What does DPIA stand for?

Data Protection Impact Assessment

Which are principles of lawful processing?

Transparency | Legitimate purpose | Proportionality

What is the focus of the Payment Card Industry Data Security Standard (PCI DSS)?

Credit card transaction security

Which are key rights of data subjects under privacy laws?

Right to erasure (forgotten) | Right to rectification | Right to access

Which concept involves notifying individuals and authorities after a breach?

Breach notification requirement

Which are key purposes of cybersecurity law?

Safeguarding national security | Preventing cyberattacks | Protecting digital infrastructures

Which are examples of incident response plan steps?

Identification of incident | Containment | Recovery

Which is a challenge in cross-border data transfer?

Different privacy jurisdictions

Which are elements of the CIA Triad?

Confidentiality | Availability | Integrity

Which are examples of cybercrime?

Hacking | Identity theft | Malware distribution

Cybersecurity laws are important for:

National security, personal data protection, and corporate accountability

Which of the following is an example of accountability in practice?

Appointing a Data Protection Officer and keeping compliance records

Hacking, identity theft, malware distribution

A Data Protection Impact Assessment (DPIA) is required under GDPR when:

Processing poses high risk to individuals’ rights

Which are examples of encryption use in compliance?

Protecting stored medical records | Protecting communications with SSL/TLS | Securing online payment transactions

Which of the following is a benefit of harmonizing cybersecurity laws internationally?

Facilitating trade and ensuring consistent protection

What does “jurisdiction” mean in data privacy?

Legal authority over geographical area or data transfers

A data breach occurs when:

Confidential or protected data is accessed without authorization

Which are safeguards for cross-border data transfers under GDPR?

Binding Corporate Rules | Standard Contractual Clauses | Adequacy decisions

Help

Options

focusNode

Didn't know it?
click below

Knew it?
click below

Don't Know

Remaining cards (0)

