Free ISC2 CCSP Actual Exam Questions - Question 12 Discussion

It’s definitely D. Sharing detailed info plus advice helps customers act quickly, which is crucial after a breach. A and B leave too much out—either too little info or ignoring customers’ worries. C misses a lot since you can’t rely on customers to report suspicious activity first; the org needs to be proactive and open. For healthcare, compliance means full disclosure with clear guidance, so D fits best.

D imo, it’s the only one that actually addresses the issue head-on. Just a social media post (A) wouldn’t be enough, and ignoring customer concerns like in B feels reckless. Also, only contacting customers who noticed problems (C) leaves too many in the dark. Healthcare data breaches can have serious consequences, so customers need clear info on what happened and how to protect themselves, which D covers well.

A/B no good—too vague or ignoring customers’ concerns. D is the only thorough option here.

C imo, since just contacting customers who noticed issues ignores many who could be affected but haven’t spotted anything yet. D covers a wider audience, which feels safer.

Makes sense to go with D here. It’s the only option that balances being transparent and helping customers act, which is crucial in healthcare breaches. A and B are too vague or one-sided, and C misses customers who might be affected but haven’t noticed anything suspicious yet. D covers all bases by informing everyone and helping them stay safe.

It’s D, since only full info plus guidance meets both customer care and legal needs here.

D, because full disclosure with clear guidance is crucial for compliance and trust.

It’s D because transparency is key, especially in healthcare. Customers need to know the risks and what to do next, not just vague updates or limited info. Options A, B, and C don’t cover all that.

D imo, customers need to know what happened and how it affects them. Keeping them informed with clear steps helps build trust and meets compliance.