Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 11:

  When a government's health division establishes the complete privacy regulation for only the health market, which privacy protection reference model is being used?

  A. Co-regulatory
  B. Sectoral
  C. Comprehensive
  D. Self-regulatory
  B. Sectoral

  ---

  Explanation/Reference:

  Reference: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html

• Question 12:

  Which of the following is the BEST way to limit the organization's potential exposure in the event of consumer data loss while maintaining the traceability of the data?

  A. Encrypt the data at rest.
  B. De-identify the data.
  C. Use a unique hashing algorithm.
  D. Require a digital signature.
  D. Require a digital signature.

• Question 13:

  As part of a major data discovery initiative to identify personal data across the organization, the project team has identified the proliferation of personal data held as unstructured data as a major risk. What should be done FIRST to address this situation?

  A. Identify sensitive unstructured data at the point of creation.
  B. Classify sensitive unstructured data.
  C. Identify who has access to sensitive unstructured data.
  D. Assign an owner to sensitive unstructured data.
  A. Identify sensitive unstructured data at the point of creation.

• Question 14:

  Notice was provided to everyone visiting a company's website indicating what personal data was being collected and for what purpose it was being used. The IT department recently received a new request to use this personal data. Which of the following should be done FIRST?

  A. Determine who needs to opt in to the new data usage scenario.
  B. Request the internal audit function to conduct a privacy audit.
  C. Assess whether the use of data is consistent with the original purpose.
  D. Determine which department is the data owner and refer to them for approval.
  C. Assess whether the use of data is consistent with the original purpose.

• Question 15:

  Which of the following is the MOST effective way to support organizational privacy awareness objectives?

  A. Funding in-depth training and awareness education for data privacy staff
  B. Implementing an annual training certification process
  C. Including mandatory awareness training as part of performance evaluations
  D. Customizing awareness training by business unit function
  A. Funding in-depth training and awareness education for data privacy staff

• Question 16:

  Which of the following is the GREATEST concern for an organization subject to cross-border data transfer regulations when using a cloud service provider to store and process data?

  A. The service provider has denied the organization's request for right to audit.
  B. Personal data stored on the cloud has not been anonymized.
  C. The extent of the service provider's access to data has not been established.
  D. The data is stored in a region with different data protection requirements.
  D. The data is stored in a region with different data protection requirements.

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2014/data-owners-responsibilities-when-migrating-to-the-cloud

• Question 17:

  An organization uses analytics derived from archived transaction data to create individual customer profiles for customizing product and service offerings. Which of the following is the IT privacy practitioner's BEST recommendation?

  A. Anonymize personal data.
  B. Discontinue the creation of profiles.
  C. Implement strong access controls.
  D. Encrypt data at rest.
  A. Anonymize personal data.

• Question 18:

  Which of the following should be the PRIMARY consideration when evaluating transaction-based cloud solutions?

  A. Service level agreements (SLAs)
  B. Joint data protection responsibilities
  C. Data protection capabilities
  D. Elasticity of the service offerings
  B. Joint data protection responsibilities

• Question 19:

  An organization wants to implement a cloud application with a REST application programming interface (API). Which of the following BEST protects against unauthorized access to the API?

  A. Use of a trusted API framework
  B. Restriction of API access to whitelisted IP addresses
  C. Access authentication via API key
  D. Throttling of access requests to the API
  C. Access authentication via API key

• Question 20:

  Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

  A. The applicable privacy legislation
  B. The quantity of information within the scope of the assessment
  C. The systems in which privacy-related data is stored
  D. The organizational security risk profile
  C. The systems in which privacy-related data is stored

  ---

  Explanation/Reference:

  Reference: https://www.sciencedirect.com/topics/computer-science/privacy-impact-assessment