Know

retry

shuffle

restart

0:00

Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

Normal Size Small Size show me how

ME - CyberSec & Priv

ME[M1-4] - CYBERSECURITY AND PRIVACY / IT0204

Question	Answer
M1:	__________________________________________________________
Which principle requires organizations to demonstrate compliance with data protection laws?	Accountability
Which U.S. law was passed after 9/11 to strengthen homeland defense?	Homeland Security Act
A company processes personal data of EU citizens without GDPR compliance. This is lawful.	False
What does DPIA stand for?	Data Protection Impact Assessment
Which law governs EU member states’ network and information security?	NIS Directive
A school posts student grades on a public website without consent. This complies with privacy law.	False
A retailer collects customer consent before sending marketing emails. This complies with lawful processing.	True
Which of the following is an example of personal data?	Phone number
Which is a key risk of weak jurisdictional enforcement in data privacy?	Cross-border misuse of data
An employee leaks client data via personal email. The company later updates policies. The leak still violates privacy law.	True
An e-commerce store fails to notify affected customers after a breach. This complies with breach notification laws.	False
Which are principles of lawful processing?	Transparency \| Legitimate purpose \| Proportionality
Which are examples of sector-specific regulations?	GLBA \| HIPAA
What is the focus of the Payment Card Industry Data Security Standard (PCI DSS)?	Credit card transaction security
Which are key rights of data subjects under privacy laws?	Right to erasure (forgotten) \| Right to rectification \| Right to access
Which of the following is NOT sensitive personal data?	Weather patterns
Which concept involves notifying individuals and authorities after a breach?	Breach notification requirement
Which are key purposes of cybersecurity law?	Safeguarding national security \| Preventing cyberattacks \| Protecting digital infrastructures
Which are examples of incident response plan steps?	Identification of incident \| Containment \| Recovery
Which cybersecurity law promotes consumer trust in digital services?	GDPR
Which are global privacy frameworks?	GDPR \| APEC Privacy Framework
An online service allows users to download their stored personal data upon request. This is a privacy right.	True
Which of the following is an example of a sector-specific privacy law?	HIPAA
Which is a challenge in cross-border data transfer?	Different privacy jurisdictions
Which regulation is specific to the European Union?	GDPR
Which principle prevents organizations from collecting unlimited data?	Proportionality
Which international agency promotes cybersecurity in the EU?	ENISA
A tech company enforces multi-factor authentication to protect user accounts. This aligns with cybersecurity best practice.	True
Which decade saw the first wave of cybersecurity legislation?	1980s–1990s
A bank reports a data breach 6 months after discovery. This satisfies GDPR requirements.	False
Which are elements of the CIA Triad?	Confidentiality \| Availability \| Integrity
Which are examples of cybercrime?	Hacking \| Identity theft \| Malware distribution
A government agency requires explicit consent before collecting fingerprints. This complies with privacy law.	True
Which country introduced the “Right to be Forgotten”?	European Union
A social media platform asks explicit consent before using personal photos for ads. This follows lawful processing.	True
Which principle supports deleting personal data after consent is withdrawn?	Right to be forgotten
Cybersecurity laws are important for:	National security, personal data protection, and corporate accountability
Which of the following is an example of accountability in practice?	Appointing a Data Protection Officer and keeping compliance records
Cybercrime includes:	Hacking, identity theft, malware distribution
Which regulation requires strong security measures in healthcare institutions?	HIPAA
A Data Protection Impact Assessment (DPIA) is required under GDPR when:	Processing poses high risk to individuals’ rights
A retail shop collects customer emails and uses them for unrelated political ads. This complies with data minimization.	False
Which are examples of encryption use in compliance?	Protecting stored medical records \| Protecting communications with SSL/TLS \| Securing online payment transactions
A school encrypts student grades and allows only teachers to access them. This aligns with confidentiality.	True
Which of the following is a benefit of harmonizing cybersecurity laws internationally?	Facilitating trade and ensuring consistent protection
What does “jurisdiction” mean in data privacy?	Legal authority over geographical area or data transfers
Which principle requires data collection to be limited to what is necessary?	Proportionality
A data breach occurs when:	Confidential or protected data is accessed without authorization
An airline keeps passenger passport data forever even after travel. This complies with retention limits.	False
Which are safeguards for cross-border data transfers under GDPR?	Binding Corporate Rules \| Standard Contractual Clauses \| Adequacy decisions
The GDPR came into effect in which decade?	2010s
Which best explains “data minimization”?	Collecting only data necessary for stated purposes
