Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 141:

  An employee accidentally sends an email with personal data to the wrong person. Which of the following should the employee do FIRST upon becoming aware of the issue?

  A. Notify the privacy regulator and the impacted data subjects.
  B. Send the recipient another email requesting deletion of the email that was accidentally sent.
  C. Document and file the details of what happened in anticipation of further questioning.
  D. Report the situation to the data privacy officer as it could be a privacy breach.
  C. Document and file the details of what happened in anticipation of further questioning.

• Question 142:

  Which of the following is the BEST way to ensure third-party providers that process an organization's personal data are addressed as part of the data privacy strategy?

  A. Require service level agreements (SLAs) to ensure data integrity while safeguarding confidentiality.
  B. Require data dictionaries from service providers that handle the organization's personal data.
  C. Outsource personal data processing to the same third party.
  D. Require independent audits of the providers' data privacy controls.
  D. Require independent audits of the providers' data privacy controls.

• Question 143:

  Which party should data subject contact FIRST if they believe their personal information has been collected and used without consent?

  A. Privacy rights advocate
  B. Outside privacy counsel
  C. Data protection authorities
  D. The organization's chief privacy officer (CPO)
  C. Data protection authorities

• Question 144:

  Which of the following is MOST important when developing an organizational data privacy program?

  A. Obtaining approval from process owners
  B. Profiling current data use
  C. Following an established privacy framework
  D. Performing an inventory of all data
  B. Profiling current data use

• Question 145:

  Which of the following BEST supports an organization's efforts to create and maintain desired privacy protection practices among employees?

  A. Skills training programs
  B. Awareness campaigns
  C. Performance evaluations
  D. Code of conduct principles
  B. Awareness campaigns

• Question 146:

  An organization is planning a new implementation for tracking consumer web browser activity. Which of the following should be done FIRST?

  A. Seek approval from regulatory authorities.
  B. Conduct a privacy impact assessment (PIA).
  C. Obtain consent from the organization's clients.
  D. Review and update the cookie policy.
  C. Obtain consent from the organization's clients.

• Question 147:

  Which authentication practice is being used when an organization requires a photo on a government-issued identification card to validate an in-person credit card purchase?

  A. Possession factor authentication
  B. Knowledge-based credential authentication
  C. Multi-factor authentication
  D. Biometric authentication
  B. Knowledge-based credential authentication

  ---

  Explanation/Reference:

  Reference: https://www.priv.gc.ca/en/privacy-topics/identities/identification-and-authentication/auth_061013/

• Question 148:

  When tokenizing credit card data, what security practice should be employed with the original data before it is stored in a data lake?

  A. Encoding
  B. Backup
  C. Encryption
  D. Classification
  C. Encryption

  ---

  Explanation/Reference:

  Reference: https://cpl.thalesgroup.com/faq

• Question 149:

  Which of the following is a PRIMARY objective of performing a privacy impact assessment (PIA) prior to onboarding a new Software as a Service (SaaS) provider for a customer relationship management (CRM) system?

  A. To identify controls to mitigate data privacy risks
  B. To classify personal data according to the data classification scheme
  C. To assess the risk associated with personal data usage
  D. To determine the service provider's ability to maintain data protection controls
  C. To assess the risk associated with personal data usage

• Question 150:

  Which of the following is MOST important to ensure when developing a business case for the procurement of a new IT system that will process and store personal information?

  A. The system architecture is clearly defined.
  B. A risk assessment has been completed.
  C. Security controls are clearly defined.
  D. Data protection requirements are included.
  D. Data protection requirements are included.

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/privacy-policy