Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 21:

  Which of the following is the MOST effective use of data flow diagrams when implementing a data privacy compliance program?

  A. Illustrating where personal data resides in systems
  B. Identifying where personal data is in transit
  C. Processing personal data with clarity and ease
  D. Mapping personal data at rest
  A. Illustrating where personal data resides in systems

  ---

  Explanation/Reference:

• Question 22:

  Which of the following is a PRIMARY element of application and software hardening?

  A. Software repository
  B. Vulnerability analysis
  C. Database configuration
  D. Code review
  B. Vulnerability analysis

• Question 23:

  How can an organization BEST ensure its vendors are complying with data privacy requirements defined in their contracts?

  A. Review self-attestations of compliance provided by vendor management.
  B. Obtain independent assessments of the vendors' data management processes.
  C. Perform penetration tests of the vendors' data security.
  D. Compare contract requirements against vendor deliverables.
  D. Compare contract requirements against vendor deliverables.

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2019/volume-5/ensuring-vendor-compliance-and-thirdparty-risk-mitigation

• Question 24:

  Which of the following is a PRIMARY consideration to protect against privacy violations when utilizing artificial intelligence (AI) driven business decisions?

  A. De-identifying the data to be analyzed
  B. Verifying the data subjects have consented to the processing
  C. Defining the intended objectives
  D. Ensuring proper data sets are used to train the models
  B. Verifying the data subjects have consented to the processing

• Question 25:

  Data collected by a third-party vendor and provided back to the organization may not be protected according to the organization's privacy notice. Which of the following is the BEST way to address this concern?

  A. Review the privacy policy.
  B. Obtain independent assurance of current practices.
  C. Re-assess the information security requirements.
  D. Validate contract compliance.
  D. Validate contract compliance.

• Question 26:

  What should a sender do to send a recipient a file of personal data using asymmetric encryption?

  A. Recipient's private key is used to encrypt; recipient's public key is used to decrypt.
  B. Sender's public key is used to encrypt; recipient's public key is used to decrypt.
  C. Recipient's public key is used to encrypt; recipient's private key is used to decrypt.
  D. Recipient's private key is used to encrypt; sender's public key is used to decrypt.
  C. Recipient's public key is used to encrypt; recipient's private key is used to decrypt.

• Question 27:

  In addition to lowering costs and improving performance, which of the following is the MOST compelling reason to archive data?

  A. Improving business alignment
  B. Restricting data access
  C. Achieving compliance
  D. Improving data confidentiality
  C. Achieving compliance

  ---

  Explanation/Reference:

• Question 28:

  An organization want to develop an application programming interface (API) to seamlessly exchange personal data with an application hosted by a third-party service provider. What should be the FIRST step when developing an application link?

  A. Data tagging
  B. Data normalization
  C. Data mapping
  D. Data hashing
  C. Data mapping

  ---

  Explanation/Reference:

• Question 29:

  During which of the following system lifecycle stages is it BEST to conduct a privacy impact assessment (PIA) on a system that holds personal data?

  A. Functional testing
  B. Development
  C. Production
  D. User acceptance testing (UAT)
  B. Development

  ---

  Explanation/Reference:

• Question 30:

  Information should only be considered personal information if it:

  A. relates directly or indirectly to an individual.
  B. appears in a digital or electronic format.
  C. is classified as sensitive and confidential.
  D. is objectively accurate or verifiable.
  A. relates directly or indirectly to an individual.