A cloud storage provider retains backups indefinitely without justification. This complies with retention policies.	False
A government publishes citizens’ addresses online without consent. This violates privacy law.	True
Which U.S. law targets fraud using computers?	CFAA
Which law enforces mandatory breach notifications within 72 hours?	GDPR
The U.S. Computer Fraud and Abuse Act (CFAA) of 1986 primarily addressed:	Computer crimes
What is the purpose of pseudonymization?	Reducing re-identification risk by replacing identifiers
Which U.S. law addresses protection of patient health information?	HIPAA
Which are examples of lawful bases for processing personal data under GDPR?	Contract performance \| Legal obligation \| Consent
Which country pioneered early data protection legislation?	Germany
Which is the most critical role of corporate accountability laws?	Ensuring organizations safeguard data and face penalties if not compliant
A financial institution encrypts client data and conducts regular audits. This demonstrates accountability.	True
A bank notifies customers of a breach within 72 hours. This complies with GDPR.	True
What is the “right to be forgotten”?	Requesting deletion of personal data no longer needed
Which framework by NIST improves cybersecurity for critical infrastructure?	Cybersecurity Framework
Which are examples of accountability practices?	Maintaining records of processing \| Conducting DPIAs \| Appointing a DPO when required
Which regulation addresses consumer privacy in financial services?	GLBA
Why are privacy laws crucial in the digital age?	Because personal data is a valuable commodity and misuse is a risk
An IT firm conducts a DPIA before launching biometric data processing. This aligns with GDPR.	True
Which Philippine law established a comprehensive framework for data protection?	Data Privacy Act of 2012
Which country passed the CFAA?	United States
The principle of “data retention” requires:	Storing data only as long as legally or operationally needed
Which principle emphasizes giving individuals control over their data?	Consent
Which of the following is NOT part of the CIA Triad?	Transparency
A cyberattack aiming to make a system unavailable refers to:	Denial of Service
Which are benefits of international harmonization of cybersecurity laws?	Easier compliance for global businesses \| Facilitation of trade \| Consistent data protection standards
A hospital restricts access to patient records only to attending physicians. This follows least privilege principle.	True
Which U.S. Act of 2002 included provisions for critical infrastructure protection?	Homeland Security Act
A website installs tracking cookies without informing users. This complies with transparency principles.	False
What is the primary goal of encryption in privacy law compliance?	To prevent unauthorized access to sensitive data
Privacy laws primarily regulate:	Collection, processing, and sharing of personal data
A company deletes customer data once no longer needed. This follows data minimization.	True
A company publishes anonymized statistics without identifiers. This generally complies with privacy law.	True
A retailer refuses to correct inaccurate customer data when requested. This complies with privacy rights.	False
A company shares medical records with advertisers without consent. This complies with HIPAA.	False
Which legal concept refers to replacing identifiers with pseudonyms?	Pseudonymization
What does encryption ensure?	Confidentiality and integrity of data
The Data Privacy Act of 2012 was enacted in:	Philippines
Which U.S. law requires financial institutions to protect consumers’ personal information?	GLBA
Which is NOT an example of a cybersecurity incident?	System software update
Which are possible consequences of data breaches?	Loss of consumer trust \| Legal liability \| Financial penalties
Which directive aims to achieve a high common level of network security in the EU?	NIS Directive
_______________________________________________________________________	(1 wrong answer)
_______________________________________________________________________	_______________________________________________________________________
Which is a historical driver for privacy law?	Expansion of the internet and online threats
Which event led to stricter international privacy frameworks in the 2000s?	Increasing frequency of cyberattacks
Which principle ensures that personal data is processed fairly and lawfully?	Transparency and legitimate purpose
Which are recognized sensitive data categories?	Biometric identifiers \| Political opinions \| Medical information
Which law requires impact assessments for high-risk processing activities?	GDPR
Which EU law laid the foundation for modern data protection?	Data Protection Directive of 1995
A hospital encrypts patient data but lets all employees access it without logging. This complies with confidentiality.	False
Which of the following best defines “cybersecurity”?	Protecting systems, networks, and data from digital attacks
What does “consent” mean in privacy law?	Individual permission before data collection or processing
_______________________________________________________________________	_______________________________________________________________________
_______________________________________________________________________	_______________________________________________________________________
Which of the following defines “cybercrime”?	Illegal activities conducted via computers or the internet
