Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 151:

  Which of the following poses the GREATEST privacy risk for client-side application processing?

  A. Failure of a firewall protecting the company network
  B. An employee loading personal information on a company laptop
  C. A remote employee placing communication software on a company server
  D. A distributed denial of service attack (DDoS) on the company network
  B. An employee loading personal information on a company laptop

• Question 152:

  A software development organization with remote personnel has implemented a third-party virtualized workspace to allow the teams to collaborate. Which of the following should be of GREATEST concern?

  A. The third-party workspace is hosted in a highly regulated jurisdiction.
  B. Personal data could potentially be exfiltrated through the virtual workspace.
  C. The organization's products are classified as intellectual property.
  D. There is a lack of privacy awareness and training among remote personnel.
  A. The third-party workspace is hosted in a highly regulated jurisdiction.

• Question 153:

  An organization wishes to deploy strong encryption to its most critical and sensitive databases. Which of the following is the BEST way to safeguard the encryption keys?

  A. Ensure the keys are stored in a remote server.
  B. Ensure key management responsibility is assigned to the privacy officer.
  C. Ensure the keys are stored in a cryptographic vault.
  D. Ensure all access to the keys is under dual control.
  C. Ensure the keys are stored in a cryptographic vault.

• Question 154:

  Which of the following should be the FIRST consideration prior to implementing an audit trail of access to personal data?

  A. Vulnerability and threat assessments
  B. Service level agreements (SLAs)
  C. Cost-benefit analysis
  D. Sensitivity and regulatory requirements
  C. Cost-benefit analysis

• Question 155:

  Which of the following is the BEST way for an organization to limit potential data exposure when implementing a new application?

  A. Implement a data loss prevention (DLP) system.
  B. Use only the data required by the application.
  C. Encrypt all data used by the application.
  D. Capture the application's authentication logs.
  B. Use only the data required by the application.

• Question 156:

  Which of the following is the BEST way to protect personal data in the custody of a third party?

  A. Have corporate counsel monitor privacy compliance.
  B. Require the third party to provide periodic documentation of its privacy management program.
  C. Include requirements to comply with the organization's privacy policies in the contract.
  D. Add privacy-related controls to the vendor audit plan.
  C. Include requirements to comply with the organization's privacy policies in the contract.

  ---

  Explanation/Reference:

  In GDPR parlance, organizations that use third-party service providers are often, but not always, considered data controllers, which are entities that determine the purposes and means of the processing of personal data, which can include directing third parties to process personal data on their behalf. The third parties that process data for data controllers are known as data processors.

• Question 157:

  Which of the following helps define data retention time in a stream-fed data lake that includes personal data?

  A. Information security assessments
  B. Privacy impact assessments (PIAs)
  C. Data privacy standards
  D. Data lake configuration
  B. Privacy impact assessments (PIAs)

• Question 158:

  Which of the following is the MOST important consideration when determining retention periods for personal data?

  A. Sectoral best practices for the industry
  B. Notice provided to customers during data collection
  C. Data classification standards
  D. Storage capacity available for retained data
  B. Notice provided to customers during data collection

• Question 159:

  Which of the following should an IT privacy practitioner do FIRST before an organization migrates personal data from an on-premise solution to a cloud-hosted solution?

  A. Develop and communicate a data security plan.
  B. Perform a privacy impact assessment (PIA).
  C. Ensure strong encryption is used.
  D. Conduct a security risk assessment.
  B. Perform a privacy impact assessment (PIA).

  ---

  Explanation/Reference:

• Question 160:

  Which of the following BEST enables an organization to ensure consumer credit card numbers are accurately captured?

  A. Access controls
  B. Reconciliation controls
  C. Input validation controls
  D. Input reference controls
  C. Input validation controls