Isaca Isaca Certifications CDPSE Questions & Answers

• Question 1:

  An organization must de-identify its data before it is transferred to a third party. Which of the following should be done FIRST?

  A. Determine the categories of personal data collected.

  B. Remove the identifiers during the data transfer.

  C. Encrypt the data at rest and in motion.

  D. Ensure logging is turned on for the database.

  Correct Answer: A

• Question 2:

  Which of the following BEST enables an organization to ensure consumer credit card numbers are accurately captured?

  A. Access controls

  B. Reconciliation controls

  C. Input validation controls

  D. Input reference controls

  Correct Answer: C

• Question 3:

  Which of the following is MOST important to review before using an application programming interface (API) to help mitigate related privacy risk?

  A. Data taxonomy

  B. Data classification

  C. Data flows

  D. Data collection

  Correct Answer: B

• Question 4:

  An online retailer has recently acquired a travel company and is planning to share its retail customer database with the new company for marketing purposes. Which data protection principle is at GREATEST risk of being violated?

  A. Data portability

  B. Data integrity

  C. Data use limitation

  D. Data transparency

  Correct Answer: C

• Question 5:

  Which of the following BEST ensures an organization's data retention requirements will be met in the public cloud environment?

  A. Service level agreements (SLAs)

  B. Cloud vendor agreements

  C. Data classification schemes

  D. Automated data deletion schedules

  Correct Answer: A

• Question 6:

  A web-based payment service is adding a requirement for biometric authentication. Which risk factor is BEST mitigated by this practice?

  A. User validation failures when reconnecting after lost sessions

  B. Zero-day attacks and exploits

  C. Identity spoofing by unauthorized users

  D. Legal liability from the misuse of accounts

  Correct Answer: C

• Question 7:

  Which of the following should trigger a review of an organization's privacy policy?

  A. Backup procedures for customer data are changed.

  B. Data loss prevention (DLP) incidents increase.

  C. An emerging technology will be implemented.

  D. The privacy steering committee adopts a new charter.

  Correct Answer: D

• Question 8:

  Which of the following is the BEST way to explain the difference between data privacy and data security?

  A. Data privacy protects users from unauthorized disclosure, while data security prevents compromise.

  B. Data privacy protects the data subjects, while data security is about protecting critical assets.

  C. Data privacy is about data segmentation, while data security prevents unauthorized access.

  D. Data privacy stems from regulatory requirements, while data security focuses on consumer rights.

  Correct Answer: B

• Question 9:

  An organization has a policy requiring the encryption of personal data if transmitted through email. Which of the following is the BEST control to ensure the effectiveness of this policy?

  A. Provide periodic user awareness training on data encryption.

  B. Implement a data loss prevention (DLP) tool.

  C. Conduct regular control self-assessments (CSAs).

  D. Enforce annual attestation to policy compliance.

  Correct Answer: C

• Question 10:

  Which of the following is MOST important to include when defining an organization's privacy requirements as part of a privacy program plan?

  A. Data classification process

  B. Privacy management governance

  C. Privacy protection infrastructure

  D. Lessons learned documentation

  Correct Answer: C