Which country’s law is considered a global benchmark for data protection?	EU’s GDPR
The accountability principle requires:	Records of processing and demonstration of compliance
Which are responsibilities of a Data Protection Officer (DPO)?	Serving as contact point for authorities \| Monitoring processing activities \| Advising on compliance
Which regulation aims to harmonize cybersecurity across EU nations?	NIS Directive
Which are major challenges in enforcing cybersecurity laws?	Cross-border jurisdiction conflicts \| Rapidly evolving technologies \| Sophisticated cybercrime techniques
Which are critical elements of national cybersecurity strategies?	Protecting critical infrastructure \| Enforcing incident reporting \| Public awareness campaigns
Which practices comply with data protection principles?	Obtaining informed consent \| Encrypting sensitive data \| Implementing retention limits
A company transfers EU customer data to another country with no equivalent privacy law, without safeguards. This complies with GDPR.	False
What is the main focus of cybersecurity law?	Ensuring integrity, confidentiality, and availability of data
Which standard secures credit card transactions?	PCI DSS
A government requires telecoms to retain communication data only for legally defined periods. This complies with retention limits.	True
A bank ignores a client’s request to erase outdated personal data. This complies with the right to be forgotten.	False
Which regulation governs personal health information in the healthcare sector?	HIPAA
Which are considered personal data?	Biometric Data \| Name \| IP Address
A hospital shares pseudonymized patient data for research with safeguards. This generally complies with privacy law.	True
A company refuses to disclose how long it keeps customer data. This demonstrates accountability.	False
Which type of law punishes online fraud and identity theft?	Cybercrime law
_______________________________________________________________________	_______________________________________________________________________
_______________________________________________________________________	_______________________________________________________________________
M2:	_______________________________________________________________________
_______________________________________________________________________	(1 wrong answer)
_______________________________________________________________________	_______________________________________________________________________
The “Do Not Sell My Personal Information” link is required under:	CCPA
Which law requires “Do Not Sell My Personal Information” link?	CCPA
Which EU law came into effect on May 25, 2018?	GDPR
Which Philippine DPA violation is committed when an HR department loses an unsecured USB?	Negligence in Access
A business processing fewer than 50,000 California users’ data is exempt from CCPA.	True
Which GDPR principle ensures data is accurate and kept up to date?	Accuracy
A hospital in the Philippines encrypts patient records but fails to notify NPC after a breach within 72 hours. The hospital is compliant with DPA 2012.	False
A retailer publishes anonymized sales data with no identifiers. This generally complies with privacy laws.	True
Which GDPR principle states only necessary data should be collected?	Data Minimization
A firm implements SCCs to transfer EU data abroad. This aligns with GDPR.	True
A Philippine government agency discloses citizen data to third parties without consent. This violates DPA 2012.	True
Which principle requires companies to adopt security measures from the start of system design?	Data Protection by Design and by Default
Which are administrative sanctions under Philippine DPA?	Reprimands and compliance orders
Under GDPR, breach notification must always be done within 24 hours.	False
Which mechanisms protect EU citizens’ data transferred overseas?	Adequacy Decisions \| SCCs \| BCRs
A U.S. hospital fails to provide patients with a copy of their medical records. This violates HIPAA.	True
Which GDPR principle ensures security against accidental loss or destruction?	Integrity and Confidentiality
Which law imposes fines up to ₱4M and imprisonment for privacy violations?	Philippine DPA 2012
Which Philippine DPA violation involves using collected data for politics without consent?	Unauthorized Purpose
Which organization enforces the Data Privacy Act of 2012 in the Philippines?	National Privacy Commission (NPC)
Which HIPAA safeguard involves encrypting electronic health records?	Technical safeguard
Which are penalties under the Philippine DPA 2012?	Imprisonment
A Russian company requiring all citizen data to remain in Russia demonstrates a localization requirement.	True
Which cross-border tool is an internal company policy approved for multinational transfers?	Binding Corporate Rules (BCRs)
Which consumer right is unique to CCPA?	Right to opt out of data sale
Which GDPR right allows individuals to object to processing for marketing?	Right to Object
Under GDPR, consent must be freely given, specific, and informed.	True
Which of the following is NOT a penalty for violating the Philippine DPA?	Community service only
Which rights under CCPA mirror GDPR?	Right to data portability \| Right to delete \| Right to access
Which of the following is a HIPAA enforcement mechanism?	Office for Civil Rights (OCR)
