DSCI DSCI Certifications DCPLA Questions & Answers

• Question 31:

  As a newly appointed Data Protection officer of an IT company gearing up for DSCI's privacy certification, you are trying to understand what data elements are involved in each of the business process, function and if these data elements can be classified as sensitive personal information. What is being accomplished with this effort?

  A. Organization to get "Visibility" over its exposure to sensitive personal information

  B. It is a part of the annual exercise per the organization's privacy policy / processes

  C. Information security controls for confidential information being reviewed

  D. Gathering inputs to restructure privacy function

  Correct Answer: A

• Question 32:

  XYZ bank has recently decided to start offering online banking services. For doing so, the bank has outsourced its IT operations and processes to various third parties. Acknowledging privacy concerns, bank has decided to implement a privacy program. Assuming you have been tasked to deploy this framework for the bank, which of the following would most likely be your first step?

  A. Create an inventory of business processes that deal with personal information and identify the associated data element

  B. Ensure that bank is equipped to test the relevance of each legal and compliance requirement in its environment

  C. Assign privacy roles and responsibilities for process owners

  D. None of the above

  Correct Answer: A

• Question 33:

  Which of the following measures can an organization implement to establish regulatory compliance intelligence? (Choose all that apply.)

  A. Establish a process that keeps a track of applicable legal and regulatory changes

  B. Identify the liabilities imposed by the regulations with respect to specific data elements

  C. Ensure that a mechanism exists for quick and effective provisioning, de-provisioning and authorization of access to information or systems which are exposed to data

  D. Ensure that knowledge with respect to legal and regulatory compliances is managed effectively

  Correct Answer: AB

• Question 34:

  Classify the following scenario as major or minor non-conformity.

  "The organization is aware of the PI dealt by it at a broad level based on the business services provided but does not have the detailed view of which business functions, processes or relationships deal with what types of PI including usage, access, transmission, storage, etc."

  A. Major

  B. Minor

  C. Both Major and Minor

  D. None of the above

  Correct Answer: A

• Question 35:

  Which of the following factors is least likely to be considered while implementing or augmenting data security solution for privacy protection?

  A. Security controls deployment at the database level

  B. Information security infrastructure up-gradation in the organization

  C. Classification of data type and its usage by various functions in the organization

  D. Training and awareness program for third party organizations

  Correct Answer: D

• Question 36:

  The concept of data adequacy is based on the principle of _________.

  A. Adequate compliance

  B. Dissimilarity of legislations

  C. Essential equivalence

  D. Essential assessment

  Correct Answer: C

• Question 37:

  Which of the following is outside the scope of an organization's privacy incident management plan?

  A. Detection of leakage of personal information

  B. Defers data access rules for business users

  C. Communication of privacy incidents

  D. Remediation of incidents

  Correct Answer: B

• Question 38:

  __________ layer of the DSCI Privacy Framework (DPF? ensures that adequate level of awareness exists in an organization.

  A. Personal Information Security

  B. Information Usage, Access, Monitoring and Training

  C. Privacy Strategy and Processes

  D. None of the above

  Correct Answer: B

• Question 39:

  Its mandatory for the assessee to provide the pre-requisites to the assessor organization before commencement of the first phase of assessment.

  A. True

  B. False

  Correct Answer: A

• Question 40:

  "Data which cannot be attributed to a particular data subject without use of additional information." Which of the following best describes the above statement?

  A. Anonymized Data

  B. Metadata

  C. Pseudonymized Data

  D. None of the above

  Correct Answer: C