Examkin

Question

Difficulty: MediumData Privacy and Compliance Regulations

A systems administrator at a cloud software vendor is updating data governance policies for a database cluster that processes payment billing information and manages subscriber accounts for European Union citizens. Which of the following compliance controls must the administrator implement to align with the governing regulatory frameworks? (Select TWO).

  1. Providing mechanisms for users to request permanent deletion of their account profile data under the GDPR right to be forgotten.Answer
  2. Prohibiting the post-authorization storage of card verification value (CVV/CVC) codes in compliance with PCI-DSS.Answer
  3. C
    Enforcing mandatory HIPAA encryption standards on all non-health subscriber telemetry logs.
  4. D
    Applying FERPA directory privacy controls to commercial user payment card records.

Answer

The administrator must implement mechanisms for users to request permanent deletion of profile data under GDPR and prohibit the post-authorization storage of card verification codes under PCI-DSS.
Handling data from EU citizens brings the platform under the scope of GDPR, which includes data subject rights such as the right to be forgotten (erasure). Storing and processing payment card details subjects the organization to PCI-DSS, which strictly forbids storing sensitive authentication data like CVV/CVC codes after authorization.

Step-by-Step Solution

1
Identify the regulatory frameworks triggered by the data types described in the scenario.
EU citizen account profiles trigger GDPR requirements; handling payment card transactions triggers PCI-DSS standards.
Regulatory compliance depends directly on the classification and jurisdiction of the processed data.
2
Evaluate the technical and operational controls mandated by GDPR for EU consumer data.
GDPR requires providing data subjects with the right to erasure ('right to be forgotten').
Data subjects in the EU maintain rights over how their personal data is retained and deleted.
3
Evaluate the restrictions imposed by PCI-DSS on payment card storage.
PCI-DSS explicitly forbids storing card verification values (CVV/CVC) post-authorization.
Limiting stored sensitive authentication data reduces risk in the event of a payment system breach.

Key Concept

Matching data privacy regulations (GDPR, PCI-DSS, HIPAA, FERPA) to their respective data scopes and technical requirements.
Rate this question

Topics

Data Privacy and Compliance Regulations

More questions from this topic