_______________________________________________________________________	_______________________________________________________________________
_______________________________________________________________________	_______________________________________________________________________
A California-based business with $5 million annual revenue automatically falls under CCPA obligations.	False
A company must disclose the purpose for which it collects data under CCPA.	True
A Philippine university posts student data publicly without consent. This violates DPA 2012.	True
GDPR fines can be up to:	€20 million or 4% of global turnover
An EU company transfers data to a country with no adequacy decision and no SCCs. This complies with GDPR.	False
Which of the following are GDPR data subject rights?	Right to erasure \| Right to be informed \| Right to restrict processing
Which of the following is NOT a key GDPR principle?	Profit Maximization
Which Philippine law introduced criminal penalties for data privacy violations?	Data Privacy Act of 2012
Which GDPR right allows individuals to stop processing under certain conditions?	Right to Restrict Processing
Which law requires businesses to disclose categories of data collected?	CCPA
Which GDPR right allows individuals to request their data be deleted when no longer needed?	Right to be Forgotten
Under HIPAA, hospitals may share patient records with advertisers without consent.	False
Under DPA 2012, breach notification to the NPC must occur within:	72 hours
Under CCPA, a consumer may demand to know what categories of data a company collects about them.	True
Which is an adequacy mechanism under GDPR?	Adequacy Decision by EU Commission
Which are key principles of data protection regulations?	Lawfulness, Fairness, Transparency \| Data Minimization \| Purpose Limitation
Which U.S. law gives consumers the right to delete their personal data?	CCPA
Which are obligations under HIPAA?	Protect PHI \| Provide breach notification \| Implement safeguards
Which mechanism allows global businesses to transfer data within their subsidiaries?	Binding Corporate Rules
Which are consumer rights recognized under GDPR and DPA 2012?	Right to be informed \| Right to access \| Right to rectification
Under GDPR, a DPO is required for companies that monitor data on a large scale.	True
A company continues to process EU customer data after consent is withdrawn. This complies with GDPR.	False
Which examples count as PHI under HIPAA?	Lab test results \| Patient names \| Medical history
A Philippine telco collects location data for marketing without consent. This complies with DPA 2012.	False
A healthcare provider uses strong encryption and access control to protect patient records. This aligns with HIPAA safeguards.	True
Which is a key consumer right under GDPR?	Right to data portability
Which law has extraterritorial scope, applying to organizations outside its jurisdiction?	GDPR
Which law requires organizations to appoint a DPO under certain conditions?	GDPR
Which DPA violation is committed when a breach is hidden from NPC?	Concealment of Breach
Which law mandates breach reporting both to regulators and individuals?	GDPR
Which right is explicitly given to California residents under CCPA?	Right to Know what personal data is collected
Which GDPR principle requires businesses to demonstrate compliance?	Accountability
Which rights are provided under CCPA?	Right to Know \| Right to Delete \| Right to Opt Out of Data Sale
Which Philippine DPA violation combines two or more offenses?	Combination of Acts
Which are key cross-border data transfer challenges?	Data localization rules \| Differing national laws \| Enforcement complexity
Which law applies to California companies with $25M+ revenue or 50K+ consumer data?	CCPA
What is the role of a Data Protection Officer (DPO)?	Oversee compliance with data protection laws
Which are rights under GDPR?	Access \| Rectification \| Erasure
A bank shares PHI without patient consent under HIPAA. This is lawful.	False
Which practices comply with GDPR’s consent requirements?	Specific and informed \| Freely given \| Clear affirmative action
Which GDPR right is also mirrored in DPA 2012?	Right to Access
Which principle emphasizes that personal data must be processed fairly, lawfully, and transparently?	Lawfulness, Fairness, Transparency
Which of the following does NOT fall under GDPR scope?	Local clubs with no personal data
An e-commerce firm fails to display a “Do Not Sell My Personal Information” link for California users. This violates CCPA.	True
Which U.S. law protects patient health data?	HIPAA
Under HIPAA, which type of data is specially protected?	Protected Health Information (PHI)
Which HIPAA requirement ensures breach notification to affected individuals?	Breach Notification Rule
Which law grants the right to file legal action after a data breach?	CCPA
Which right under GDPR lets individuals transfer data between providers?	Right to Portability
Which Philippine DPA violation involves intentionally sharing data to a competitor?	Malicious Disclosure
Which of the following is a penalty for intentional violation of CCPA?	$7,500
Which are tools for lawful cross-border transfers under GDPR?	Binding Corporate Rules (BCRs) \| Standard Contractual Clauses (SCCs) \| Adequacy Decisions
Under CCPA, companies can charge higher prices to consumers who opt out of data sales.	False
A U.S. company selling to EU customers must comply with GDPR, even if not based in Europe.	True
