Isaca Isaca Certifications CDPSE Questions & Answers

• Question 211:

  Which of the following is the MOST effective way to support organizational privacy awareness objectives?

  A. Funding in-depth training and awareness education for data privacy staff

  B. Implementing an annual training certification process

  C. Including mandatory awareness training as part of performance evaluations

  D. Customizing awareness training by business unit function

  Correct Answer: A

• Question 212:

  An employee accidentally sends an email with personal data to the wrong person. Which of the following should the employee do FIRST upon becoming aware of the issue?

  A. Notify the privacy regulator and the impacted data subjects.

  B. Send the recipient another email requesting deletion of the email that was accidentally sent.

  C. Document and file the details of what happened in anticipation of further questioning.

  D. Report the situation to the data privacy officer as it could be a privacy breach.

  Correct Answer: C

• Question 213:

  Which of the following is MOST useful for understanding an organization's approach towards privacy compliance?

  A. Data classifications

  B. Data privacy policies

  C. Privacy awareness training

  D. Privacy audit reports

  Correct Answer: D

• Question 214:

  A project manager for a new data collection system had a privacy impact assessment (PIA) completed before the solution was designed. Once the system was released into production, an audit revealed personal data was being collected that was not part of the PIA. What is the BEST way to avoid this situation in the future?

  A. Conduct a privacy post-implementation review.

  B. Document personal data workflows in the product life cycle.

  C. Incorporate privacy checkpoints into the secure development life cycle.

  D. Require management approval of changes to system architecture design.

  Correct Answer: D

• Question 215:

  Which of the following is the PRIMARY reason to allow data transfer between regions?

  A. Data subjects give implicit consent for a contract or claim.

  B. There is a legal basis of public interest.

  C. Data transfer concerns a limited number of data subjects.

  D. There are legitimate interests that override data subject rights.

  Correct Answer: A

• Question 216:

  Which of the following should an IT privacy practitioner review FIRST to understand where personal data is coming from and how it is used within the organization?

  A. Data process flow diagrams

  B. Data classification

  C. Data collection standards

  D. Data inventory

  Correct Answer: C

• Question 217:

  Which of the following is the BEST course of action to manage privacy risk when a significant vulnerability is identified in the operating system (OS) that supports an organization's customer relationship management (CRM) system?

  A. Apply OS patching to fix the vulnerability immediately.

  B. Manage system permissions and access more strictly.

  C. Enable comprehensive logging of activities at the OS level.

  D. Perform a vulnerability assessment to determine the impact.

  Correct Answer: B

• Question 218:

  In a contract for cloud services, whom should a cloud provider agree to notify in the event of a personal data breach?

  A. Its client's end users

  B. Its client's insurance carrier

  C. Its client's regulatory authority

  D. Its client

  Correct Answer: A

• Question 219:

  Which of the following BEST prevents users from sending out customers' personal data without encryption?

  A. Data loss prevention (DLP) tools

  B. De-identification of data

  C. Automatic email blocking

  D. User behavior monitoring

  Correct Answer: B

• Question 220:

  Which of the following would BEST enable an organization to account for unstructured data?

  A. Data dictionary

  B. Data library

  C. Data classification

  D. Data flow map

  Correct Answer: B