ITN 267

There are ______regional Federal Reserve Banks, which serve different geographic districts.

12

COBRA benefits generally last a maximum of:

18 months

To be COPPA-compliant, a privacy policy must provide "assurance that participation is not conditioned on data collection." Which of the following statements offer the best explanation of this criterion?

A Web site can't require children to submit contact details in order to be allowed to use the site. Web sites are not allowed to collect more information than necessary for a child to participate in an activity.

Which of the following statements does not apply to credit unions?

A credit union must have a three-member board of directors.

HIPAA's _____________________ provisions are designed to encourage "the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information."

Administrative Simplification

The District of Columbia and 45 states have enacted breach notification laws, which require an organization to notify state residents if it experiences a security breach that involves the personal information of the residents. Which group of four states does not have a breach notification law?

Alabama, Kentucky, New Mexico, and South Dakota

Which of the following correctly summarizes an employer's right to monitor telephone conversations?

An employer has right to monitor telephone conversations in the ordinary course of business without a court order.

___________________ allows employees and their families to continue health coverage when they lose or change a job.

COBRA

Which of the following is a true statement regarding COPPA and CIPA rules?

COPPA defines a minor as anyone under the age of 13 years, while CIPA defines a minor as someone under the age of 17 years.

The Payment Card Industry Security Standards Council (PCI Council) is made up of representatives of the major credit card companies. The major credit card companies are also called credit card brands. Which of the following is not one of the major brands?

Chase Bank

Collection and use of a child's personal information, such as name, e-mail address, or social security number, by a Web site operate is governed by:

Children's Online Privacy Protection Act (COPPA)

In 2013, a social media company paid $800,000 to settle charges with the Federal Trade Commission (FTC). The company had an application that allowed children to create journals and share those journals online. Children could also post photos and share location information. The company collected the birth dates of 3,000 children before getting parental permission. The FTC alleged that the company violated which of the following?

Children's Online Privacy Protection Act (COPPA)

The ________________________ protects the personal information of children online.

Children's Online Privacy Protection Act (COPPA)

____________ is demonstrated by the processes and procedures that an organization uses to meet the law.

Compliance

______________ means that only people with the right permission can access and use information.

Confidentiality

_______________ governs the prosecution of those charged with serious offenses against public order, such as murder.

Criminal law

Which of the following is not included the Electronic Communications Privacy Act?

Driver's Privacy Protection Act

In which of the following areas of the workplace is an employee most likely to have a reasonable expectation of privacy?

Employee lounge

Which of the following was enacted by Congress in response to growth in identity theft crime?

Fair and Accurate Credit Transaction Act (FACTA) of 2003

A company that created virtual online gaming worlds agreed to pay $3 million in 2011 to settle charges with the FTC. The FTC alleged that the company improperly collected and disclosed the personal information of thousands of children without parental consent. This is the largest civil penalty so far in a Children's Internet Protection Act (CIPA) action. T or F

False

A contract tells an organization how it must act and the consequences for failing to act properly. T or F

False

A covered entity is required, upon a person's request, to correct data in the person's PHI. T or F

False

A keystroke logger is harmful code intentionally left on a computer system. It lies dormant for a certain period, and when specific conditions are met, it "explodes" and carries out its malicious function. T or F

False

All information—no matter how sensitive—should have the extensive protection of safeguards. T or F

False

Because torts are a part of the law, somebody who steals your identity will be prosecuted whether or not you press charges. T or F

False

Before the PCI Council was formed, all major credit card companies shared the same security requirements that applied to the credit cards that they issued. T or F

False

Citizens and members of the legal profession are all bound by the terms of the common law. T or F

False

First-party cookies are set by one Web site but readable by another site, and third-party cookies are exchanged between a user's browser and the Web site the user is visiting. T or F

False

In situations when a covered entity may use or disclose PHI to the extent that it's required by law, the covered entity may only do so in response to a subpoena issued by a grand jury. T or F

False

Individual consumers are the targets of hackers far more often that financial institutions. T or F

False

Passive data collection practices are obvious to the customer, whereas active data collection happens secretly and may use devices such as cookies and Web beacons. T or F

False

Patches exacerbate vulnerabilities, because they merely mask problems but do not offer solutions. T or F

False

Phishing is a form of Internet fraud in which attackers sift through trash to discover personal information. It's an issue because individuals and organizations dispose of personal information in unsecure ways. T or F

