Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 161:

  Which key stakeholder within an organization should be responsible for approving the outcomes of a privacy impact assessment (PIA)?

  A. Data custodian
  B. Privacy data analyst
  C. Data processor
  D. Data owner
  D. Data owner

  ---

  Explanation/Reference:

  Reference: https://ico.org.uk/media/1042196/trilateral-full-report.pdf

• Question 162:

  Which of the following is the BEST course of action to manage privacy risk when a significant vulnerability is identified in the operating system (OS) that supports an organization's customer relationship management (CRM) system?

  A. Apply OS patching to fix the vulnerability immediately.
  B. Manage system permissions and access more strictly.
  C. Enable comprehensive logging of activities at the OS level.
  D. Perform a vulnerability assessment to determine the impact.
  B. Manage system permissions and access more strictly.

• Question 163:

  Which of the following is the PRIMARY objective of privacy incident response?

  A. To ensure data subjects impacted by privacy incidents are notified.
  B. To reduce privacy risk to the lowest possible level
  C. To mitigate the impact of privacy incidents
  D. To optimize the costs associated with privacy incidents
  C. To mitigate the impact of privacy incidents

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2020/volume-4/incident-response-models

• Question 164:

  Which of the following is MOST important to consider when managing changes to the provision of services by a third party that processes personal data?

  A. Changes to current information architecture
  B. Updates to data life cycle policy
  C. Business impact due to the changes
  D. Modifications to data quality standards
  B. Updates to data life cycle policy

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/a-riskbased-management-approach-to-thirdparty-data-security-risk-and-compliance

• Question 165:

  A new marketing application needs to use data from the organization's customer database. Prior to the application using the data, which of the following should be done FIRST?

  A. Ensure the data loss prevention (DLP) tool is logging activity.
  B. De-identify all personal data in the database.
  C. Determine what data is required by the application.
  D. Renew the encryption key to include the application.
  C. Determine what data is required by the application.

• Question 166:

  Which of the following should be done FIRST to address privacy risk when migrating customer relationship management (CRM) data to a new system?

  A. Develop a data migration plan.
  B. Conduct a legitimate interest analysis (LIA).
  C. Perform a privacy impact assessment (PIA).
  D. Obtain consent from data subjects.
  C. Perform a privacy impact assessment (PIA).

• Question 167:

  Which of the following is MOST important to review before using an application programming interface (API) to help mitigate related privacy risk?

  A. Data taxonomy
  B. Data classification
  C. Data flows
  D. Data collection
  B. Data classification

• Question 168:

  An organization's data destruction guidelines should require hard drives containing personal data to go through which of the following processes prior to being crushed?

  A. Low-level formatting
  B. Remote partitioning
  C. Degaussing
  D. Hammer strike
  A. Low-level formatting

  ---

  Explanation/Reference:

  Reference: https://it.brown.edu/computing-policies/electronic-equipment-disposition-policy/data-removal-recommendations

• Question 169:

  Which of the following is the BEST control to detect potential internal breaches of personal data?

  A. Data loss prevention (DLP) systems
  B. Classification of data
  C. Employee background checks
  D. User behavior analytics tools
  D. User behavior analytics tools

• Question 170:

  Which of the following is the MOST effective method to obfuscate personal data in a public cloud environment?

  A. Tokenization
  B. Digital hashing
  C. Multi-factor authentication
  D. Access control
  A. Tokenization