Which of the following is a key feature of GDPR consent?	Must be informed, specific, and unambiguous
Which GDPR principle is violated if a company keeps data forever?	Storage Limitation
Which are key differences between HIPAA and GDPR?	GDPR covers all personal data \| HIPAA is sector-specific \| HIPAA focuses on PHI
Which CCPA right allows consumers to stop companies from selling their data?	Right to Opt Out
Which principle limits keeping data longer than necessary?	Storage Limitation
Which GDPR penalty tier covers minor infringements?	€10 million or 2% of global turnover
A company deletes inaccurate personal data upon user request. This aligns with GDPR.	True
Which cross-border mechanism applies in absence of adequacy decisions?	Standard Contractual Clauses (SCCs)
Under DPA 2012, unauthorized disclosure of personal data may result in imprisonment.	True
Which Philippine DPA violation is committed when a teacher posts student grades publicly?	Unauthorized Disclosure
_______________________________________________________________________	_______________________________________________________________________
_______________________________________________________________________	_______________________________________________________________________
M3:	_______________________________________________________________________
A company uses “tabletop exercises” to test its IRP. This technique belongs to which stage?	Preparation
An online shopping site was hacked, and stolen card details were sold on the dark web. Which ETSI indicator best applies?	Intrusion
Which organizations must comply with HIPAA breach notification rules?	Hospitals \| Health insurance companies \| Healthcare clearinghouses
What is the main purpose of incident assessment?	Determine scope, impact, and severity
GDPR requires that breach notifications include details about mitigation efforts.	True
Which IRP step involves removing unauthorized accounts created during a breach?	Eradication
In the Equifax breach, stolen data included credit card details and Social Security numbers.	True
Which breach case showed that acquisition due diligence should include cybersecurity checks?	Marriott
After containment, which step involves ensuring malware remnants are fully removed?	Eradication
Which law requires notification of a data breach to a supervisory authority within 72 hours?	GDPR
Which law primarily enforces consumer rights in California regarding breach notifications?	CCPA
Which breach involved attackers injecting malicious scripts into an airline’s website to capture card details?	British Airways
Which breach taught the industry about risks in credit-reporting infrastructures?	Equifax
Which laws mandate breach notification obligations?	GDPR \| HIPAA \| Philippine DPA 2012
Which law emphasizes consumer rights to know, delete, and opt-out after a breach?	CCPA
Incident response plans should be tested annually or biannually to remain effective.	True
An effective IRP requires coordination between technical teams, legal counsel, and communication staff.	True
A company tests its breach notification procedures by running a simulation. This falls under which IRP phase?	Preparation
A university suffers ransomware but recovers from backup. Which ETSI indicator applies?	Malware
Which of the following were highlighted as ETSI Security Incident Indicators?	Website Defacement
In HIPAA breach notifications, which of the following must be communicated to individuals?	Description of the incident \| Types of PHI involved \| Steps individuals should take to protect themselves
A company immediately notifies customers about a suspected breach even before confirming it. This may cause panic but fulfills notification duties.	True
Under HIPAA, covered entities must notify affected individuals without unreasonable delay.	Post-Recovery Monitoring
Which communication channels are acceptable for notifying individuals of a breach?	Written letters \| Email notifications \| Public announcements (for large-scale incidents)
Under HIPAA, media outlets must be informed if a breach affects more than 500 people.	True
Which breach response step can be legally required across GDPR, HIPAA, and DPA 2012?	Breach notification to regulators and affected individuals
A company failing to notify DPAs within 72 hours under GDPR may face heavy fines.	True
A company creates an incident logbook documenting actions during a breach. This practice belongs to which IRP phase?	Identification and Containment
Which breaches were notable for delayed notifications?	Yahoo \| Equifax
If hackers replace a company website with political propaganda, what ETSI indicator is this?	Website Defacement
A delay of several years in notifying users about stolen account credentials characterizes which case?	Yahoo
The National Privacy Commission (Philippines) requires breach notifications even for suspected incidents.	False
An organization using tabletop exercises to simulate attacks is engaging in proactive preparation.	True
A hospital ransomware attack encrypted patient files, but the hospital refused to notify regulators because backups restored data. This action is compliant with HIPAA.	False
In breach notifications under the Philippine DPA 2012, which information must be provided?	Measures taken by the organization
A phishing campaign successfully tricks employees into clicking malicious links. Which immediate step is best?	Containment
