Isaca Isaca Certifications CDPSE Questions & Answers

• Question 21:

  Which of the following should be of GREATEST concern when an organization wants to store personal data in the cloud?

  A. The organization's potential legal liabilities related to the data

  B. The data recovery capabilities of the storage provider

  C. The data security policies and practices of the storage provider

  D. Any vulnerabilities identified in the cloud system

  Correct Answer: C

• Question 22:

  Which of the following should be established FIRST before authorizing remote access to a data store containing personal data?

  A. Privacy policy

  B. Network security standard

  C. Multi-factor authentication D. Virtual private network (VPN)

  Correct Answer: D

• Question 23:

  Which of the following is the BEST way to protect the privacy of data stored on a laptop in case of loss or theft?

  A. Strong authentication controls

  B. Remote wipe

  C. Regular backups

  D. Endpoint encryption

  Correct Answer: D

• Question 24:

  Which of the following should be done FIRST when developing an organization-wide strategy to address data privacy risk?

  A. Obtain executive support.

  B. Develop a data privacy policy.

  C. Gather privacy requirements from legal counsel.

  D. Create a comprehensive data inventory.

  Correct Answer: A

• Question 25:

  An online retail company is trying to determine how to handle users' data if they unsubscribe from marketing emails generated from the website. Which of the following is the BEST approach for handling personal data that has been restricted?

  A. Encrypt users' information so it is inaccessible to the marketing department.

  B. Reference the privacy policy to see if the data is truly restricted.

  C. Remove users' information and accounts from the system.

  D. Flag users' email addresses to make sure they do not receive promotional information.

  Correct Answer: C

• Question 26:

  Which of the following is an IT privacy practitioner's BEST recommendation to reduce privacy risk before an organization provides personal data to a third party?

  A. Tokenization

  B. Aggregation

  C. Anonymization

  D. Encryption

  Correct Answer: C

• Question 27:

  Which of the following is a responsibility of the audit function in helping an organization address privacy compliance requirements?

  A. Approving privacy impact assessments (PIAs)

  B. Validating the privacy framework

  C. Managing privacy notices provided to customers

  D. Establishing employee privacy rights and consent

  Correct Answer: D

• Question 28:

  Before executive leadership approves a new data privacy policy, it is MOST important to ensure:

  A. a training program is developed.

  B. a privacy committee is established.

  C. a distribution methodology is identified.

  D. a legal review is conducted.

  Correct Answer: B

  Reference: https://www.isaca.org/resources/news-and-trends/industry-news/2021/pakistans-cybersecurity-policy-in-2021-a-review

• Question 29:

  How can an organization BEST ensure its vendors are complying with data privacy requirements defined in their contracts?

  A. Review self-attestations of compliance provided by vendor management.

  B. Obtain independent assessments of the vendors' data management processes.

  C. Perform penetration tests of the vendors' data security.

  D. Compare contract requirements against vendor deliverables.

  Correct Answer: D

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2019/volume-5/ensuring-vendor-compliance-and-thirdparty-risk-mitigation

• Question 30:

  Which of the following is the PRIMARY reason to complete a privacy impact assessment (PIA)?

  A. To comply with consumer regulatory requirements

  B. To establish privacy breach response procedures

  C. To classify personal data

  D. To understand privacy risks

  Correct Answer: A

  Reference: https://www.isaca.org/resources/news-and-trends/industry-news/2020/three-ways-your-approach-to-privacy-is-at-risk