Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 111:

  Which of the following is the BEST way to manage privacy risk associated with outsourcing to a third party?

  A. Utilize a variable sourcing strategy.
  B. Review and approve the vendor's privacy policies.
  C. Require specific controls as part of the contract.
  D. Perform privacy audits of the vendor.
  D. Perform privacy audits of the vendor.

• Question 112:

  An organization decides to outsource its customer personal data analytics to a third party to understand spending habits. Which of the following is the MOST important contractual consideration?

  A. Platform architecture used to process the data
  B. Terms for continuous monitoring of the vendor
  C. Clearly defined data responsibilities of all parties
  D. The vendor's vulnerability management program
  C. Clearly defined data responsibilities of all parties

• Question 113:

  An organization wants to change the originally specified purpose of collected personal data. What must be done NEXT?

  A. Notify data protection authorities.
  B. Obtain consent from data subjects.
  C. Update the enterprise data architecture.
  D. Revise the privacy notice.
  D. Revise the privacy notice.

• Question 114:

  During the design of a role-based user access model for a new application, which of the following principles is MOST important to ensure data privacy is protected?

  A. Segregation of duties
  B. Unique user credentials
  C. Two-person rule
  D. Need-to-know basis
  A. Segregation of duties

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2019/volume-4/effective-user-access-reviews

• Question 115:

  Which of the following is the MOST important consideration when using advanced data sanitization methods to ensure privacy data will be unrecoverable?

  A. Subject matter expertise
  B. Type of media
  C. Regulatory compliance requirements
  D. Location of data
  C. Regulatory compliance requirements

  ---

  Explanation/Reference:

  Reference: https://techreset.com/itad-guides/data-sanitization-and-methods/

• Question 116:

  Which of the following BEST represents privacy threat modeling methodology?

  A. Mitigating inherent risks and threats associated with privacy control weaknesses
  B. Systematically eliciting and mitigating privacy threats in a software architecture
  C. Reliably estimating a threat actor's ability to exploit privacy vulnerabilities
  D. Replicating privacy scenarios that reflect representative software usage
  A. Mitigating inherent risks and threats associated with privacy control weaknesses

  ---

  Explanation/Reference:

  Reference: https://threatmodeler.com/threat-modeling-methodologies-overview-for-your-business/

• Question 117:

  Which of the following is the BEST approach for a local office of a global organization faced with multiple privacy-related compliance requirements?

  A. Focus on developing a risk action plan based on audit reports.
  B. Focus on requirements with the highest organizational impact.
  C. Focus on global compliance before meeting local requirements.
  D. Focus on local standards before meeting global compliance.
  D. Focus on local standards before meeting global compliance.

• Question 118:

  An organization has a policy requiring the encryption of personal data if transmitted through email. Which of the following is the BEST control to ensure the effectiveness of this policy?

  A. Provide periodic user awareness training on data encryption.
  B. Implement a data loss prevention (DLP) tool.
  C. Conduct regular control self-assessments (CSAs).
  D. Enforce annual attestation to policy compliance.
  C. Conduct regular control self-assessments (CSAs).

• Question 119:

  Which of the following is the MOST important topic to cover in privacy awareness training customized for an organization's IT security staff?

  A. Sanctions for misuse of personal information
  B. Roles and responsibilities in responding to privacy-related incidents
  C. Requirements for usage and distribution of personal information
  D. Applicable privacy laws, regulations, and policies
  B. Roles and responsibilities in responding to privacy-related incidents

• Question 120:

  Which of the following is the BEST way to hide sensitive personal data that is in use in a data lake?

  A. Data masking
  B. Data truncation
  C. Data encryption
  D. Data minimization
  A. Data masking

  ---

  Explanation/Reference:

  Reference: https://cprosenjit.medium.com/masking-sensitive-data-in-azure-data-lake-dd47b02b9098