False

Private, personal information may become public under the Freedom of Information Act. T or F

False

The American Library Association and the American Civil Liberties Union sued the U.S. government. They claimed CIPA violated the free speech rights of adults. In 2002 the U.S. District Court for the Eastern District of Pennsylvania agreed that CIPA violated First Amendment rights. The U.S. District Court said that the government could not enforce CIPA. The U.S. government appealed that decision, and the lawsuit went to the U.S. Supreme Court. In United States et al. v. American Library Association, Inc. et al. in 2003, the U.S. Supreme Court struck down the law as unconstitutional. T or F

False

The C-I-A triad refers to the way that the Central Intelligence Agencies classifies sensitive information. T or F

False

The Constitution specifies the basic lawmaking process. A bill is the initial draft of a potential law. Only one chamber of Congress needs to approve the bill, and the president must sign it before it becomes a law. T or F

False

The DSS offers a single approach to safeguarding sensitive cardholder data for all credit card issuers. It recommends 12 basic categories of security requirements that should be followed in order to protect credit card data. T or F

False

The FCC rules specifically state that the U.S. federal government may establish the criteria for making a determination that a filter is CIPA compliant. T or F

False

The FDIC insures deposit accounts in the event of bank failure. If a bank fails, the FDIC returns the money that a customer put in the bank, no matter how great or small the amount. T or F

False

The FTC enforces GLBA for any financial institution that isn't regulated by one of the other agencies. Like the other agencies, the FTC may bring an action against any financial institution that doesn't comply with GLBA. The FTC rarely pursues GLBA enforcement actions. T or F

False

The Federal Communications Commission (FCC) mandates that a TPM should be 100 percent effective. This effectiveness is determined by the CIPA and the FC. T or F

False

The HHS said that the Privacy Rule has two main purposes: 1) to allow consumers to control the use of their health information (including providing consumers with a way to access their health information) and 2) to improve health care in the U.S. by restoring consumer trust in the health care system. T or F

False

The O.J. Simpson criminal and civil trials illustrate the basic difference between criminal and civil law, because O.J. Simpson was found "guilty" of murder in the criminal case, and he was found not liable in the civil case. The reason for the apparently inconsistent results is that the murder case was in the criminal system and the wrongful death case was a civil action. T or F

False

The Patriot Act made three major changes to the Electronic Communications Privacy Act (ECPA), and as a result, electronic communications privacy has greater government protections. T or F

False

The Supreme Court has exclusive original jurisdiction to decide cases about disputes between state governments and exercises this original jurisdiction with frequency. T or F

False

The Supreme Court is under obligation to review a decision from the U.S. Court of Appeals, as guaranteed by the writ of certiorari. T or F

False

The United States Code is the United States' comprehensive data privacy law. T or F

False

The United States has one comprehensive data protection law and relies on the Federal Trade Commission (FTC) to ensure compliance. T or F

False

The domain of Telecommunications and Network Security describes how to protect information systems resources during their normal operational state. It includes items such as vulnerability management and incident response activities. T or F

False

The following is an example of an inadvertent disclosure: a patient going to a hospital to pay a bill briefly views another patient's payment information on the billing clerk's computer monitor. The first patient can see this information only briefly before the clerk accesses the patient's own record. T or F

False

The portrayal in a false light involves appropriating, or taking, an individual's name or likeness without their consent. T or F

False

While each federal district court also has its own bankruptcy court. The Constitution gives state governments the sole power over bankruptcy law. T or F

False

While external and internal attackers are both deliberate threats, only internal attackers seek to embarrass an organization. T or F

False

The Family Policy Compliance Office (FPCO) provides oversight for the ____________________.

Family Educational Rights and Privacy Act (FERPA)

The _________________ requires schools to protect students' records.

Family Educational Rights and Privacy Act (FERPA)

The purpose of the ______________________ is to address financial uncertainty and provide the nation with a more stable economy.

Federal Reserve System

The mission of the _____________________ is to protect consumers and to make sure that business is competitive by eliminating practices harmful to business.

Federal Trade Commission FTC

Some people believe that COPPA requirements violate freedom of speech without censorship guaranteed by the ______________ Amendment.

First

Which of the following U.S. Constitution amendments contribute to the right of privacy?

