoked. Which IRP failure occurred? | Eradication |
| If hackers replace a company website with political propaganda, what ETSI indicator is this? | Website Defacement |
| Which breach involved attackers injecting malicious scripts into an airline’s website to capture card details? | British Airways |
| Which breach revealed the risk of using third-party scripts for payments? | British Airways |
| If an organization contains a breach but does not conduct forensic analysis, the IRP is still complete. | False |
| Which IRP step involves removing unauthorized accounts created during a breach? | Eradication |
| Which body oversees breach notifications under GDPR? | Data Protection Authorities (DPAs) |
| Which are examples of Eradication activities? | Removing malware; Deleting unauthorized user accounts; Applying security patches |
| An organization using tabletop exercises to simulate attacks is engaging in proactive preparation. | True |
| Which IRP phase comes right after eradication? | Recovery |
| Which regulation specifically protects U.S. healthcare patient records during incidents? | HIPAA |
| Under HIPAA, media outlets must be informed if a breach affects more than 500 people. | True |
| A hospital’s database is breached, exposing patient medical records. Which initial step in the Incident Response Plan (IRP) must be taken first? | Identify and analyze the breach source |
Created by:
jxxnixx