Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 1:

  A global organization is planning to implement a customer relationship management (CRM) system to be used in offices based in multiple countries. Which of the following is the MOST important data protection consideration for this project?

  A. Industry best practice related to information security standards in each relevant jurisdiction
  B. Identity and access management mechanisms to restrict access based on need to know
  C. Encryption algorithms for securing customer personal data at rest and in transit
  D. National data privacy legislative and regulatory requirements in each relevant jurisdiction
  D. National data privacy legislative and regulatory requirements in each relevant jurisdiction

• Question 2:

  When contracting with a Software as a Service (SaaS) provider, which of the following is the MOST important contractual requirement to ensure data privacy at service termination?

  A. Encryption of customer data
  B. Removal of customer data
  C. De-identification of customer data
  D. Destruction of customer data
  D. Destruction of customer data

• Question 3:

  Which method BEST reduces the risk related to sharing of personal data between a software as a service (SaaS) customer and the third party storing it?

  A. Data hashing
  B. Data encryption
  C. Data pseudonymization
  D. Data anonymization
  D. Data anonymization

• Question 4:

  It is MOST important to consider privacy by design principles during which phase of the software development life cycle (SDLC)?

  A. Application design
  B. Requirements definition
  C. Implementation
  D. Testing
  D. Testing

  ---

  Explanation/Reference:

  Reference: https://securityboulevard.com/2019/10/incorporating-privacy-by-design-in-a-software-development-life-cycle/

• Question 5:

  Which of the following should be done FIRST when a data collection process is deemed to be a high-level risk?

  A. Conduct a privacy impact assessment (PIA).
  B. Create a system of records notice (SORN).
  C. Perform a business impact analysis (BIA).
  D. Implement remediation actions to mitigate privacy risk.
  A. Conduct a privacy impact assessment (PIA).

• Question 6:

  Which of the following is the BEST way to convert personal information to non-personal information?

  A. Encryption
  B. Pseudonymization
  C. Hashing
  D. Anonymization
  B. Pseudonymization

  ---

  Explanation/Reference:

• Question 7:

  The BEST way for a multinational organization to ensure the comprehensiveness of its data privacy policy is to perform an annual review of changes to privacy regulations in:

  A. all data sectors in which the business operates.
  B. all countries with privacy regulations.
  C. the region where the business is incorporated.
  D. all jurisdictions where corporate data is processed.
  D. all jurisdictions where corporate data is processed.

• Question 8:

  Which of the following is the PRIMARY benefit of implementing policies and procedures for system hardening?

  A. It increases system resiliency.
  B. It reduces external threats to data.
  C. It reduces exposure of data.
  D. It eliminates attack motivation for data.
  B. It reduces external threats to data.

  ---

  Explanation/Reference:

• Question 9:

  Which of the following should an IT privacy practitioner do FIRST following a decision to expand remote working capability to all employees due to a global pandemic?

  A. Evaluate the impact resulting from this change.
  B. Revisit the current remote working policies.
  C. Implement a virtual private network (VPN) tool.
  D. Enforce multi-factor authentication for remote access.
  B. Revisit the current remote working policies.

• Question 10:

  Which of the following MUST be included in a contract with a vendor that will be processing personal data?

  A. A clause to hash all data that is processed or stored by the vendor
  B. A clause to prohibit the vendor from sending data to third parties
  C. A clause to report breaches in a timely manner to the organization
  D. A clause to require the vendor to comply with industry best practices
  C. A clause to report breaches in a timely manner to the organization