First, Third, and Fourth Amendments

Which Act established the public's right to request information from federal agencies?

Freedom of Information Act

____________________ forbids a new employer's health plan from denying health coverage for some reasons and prohibits discrimination against workers based on certain conditions such as pregnancy.

HIPAA

Which of the following is true about COBRA and HIPAA?

HIPAA regulates discrimination based on health history while COBRA ensures health coverage continues.

What is the purpose of Executive Order 13526?

It describes rules for using and a system of for classifying national security information.

Which of the following is a true statement about the Court of Appeals?

It's court of appellate jurisdiction & it does not review the facts of a case or additional evidence.

A _____________ is a method of controlled entry into a facility and provides access to secure areas such as a research lab or data center.

Mantrap

Which of the following statements summarizes why the window of vulnerability is shrinking?

More people are interested in information security, and have developed the skills to find new vulnerabilities.

Based on the descriptions given, what film does NOT exemplify the concept of social engineering?

Office Space: Three friends and disgruntled coworkers at a tech company discover that the company's accounting system has a computer glitch that calculates certain financial information to six decimal points, but only records the first two decimal points in the accounting files and then regularly discards the remaining fractions of pennies. When the trio learns their jobs are in jeopardy, they create a computer program that diverts the discarded fractions of pennies into a bank account they share. They believe that the company will continue to pay them in installments small enough that the company will never notice but that will lead to a very large amount of money over time.

____________ is the practice of tracking a user's actions on the Internet in order to create a user profile.

Online profiling

A merchant of an e-commerce Web site wants to accept credit cards as a form of payment. Which of the following must the merchant follow to ensure the safety of those payments?

PCI DSS

Which of the follow is not one of the rights that parents are guaranteed under COPPA?

Parents will be notified by a Web site if is collecting an e-mail address to respond to a one-time request from a child.

In which of the following types of communication is phishing least likely to occur?

Phone calls

What is PIA?

Privacy Impact Assessment

Which statement about privacy is NOT true?

Privacy means that a person can specify the collection, use, and sharing of their data.

Required by the Fair and Accurate Credit Transaction Act of 2003 (FACTA), which of the following is an anti-identity theft rule created by federal bank regulatory agencies (the Fed, FDIC, OTS, OCC, and NCUA) and the FTC?

Red Flags Rule

_______________ is the process of reviewing known vulnerabilities and threats.

Risk Analysis

In November 2004, the FTC filed a complaint against Nationwide Mortgage Group, Inc. In its complaint, the FTC stated that Nationwide collected sensitive customer information, but that it had no policies and procedures in place to protect that information. It also stated that Nationwide failed to monitor its computer network for vulnerabilities that would expose stored customer information to attack. Which of the following rules did the Nationwide violate?

Safeguards Rule

Which Gramm-Leach-Bliley Act rule requires federal bank regulatory agencies, the SEC, and the FTC to issue security standards for the institutions that they regulate?

Safeguards Rule

In what ways can you classify safeguards?

Safeguards can be classified by how they work or how they act.

The HIPAA ______________________ states how covered entities must protect the confidentiality, integrity, and availability of electronic personal health information.

Security Rule

All of the following are ways to protect confidentiality except:

Shoulder surfing

Which of the following is not a true statement?

State constitutions are nearly identical versions of the U.S. Constitution.

_____________________ are tools that filter offensive content.

Technology protection measures (TPM)

The doctrine of precedent is one of the most important traditions in the American legal system. Which of the following statements accurately summarizes how the Plessy v. Ferguson (1896) and Brown v. Board of Education (1954) cases dramatically illustrated how precedent can change and how changing precedent can have a significant impact on society?

The Brown decision was remarkable because the Court departed from the precedent set in Plessy. In fact, the Court specifically rejected the reasoning that it had used to support its decision in Plessy. Brown established new legal precedent that separate but equal laws are unconstitutional.

Which of the following is true about U.S. Supreme Court justices?

They are nominated by the president.

