Isaca CDPSE Online Practice Questions and Exam Preparation

Isaca CDPSE Online Questions & Answers

• Question 31:

  A multinational corporation is planning a big data initiative to help with critical business decisions. Which of the following is the BEST way to ensure personal data usage is standardized across the entire organization?

  A. De-identify all data.
  B. Develop a data dictionary.
  C. Encrypt all sensitive data.
  D. Perform data discovery.
  D. Perform data discovery.

  ---

  Explanation/Reference:

  Reference: https://www.omnisci.com/technical-glossary/data-discovery#:~:text=Data%20discovery%20is%20the%20business,derive%20value%20from%20business%20data

• Question 32:

  Which of the following would BEST enable an organization to account for unstructured data?

  A. Data dictionary
  B. Data library
  C. Data classification
  D. Data flow map
  B. Data library

• Question 33:

  Which of the following statements BEST differentiates sensitive personal data from other types of confidential data?

  A. The legal department is accountable for protecting sensitive personal data.
  B. Masking techniques are only applicable to the protection of sensitive personal data.
  C. Sensitive personal data merits a higher level of protection.
  D. Sensitive personal data requires deletion beyond the retention period by law.
  C. Sensitive personal data merits a higher level of protection.

• Question 34:

  Which of the following is MOST important to capture in the audit log of an application hosting personal data?

  A. Last logins of privileged users
  B. Last user who accessed personal data
  C. Application error events
  D. Server details of the hosting environment
  B. Last user who accessed personal data

• Question 35:

  Which of the following BEST enables an IT privacy practitioner to ensure appropriate protection for personal data collected that is required to provide necessary services?

  A. Understanding the data flows within the organization
  B. Implementing strong access controls on a need-to-know basis
  C. Anonymizing privacy data during collection and recording
  D. Encrypting the data throughout its life cycle
  A. Understanding the data flows within the organization

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2010/data-governance-for-privacy-confidentiality-and-compliance-a-holistic-approach

• Question 36:

  Which of the following should FIRST be established before a privacy office starts to develop a data protection and privacy awareness campaign?

  A. Detailed documentation of data privacy processes
  B. Strategic goals of the organization
  C. Contract requirements for independent oversight
  D. Business objectives of senior leaders
  B. Strategic goals of the organization

  ---

  Explanation/Reference:

  Reference: https://www.isaca.org/resources/isaca-journal/issues/2020/volume-5/building-a-privacy-culture

• Question 37:

  Which of the following is the PRIMARY reason to allow data transfer between regions?

  A. Data subjects give implicit consent for a contract or claim.
  B. There is a legal basis of public interest.
  C. Data transfer concerns a limited number of data subjects.
  D. There are legitimate interests that override data subject rights.
  A. Data subjects give implicit consent for a contract or claim.

• Question 38:

  When data processing is performed at a third-party data center, ownership of the risk PRIMARILY rests with the:

  A. data custodian.
  B. data controller.
  C. data processor.
  D. data scientist.
  B. data controller.

• Question 39:

  When choosing data sources to be used within a big data architecture, which of the following data attributes MUST be considered to ensure data is not aggregated?

  A. Accuracy
  B. Granularity
  C. Consistency
  D. Reliability
  D. Reliability

• Question 40:

  When using pseudonymization to prevent unauthorized access to personal data, which of the following is the MOST important consideration to ensure the data is adequately protected?

  A. The data must be protected by multi-factor authentication.
  B. The identifier must be kept separate and distinct from the data it protects.
  C. The key must be a combination of alpha and numeric characters.
  D. The data must be stored in locations protected by data loss prevention (DLP) technology.
  D. The data must be stored in locations protected by data loss prevention (DLP) technology.