ACE Industry Regulations & Compliance 2 — Questions and Answers
Question 1: Under HIPAA, what is the maximum civil penalty per violation category when the covered entity demonstrates willful neglect and fails to correct the violation?
- $10,000
- $50,000
- $1,000,000
- $1,900,000 (Correct answer)
Correct answer: $1,900,000
HIPAA civil penalties for willful neglect not corrected cap at $1,919,173 per violation category per calendar year (adjusted for inflation from the original $1,500,000).
Question 2: Which U.S. federal law specifically governs the interception of electronic communications and sets standards for lawful access to stored electronic data?
- Privacy Act of 1974
- Electronic Communications Privacy Act (ECPA) (Correct answer)
- Computer Fraud and Abuse Act (CFAA)
- Freedom of Information Act (FOIA)
Correct answer: Electronic Communications Privacy Act (ECPA)
The ECPA of 1986 governs wiretapping, electronic surveillance, and access to stored communications, making it central to digital forensic legal compliance.
Question 3: A forensic examiner discovers evidence on a corporate server that may relate to insider trading. Which regulatory body's guidelines would most directly govern the handling and reporting of this financial evidence?
- FINRA
- SEC (Correct answer)
- FDIC
- OCC
Correct answer: SEC
The SEC (Securities and Exchange Commission) has primary jurisdiction over insider trading violations and governs evidence handling in related investigations.
Question 4: What does the 'chain of custody' requirement primarily ensure under Federal Rules of Evidence (FRE) Rule 901?
- Evidence is encrypted during transport
- Evidence can be authenticated as what it is claimed to be (Correct answer)
- Evidence is stored in a FIPS-compliant manner
- Evidence is backed up to a certified laboratory
Correct answer: Evidence can be authenticated as what it is claimed to be
FRE Rule 901 requires authentication — demonstrating that evidence is what the proponent claims it is — which chain of custody documentation directly supports.
Question 5: Under GDPR, when conducting digital forensic investigations involving EU citizens' data, what is the maximum fine for serious violations?
- €10 million or 2% of global annual turnover
- €20 million or 4% of global annual turnover (Correct answer)
- €50 million or 5% of global annual turnover
- €100 million or 10% of global annual turnover
Correct answer: €20 million or 4% of global annual turnover
GDPR's highest tier fines are €20 million or 4% of total global annual turnover, whichever is higher, for the most serious infringements.
Question 6: Which standard framework provides a set of controls specifically designed for protecting cardholder data in payment systems, directly relevant when examining retail point-of-sale breaches?
- ISO 27001
- NIST SP 800-53
- PCI DSS (Correct answer)
- SOX
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) defines requirements for protecting cardholder data and is the primary framework for payment system breach investigations.
Question 7: In a U.S. federal investigation, what legal authority does a forensic examiner need to search and seize digital evidence from a third-party cloud provider?
- A civil subpoena
- A search warrant or court order under 18 U.S.C. § 2703 (Correct answer)
- Written consent from the account holder only
- A National Security Letter
Correct answer: A search warrant or court order under 18 U.S.C. § 2703
Under the Stored Communications Act (18 U.S.C. § 2703), law enforcement must obtain a warrant, court order, or subpoena depending on the type and age of stored data.
