Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
M3 - CyberSec & Priv
CYBERSECURITY AND PRIVACY / IT0204
| Question | Answer |
|---|---|
| A company uses “tabletop exercises” to test its IRP. This technique belongs to which stage? | Preparation |
| An online shopping site was hacked, and stolen card details were sold on the dark web. Which ETSI indicator best applies? | Intrusion |
| Which organizations must comply with HIPAA breach notification rules? | Hospitals | Health insurance companies | Healthcare clearinghouses |
| What is the main purpose of incident assessment? | Determine scope, impact, and severity |
| GDPR requires that breach notifications include details about mitigation efforts. | True |
| Which IRP step involves removing unauthorized accounts created during a breach? | Eradication |
| In the Equifax breach, stolen data included credit card details and Social Security numbers. | True |
| Which breach case showed that acquisition due diligence should include cybersecurity checks? | Marriott |
| After containment, which step involves ensuring malware remnants are fully removed? | Eradication |
| Which law requires notification of a data breach to a supervisory authority within 72 hours? | GDPR |
| Which law primarily enforces consumer rights in California regarding breach notifications? | CCPA |
| Which breach involved attackers injecting malicious scripts into an airline’s website to capture card details? | British Airways |
| Which breach taught the industry about risks in credit-reporting infrastructures? | Equifax |
| Which laws mandate breach notification obligations? | GDPR | HIPAA | Philippine DPA 2012 |
| Which law emphasizes consumer rights to know, delete, and opt-out after a breach? | CCPA |
| Incident response plans should be tested annually or biannually to remain effective. | True |
| An effective IRP requires coordination between technical teams, legal counsel, and communication staff. | True |
| A company tests its breach notification procedures by running a simulation. This falls under which IRP phase? | Preparation |
| A university suffers ransomware but recovers from backup. Which ETSI indicator applies? | Malware |
| Which of the following were highlighted as ETSI Security Incident Indicators? | Website Defacement |
| In HIPAA breach notifications, which of the following must be communicated to individuals? | Description of the incident | Types of PHI involved | Steps individuals should take to protect themselves |
| A company immediately notifies customers about a suspected breach even before confirming it. This may cause panic but fulfills notification duties. | True |
| Under HIPAA, covered entities must notify affected individuals without unreasonable delay. | Post-Recovery Monitoring |
| Which communication channels are acceptable for notifying individuals of a breach? | Written letters | Email notifications | Public announcements (for large-scale incidents) |
| Under HIPAA, media outlets must be informed if a breach affects more than 500 people. | True |
| Which breach response step can be legally required across GDPR, HIPAA, and DPA 2012? | Breach notification to regulators and affected individuals |
| A company failing to notify DPAs within 72 hours under GDPR may face heavy fines. | True |
| A company creates an incident logbook documenting actions during a breach. This practice belongs to which IRP phase? | Identification and Containment |
| Which breaches were notable for delayed notifications? | Yahoo | Equifax |
| If hackers replace a company website with political propaganda, what ETSI indicator is this? | Website Defacement |
| A delay of several years in notifying users about stolen account credentials characterizes which case? | Yahoo |
| The National Privacy Commission (Philippines) requires breach notifications even for suspected incidents. | False |
| An organization using tabletop exercises to simulate attacks is engaging in proactive preparation. | True |
| A hospital ransomware attack encrypted patient files, but the hospital refused to notify regulators because backups restored data. This action is compliant with HIPAA. | False |
| In breach notifications under the Philippine DPA 2012, which information must be provided? | Measures taken by the organization |
| A phishing campaign successfully tricks employees into clicking malicious links. Which immediate step is best? | Containment |
| If an organization keeps a detailed incident response log, it can be used as legal evidence later. | True |
| A company that encrypts sensitive data but still gets breached is not legally required to notify authorities under any law. | False |
| Failing to patch known vulnerabilities is an example of poor preparation in IRP. | True |
| Under the Philippine Data Privacy Act (DPA 2012), who must organizations notify during a major breach? | National Privacy Commission and affected individuals |
