Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 201:

  Which of the following is the best way to reduce the risk of compromised credentials when an organization allows employees to have remote access?

  A. Enable whole disk encryption on remote devices.
  B. Purchase an endpoint detection and response (EDR) tool.
  C. Implement multi-factor authentication.
  D. Deploy single sign-on with complex password requirements.
  C. Implement multi-factor authentication.

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2020/volume-14/five-key-considerations-when-securing-a-work-from-home-workforce

• Question 202:

  Which of the following scenarios poses the GREATEST risk to an organization from a privacy perspective?

  A. The organization lacks a hardware disposal policy.
  B. Emails are not consistently encrypted when sent internally.
  C. Privacy training is carried out by a service provider.
  D. The organization's privacy policy has not been reviewed in over a year.
  D. The organization's privacy policy has not been reviewed in over a year.

• Question 203:

  An organization that stores personal information is receiving an excessive number of alerts from its intrusion detection system (IDS), causing follow-through to become unfeasible. What should be done FIRST?

  A. Implement an IDS with artificial intelligence (AI) features.
  B. Conduct a root cause analysis.
  C. Perform a privacy impact assessment (PIA).
  D. Reconfigure IDS alert rules.
  B. Conduct a root cause analysis.

• Question 204:

  Which of the following is the PRIMARY reason that a single cryptographic key should be used for only one purpose, such as encryption or authentication?

  A. It eliminates cryptographic key collision.
  B. It minimizes the risk if the cryptographic key is compromised.
  C. It is more practical and efficient to use a single cryptographic key.
  D. Each process can only be supported by its own unique key management process.
  B. It minimizes the risk if the cryptographic key is compromised.

• Question 205:

  Which of the following is the MOST critical action for an organization prior to tracking user activity in its applications?

  A. Providing notification to users of the organization's privacy policies
  B. Establishing a data classification scheme
  C. Identifying and validating users' countries of residence
  D. Requesting users to read and accept the organization's privacy notice
  A. Providing notification to users of the organization's privacy policies

• Question 206:

  Which of the following is MOST useful for understanding an organization's approach towards privacy compliance?

  A. Data classifications
  B. Data privacy policies
  C. Privacy awareness training
  D. Privacy audit reports
  D. Privacy audit reports

• Question 207:

  A debt collection agency is attempting to locate a debtor and collects information on several people with similar names. During the inquiry, some of these people are discounted. How should the agency decide what data is adequate, relevant, and limited?

  A. The agency should keep only the minimum data needed to form a basic record of people removed from the search.
  B. The agency should delete all personal data collected after the debtor is found.
  C. The agency should keep the data collected but store in an anonymized format.
  D. The agency should keep the data collected and mark an indication on the people removed from the search.
  C. The agency should keep the data collected but store in an anonymized format.

• Question 208:

  Which of the following roles is responsible for establishing procedures that address the use of personal data for continuous auditing?

  A. Data processor
  B. Data controller
  C. Data modeler
  D. Data architect
  B. Data controller

• Question 209:

  Of the following, who should be PRIMARILY accountable for creating an organization's privacy management strategy?

  A. Chief data officer (CDO)
  B. Privacy steering committee
  C. Information security steering committee
  D. Chief privacy officer (CPO)
  C. Information security steering committee

• Question 210:

  A migration of personal data involving a data source with outdated documentation has been approved by senior management. Which of the following should be done NEXT?

  A. Review data flow post migration.
  B. Ensure appropriate data classification.
  C. Engage an external auditor to review the source data.
  D. Check the documentation version history for anomalies.
  A. Review data flow post migration.