A Web beacon is a small, invisible electronic file that is placed on a Web page or in an e-mail message. It counts users who visit a Web page. T or F

True

A limited data set is PHI that doesn't contain any data that identifies a person. T or F

True

A major privacy concern of social networking includes information sharing. T or F

True

A material change is a significant change in an organization's operating practices. Material changes can affect how people understand their rights or interact with an organization. T of F

True

An Internet safety policy must educate minors about appropriate online behavior. This includes how to use social networking Web sites and chatrooms safely. The policy must include information on how to recognize cyberbullying. It also must tell minors how to respond to cyberbullying. T or F

True

Appellate jurisdiction is the power of a court to review a decision made by a lower court T or F

True

As defined by HIPAA, the term "covered entities" means: health care providers, health care clearinghouses, and health plans that transmits certain types of health information in electronic form. T or F

True

Biometric data is considered personally identifiable information. T or F

True

CIPA has two main requirements. The first is that schools and libraries that accept E-Rate funding must implement technologies that filter offensive visual content so that minors don't access it. The second requirement is that schools implement an Internet safety policy. T or F

True

COPPA has several rules for getting parental consent. One of them is that the parent's consent is required to collect, use, or disclose the child's information. The notice must state that the operator will not collect, use, or disclose the child's information without parental consent. T or F

True

Confidential describes information that could cause damage to U.S. security if disclosed to an unauthorized person. This is the lowest data classification level. T or F

True

Covered entities must keep records of how they disclose a person's PHI. Under the Privacy Rule, a person has the right to receive an accounting of how the covered entity has used or disclosed the person's PHI. T or F

True

FERPA requires schools to provide an annual notification to students and parents. This notice lets parents and eligible students know what their FERPA rights are. The annual notification also must state how to file a complaint with the Department of Education if the school violates any of FERPA's provisions. T or F

True

Federal courts can hear only the following kinds of cases: 1) Disputes regarding federal laws or constitutional issues and 2) Disputes between residents of different states where the amount of money in controversy is greater than $75,000. T or F

True

Health care operations are actions that support the covered entity's business. T or F

True

Identity Theft Prevention Programs are required to detect, prevent, and mitigate identity theft in covered accounts. The written program must address both new and existing covered accounts. T or F

True

In 1973, the U.S. Supreme Court decided that for material to be identified as "obscene," it must meet three conditions: 1) appeals predominantly to prurient interests—prurient indicates a morbid, degrading, and unhealthy interest in sex; 2) depicts or describes sexual conduct in a patently offensive way, and 3) lacks serious literary, artistic, political, or scientific value. T or F

True

In general, a covered entity may disclose PHI to certain governmental entities without consent for certain purposes that include, but are not limited to, the following: to provide vital statistics, to control communicable diseases, and to report abuse and neglect. T or F

True

In the federal system, intermediate appellate courts are called the U.S. Courts of Appeals. There are 13 Courts of Appeals. The 94 district courts are grouped into 12 geographical circuits. T or F

True

Nonpublic personal information (NPI) is personally identifiable financial information that a consumer gives to a financial institution. NPI also includes private information that an institution gets from other sources. It includes lists or descriptions of consumers that are prepared by using this kind of information. T or F

True

Organizations have a number of options for responding to risk, which include risk avoidance, risk mitigation, and risk transfer. T or F

True

Physical safeguards are actions that an organization takes to protect its actual, tangible resources. They keep unauthorized individuals out of controlled areas. T or F

True

Pretexting, which is also known as social engineering, is the act of trying to gain access to customer information without proper authority to do so. T or F

True

Schools are required to make and provide copies of the educational records in special circumstances. If a parent does not live within commuting distance to the school and cannot come to the school to inspect the records, then the school must provide the parent with copies. T or F

True

States usually have two appellate courts: a state intermediate appellate court and a state supreme court. States usually have both types of courts. T or F

True

Subject matter areas of law are areas in which an attorney might specialize, and procedural law deals with the processes that courts use to decide cases. T or F

True

The Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1980 protects patient information about alcohol or drug abuse. This law applies to any federally assisted alcohol or drug abuse treatment program, and it states that these programs may not disclose patient information without consent. T or F

True

The Federal Financial Institutions Examination Council (FFIEC) promotes uniform practices among the federal financial institutions. Its purpose is to: 1) establish principles and standards for the examination of federal financial institutions; 2) develop a uniform reporting system for federal financial institutions; 3) conduct training for federal bank examiners; 4) make recommendations regarding bank supervision matters, and 5) encourage the adoption of uniform principles and standards by federal and state banks. T or F

True

The Gramm-Leach-Bliley Act requires financial institutions to protect consumer financial information by complying with the Privacy Rule, the Safeguards Rule, and the Pretexting Rule T or F

