ACE Industry Regulations & Compliance 3 — Questions and Answers
Question 1: The Sarbanes-Oxley Act (SOX) Section 802 makes it a federal crime to destroy, alter, or falsify records in what context?
- Any business record regardless of litigation
- Federal investigations and bankruptcy proceedings (Correct answer)
- Only SEC-regulated company filings
- Records related to healthcare billing
Correct answer: Federal investigations and bankruptcy proceedings
SOX Section 802 criminalizes destruction or falsification of records in connection with federal investigations and bankruptcy proceedings, with penalties up to 20 years imprisonment.
Question 2: When a forensic examiner works on a case involving a publicly traded company, which obligation does SOX impose regarding electronic records retention?
- All records must be kept for 3 years
- Audit work papers must be retained for 7 years (Correct answer)
- Financial records must be retained for 10 years
- Email must be preserved for 5 years
Correct answer: Audit work papers must be retained for 7 years
SOX requires auditors to retain audit work papers and related records for 7 years after completing the audit.
Question 3: Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), what sanction may a court impose if a party fails to preserve electronically stored information (ESI) due to a failure to take reasonable steps?
- Automatic dismissal of the case
- Adverse inference instructions to the jury (Correct answer)
- Criminal contempt charges
- Mandatory third-party forensic audit
Correct answer: Adverse inference instructions to the jury
FRCP Rule 37(e) allows courts to instruct the jury to draw an adverse inference against a party that failed to preserve ESI through culpable conduct.
Question 4: Which NIST publication provides the primary framework for computer security incident handling and is commonly referenced in forensic compliance procedures?
- NIST SP 800-61 (Correct answer)
- NIST SP 800-53
- NIST SP 800-137
- NIST SP 800-92
Correct answer: NIST SP 800-61
NIST SP 800-61, 'Computer Security Incident Handling Guide,' is the foundational reference for establishing incident response procedures in compliance frameworks.
Question 5: A forensic investigator is examining a healthcare organization's systems. Under HIPAA's Security Rule, which category of safeguards requires workforce training and security policies?
- Physical safeguards
- Technical safeguards
- Administrative safeguards (Correct answer)
- Operational safeguards
Correct answer: Administrative safeguards
HIPAA's Administrative Safeguards include workforce security training, security management processes, and written policies — the organizational rather than technical controls.
Question 6: What is the primary legal concern when a forensic examiner acquires a forensic image of an employee's personal smartphone that was used for both business and personal purposes?
- Violation of PCI DSS storage requirements
- Fourth Amendment and employee privacy rights under state law (Correct answer)
- OSHA workplace safety regulations
- Violation of the Wiretap Act only
Correct answer: Fourth Amendment and employee privacy rights under state law
BYOD investigations raise Fourth Amendment issues and state privacy law concerns because employees retain a reasonable expectation of privacy in personal data on their devices.
Question 7: The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to implement a comprehensive information security program primarily to protect what type of information?
- Employee payroll records
- Nonpublic personal information (NPI) of customers (Correct answer)
- Publicly disclosed financial statements
- Interbank transaction logs
Correct answer: Nonpublic personal information (NPI) of customers
GLBA's Safeguards Rule mandates that financial institutions protect nonpublic personal information (NPI) of their customers through a written, comprehensive security program.
ACE Industry Regulations & Compliance 3
The Sarbanes-Oxley Act (SOX) Section 802 makes it a federal crime to destroy, alter, or falsify records in what context?