If an organization keeps a detailed incident response log, it can be used as legal evidence later.	True
A company that encrypts sensitive data but still gets breached is not legally required to notify authorities under any law.	False
Failing to patch known vulnerabilities is an example of poor preparation in IRP.	True
Under the Philippine Data Privacy Act (DPA 2012), who must organizations notify during a major breach?	National Privacy Commission and affected individuals
Which recovery activities are considered best practices?	Reinstalling clean software \| Restoring data from verified backups \| Monitoring for re-infection
If an organization contains a breach but does not conduct forensic analysis, the IRP is still complete.	False
What is the most important factor in successful breach notifications?	Timeliness and accuracy of disclosure
What activities should organizations perform during the Preparation phase of IRP?	Draft incident response policies \| Establish CSIRT teams \| Conduct training and simulations
Under HIPAA, covered entities must notify affected individuals without unreasonable delay.	True
Which are common consequences of poor breach notification?	Regulatory fines \| Loss of customer trust \| Litigation costs
The British Airways breach involved stolen data from passengers’ travel itineraries and payment details.	True
An attacker modifies DNS records to redirect users to fake sites. Which ETSI indicator best applies?	Website Forgery
If a hacker uses fake “Bank Login” emails to steal credentials, what ETSI indicator is this?	Phishing
Which are examples of Eradication activities?	Removing malware \| Deleting unauthorized user accounts \| Applying security patches
Which breach forced regulators to stress “data minimization” principles?	British Airways
An organization implementing phishing awareness training after an attack is practicing “Lessons Learned.”	True
Which IRP phase ensures continuity of critical operations while incidents are addressed?	Containment
Which actions are part of the Containment phase in IRP?	Isolating affected systems \| Blocking malicious IP addresses
A company hires a digital forensics team to analyze a breached database. Which phase of IRP is this?	Identification and Investigation
Which industries are especially regulated regarding breach notifications?	Healthcare (HIPAA) \| Finance (GDPR, DPA) \| E-commerce (PCI-related)
What is the main difference between HIPAA and GDPR breach notifications?	HIPAA applies to PHI, GDPR covers all personal data
Which ETSI indicator involves overwhelming a server with traffic to disrupt services?	DoS Attack
Which incidents specifically involved credit card theft?	British Airways \| Target (reference example)
Which regulation specifically protects U.S. healthcare patient records during incidents?	HIPAA
Which breach highlighted vulnerabilities in web applications through malicious JavaScript?	British Airways
Which IRP step is critical for maintaining evidence integrity in potential legal investigations?	Identification and containment
Which breach revealed the risk of using third-party scripts for payments?	British Airways
Which case taught the importance of vendor and acquisition risk management?	Marriott
Which IRP phase ensures that chain of custody is preserved for evidence during forensic investigations?	Identification
In breach response, what role does public relations (PR) play?	Managing external communications
Which IRP stage involves communicating with external stakeholders, including DPAs and customers?	Notification/Communication
Which phase ensures systems are fully functional and secure before going back online?	Recovery
Which Philippine regulation obliges companies to submit a breach notification within 72 hours?	DPA 2012
A Philippine hospital loses unencrypted laptops containing patient records. Which step must follow immediately after containment?	Notify NPC and affected patients
The Marriott breach showed that vulnerabilities inherited during acquisitions may go unnoticed.	True
Lessons Learned meetings should include both technical and non-technical staff.	True
Which IRP step would involve reimaging systems and reinstalling clean applications?	Recovery
Which factor worsened Yahoo’s response to its breach?	Delay in disclosure to users
An organization detects spam campaigns in its network but ignores them because no sensitive data was exposed. This is acceptable under GDPR.	False
Which IRP phase comes right after eradication?	Recovery
Eradication should always be done before containment to ensure full elimination of threats.	False
Which breach taught organizations about the cost of failing to patch known vulnerabilities?	Equifax
Which breach revealed vulnerabilities inherited during an acquisition?	Marriott
Which body oversees breach notifications under GDPR?	Data Protection Authorities (DPAs)
Which best practices apply during the Lessons Learned phase?	Update security policies \| Revise training programs \| Analyze logs and response effectiveness
_______________________________________________________________________	_______________________________________________________________________
_______________________________________________________________________	_______________________________________________________________________
M4:	_______________________________________________________________________