| Which recovery activities are considered best practices? | Reinstalling clean software | Restoring data from verified backups | Monitoring for re-infection |
| If an organization contains a breach but does not conduct forensic analysis, the IRP is still complete. | False |
| What is the most important factor in successful breach notifications? | Timeliness and accuracy of disclosure |
| What activities should organizations perform during the Preparation phase of IRP? | Draft incident response policies | Establish CSIRT teams | Conduct training and simulations |
| Under HIPAA, covered entities must notify affected individuals without unreasonable delay. | True |
| Which are common consequences of poor breach notification? | Regulatory fines | Loss of customer trust | Litigation costs |
| The British Airways breach involved stolen data from passengers’ travel itineraries and payment details. | True |
| An attacker modifies DNS records to redirect users to fake sites. Which ETSI indicator best applies? | Website Forgery |
| If a hacker uses fake “Bank Login” emails to steal credentials, what ETSI indicator is this? | Phishing |
| Which are examples of Eradication activities? | Removing malware | Deleting unauthorized user accounts | Applying security patches |
| Which breach forced regulators to stress “data minimization” principles? | British Airways |
| An organization implementing phishing awareness training after an attack is practicing “Lessons Learned.” | True |
| Which IRP phase ensures continuity of critical operations while incidents are addressed? | Containment |
| Which actions are part of the Containment phase in IRP? | Isolating affected systems | Blocking malicious IP addresses |
| A company hires a digital forensics team to analyze a breached database. Which phase of IRP is this? | Identification and Investigation |
| Which industries are especially regulated regarding breach notifications? | Healthcare (HIPAA) | Finance (GDPR, DPA) | E-commerce (PCI-related) |
| What is the main difference between HIPAA and GDPR breach notifications? | HIPAA applies to PHI, GDPR covers all personal data |
| Which ETSI indicator involves overwhelming a server with traffic to disrupt services? | DoS Attack |
| Which incidents specifically involved credit card theft? | British Airways | Target (reference example) |
| Which regulation specifically protects U.S. healthcare patient records during incidents? | HIPAA |
| Which breach highlighted vulnerabilities in web applications through malicious JavaScript? | British Airways |
| Which IRP step is critical for maintaining evidence integrity in potential legal investigations? | Identification and containment |
| Which breach revealed the risk of using third-party scripts for payments? | British Airways |
| Which case taught the importance of vendor and acquisition risk management? | Marriott |
| Which IRP phase ensures that chain of custody is preserved for evidence during forensic investigations? | Identification |
| In breach response, what role does public relations (PR) play? | Managing external communications |
| Which IRP stage involves communicating with external stakeholders, including DPAs and customers? | Notification/Communication |
| Which phase ensures systems are fully functional and secure before going back online? | Recovery |
| Which Philippine regulation obliges companies to submit a breach notification within 72 hours? | DPA 2012 |
| A Philippine hospital loses unencrypted laptops containing patient records. Which step must follow immediately after containment? | Notify NPC and affected patients |
| The Marriott breach showed that vulnerabilities inherited during acquisitions may go unnoticed. | True |
| Lessons Learned meetings should include both technical and non-technical staff. | True |
| Which IRP step would involve reimaging systems and reinstalling clean applications? | Recovery |
| Which factor worsened Yahoo’s response to its breach? | Delay in disclosure to users |
| An organization detects spam campaigns in its network but ignores them because no sensitive data was exposed. This is acceptable under GDPR. | False |
| Which IRP phase comes right after eradication? | Recovery |
| Eradication should always be done before containment to ensure full elimination of threats. | False |
| Which breach taught organizations about the cost of failing to patch known vulnerabilities? | Equifax |
| Which breach revealed vulnerabilities inherited during an acquisition? | Marriott |
| Which body oversees breach notifications under GDPR? | Data Protection Authorities (DPAs) |
| Which best practices apply during the Lessons Learned phase? | Update security policies | Revise training programs | Analyze logs and response effectiveness |
Created by:
Jsean-Ed