True

The National Bank Act of 1864 established the national banking system in the United States. The Act still governs U.S. national banks even though Congress has updated it many times since 1864. T or F

True

The PCI Council was formed in 2006 to create safeguards designed to protect credit card data. Any merchant or service provider who accepts credit cards must follow the safeguards. T or F

True

The Tenth Amendment says, "The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people." T or F

True

The U.S. Supreme Court is the final source of authority for issues involving U.S. federal laws. T or F

True

The three conditions for defining obscenity are known as the Miller test. T of F

True

Threats fall into four categories: Human, Natural, Technology and Operational, and Physical and Environmental. T or F

True

Types of information that most people consider private include financial information, health information, and criminal history data. T or F

True

Under the Fair Credit Reporting Act of 1970 (FCRA), consumers can stop financial institutions from sharing their credit report or credit applications with affiliates. T or F

True

Under the Privacy Rule, there are only two situations in which a covered entity must disclose PHI: 1) when a person requests access to his or her PHI, and 2) when a person requests that their PHI be sent directly to a third party. T or F

True

How might the average person use cookies in a beneficial way?

You save an image of a relaxing, cloud-filled sky that appears every time you log-on to your Twitter account.

What is the ISO/IEC 27002?

a reference guide for standardized computing practices for large organizations

The 2006 U.S. Federal Trade Commission (FTC) alleged that Zango, Inc., an Internet marketing company, had used unfair and deceptive methods to download _____________ onto computers.

adware

In the legal system, compliance is the action of following applicable laws and rules and regulations. Which of the following processes would not be used to demonstrate compliance:

allowing employees in an organization to create policies for self-governance documents to comply with legal or regulatory requirements at the employees' discretion

Which of the following must be protected per PCI DSS requirements?

an e-commerce Web server

Which of the following roles is not included in the domain of a creditor?

collects payment in arrears

What is a small string of text that a Web site stores on a user's computer?

cookie

All of the following are true statements about the American legal system except:

decisions by each branch of government may be overturned by administrative agency courts

Schools may make the following type of disclosure without obtaining parental or student consent:

disclosure of any information to any school official with a need to know

A covered entity doesn't have to account for every PHI disclosure that it makes. The Privacy Rule states that some kinds of disclosures don't have to be included in an accounting. Any disclosure not specifically excluded must be included and tracked. Which of the following disclosures does not need to be tracked?

disclosures made to carry out treatment, payment, and health care activities

The three branches of the federal government are:

executive, legislative, and judicial

The Florida A&M case illustrates which of the following about safeguards?

how safeguards protect the integrity of computer systems

FERPA applies to any education agencies or institutions that receive funding from the U.S. Department of Education (ED). Which of the following in not an educational agency or institution?

non-profit organizations that offer educational programs

COPPA requires Web site operators collecting information from children to:

obtain parental consent

Audits are ___________ performed by independent organizations.

occasionally

Which of the following parties is not among those who would share an individual's health information?

potential employers

With respect to protected health information, HIPAA:

prohibits state laws that are contrary to HIPAA

PHI refers to:

protected health information

Which of the following is not true about the Consolidated Omnibus Budget Reconciliation Act of 1986?

requires former employers to continue paying health insurance premiums for a minimum of one year

All of the following are characteristics of HIPAA except:

requires that employers offer health coverage

Which of the follow is not a method that web site operators can use to distinguish children from adults?

requiring a name and address

___________________ is used to assess the vulnerabilities and threats that could harm electronic protected health information (EPHI).

risk analysis

According to the federal Administrative Procedure Act, an agency is any governmental authority besides Congress and the courts. Which function does not fall under the category of what an agency does?

sets precedents

The separation of duties principle requires which of the following practices?

that two or more employees must split critical task functions so that no employee knows all of the steps of the critical task

Online Privacy Alliance (OPA) is an organization of companies dedicated to protecting online privacy. Members of OPA agree to create a privacy policy for a customer that is easy to read and understand. Which of the following provisions is not included in the policy?

the option of choosing who sees the data

Which of the following statements best captures the function of the Federal Trade Commission (FTC)?

to promote consumer protection and eliminate practices that are harmful to competitive business

A ______________ is some kind of wrongful act that harms or hurts a person.

tort