A company continuously trains its staff on data privacy awareness. This is a best practice for compliance.	True
Under RA 10173, the right to data portability allows individuals to:	Obtain and transfer their own data to another service provider
A company obtains valid consent to collect customer emails but later sells them to marketers without permission. This is lawful under RA 10173.	False
Which of the following is an example of privileged communication extended under RA 10173?	Doctor–patient
Which law mandated the use of digital signatures in government transactions?	E.O. 810
Which is an example of aiding or abetting cybercrime?	Helping plan a phishing campaign
A student records a private phone call with a friend without consent. This is a violation of RA 4200.	True
Which of the following is considered system interference under RA 10175?	Launching a denial-of-service attack
Which laws address online child protection?	RA 9775 – Anti-Child Pornography Act \| RA 10175 – Cybercrime Prevention Act
Under RA 10175, system interference refers to:	Disrupting or destroying a computer system
Which are functions of the National Privacy Commission (NPC)?	Investigate data breaches \| Issue compliance orders \| Promote data privacy awareness
A hospital requires its contractors to comply with the same privacy standards it follows. This aligns with RA 10173.	True
How soon must the NPC be notified of a data breach?	72 hours
A company ignores the NPC’s compliance orders without consequence. This is consistent with RA 10173.	False
Which are considered cybercrime offenses under RA 10175?	Illegal access \| Identity theft \| Cyber libel
RA 9775 criminalizes:	Child pornography
Which is NOT a right of the data subject?	Right to own government databases
What penalty applies for improper disposal of sensitive personal information under RA 10173?	1–3 years imprisonment and ₱100K–₱1M fine
Which is an example of malicious disclosure under RA 10173?	An employee leaking a patient’s HIV status online out of spite
RA 8792 grants legal recognition to:	Electronic contracts and digital signatures
Which of the following is NOT one of the Five Pillars of Privacy Accountability?	Outsourcing all personal data with no safeguards
Which agency enforces RA 8293 (Intellectual Property Code)?	IPOPHL
A blogger posts defamatory remarks about a politician on Facebook. This can be prosecuted as cyber libel under RA 10175.	True
The main objective of the Data Privacy Act is to:	Protect personal data while allowing free flow of information
What is the penalty for illegal access to critical infrastructure under RA 10175?	Reclusion temporal (12–20 years)
A school refuses to correct inaccurate student records when requested. This violates the right to rectification under RA 10173.	True
Which law prohibits unauthorized interception of communications?	RA 4200
A company transfers Filipino customer data to a foreign server without ensuring equivalent protection. This is a compliance issue under RA 10173.	True
Which are common compliance challenges in the Philippines?	Lack of awareness of privacy laws \| Limited resources among SMEs \| Cross-border transfer complexities
Which are responsibilities of a Data Protection Officer (DPO)?	Ensure compliance with the DPA \| Conduct privacy impact assessments \| Serve as contact with NPC
A group hacks government websites to protest against a law. This is punishable under RA 10175.	True
An online seller registers a domain similar to a bank’s name to trick users. This act is considered lawful under RA 10175.	False
Which agency leads prosecution of cybercrime?	DOJ-Office of Cybercrime
Transparency under RA 10173 means:	Informing data subjects how their data will be collected and processed
Rights under the DPA are:	Transferable to heirs upon death or incapacity
Which type of data requires stricter protection under RA 10173?	Sensitive personal information
Which is an example of computer-related fraud under RA 10175?	Phishing emails to steal banking credentials
A person hacks into a bank’s system to steal client information. This is punishable as illegal access under RA 10175.	True
The DFA 2019 passport data breach violated:	RA 10173 and RA 10175
What year was the Data Privacy Act (RA 10173) enacted?	2012
Which law protects intellectual property rights, including software and databases?	RA 8293
Which is NOT a general data privacy principle under RA 10173?	Confidentiality
A hospital fails to notify the NPC within 72 hours after discovering a breach of patient records. This violates RA 10173.	True
Which rights are granted to data subjects under RA 10173?	Right to be informed \| Right to access \| Right to rectification
Which law criminalizes unauthorized recording of private telephone conversations?	RA 4200
Which laws regulate digital signatures?	RA 8792 – E-Commerce Act \| E.O. 810 – Institutionalizing digital signatures
Which is an example of a cross-border compliance challenge?	Transferring Filipino personal data to servers abroad
Which law criminalizes online child pornography with penalties one degree higher than RA 9775?	RA 10175
A cybercriminal sends phishing emails disguised as government COVID-19 aid notices. This is computer-related fraud under RA 10175.	True
A blogger copies entire copyrighted articles and reposts them online without permission. This violates RA 8293.	True
Which is a cybercrime under RA 10175?	Unauthorized access to a bank system

Created by: Jsean-Ed

"Know" box contains:
Time elapsed:
Retries: