ISACA CDPSE Certified Data Privacy Solutions Engineer Online Training

Question #1

What should be the PRIMARY consideration of a multinational organization deploying a user and entity behavior analytics (UEBA) tool to centralize the monitoring of anomalous employee behavior?

A . Cross-border data transfer
B . Support staff availability and skill set
C . User notification
D . Global public interest

Reveal Solution Hide Solution

Question #2

Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

A . The applicable privacy legislation
B . The quantity of information within the scope of the assessment
C . The systems in which privacy-related data is stored
D . The organizational security risk profile

Reveal Solution Hide Solution

Question #3

Which of the following BEST represents privacy threat modeling methodology?

A . Mitigating inherent risks and threats associated with privacy control weaknesses
B . Systematically eliciting and mitigating privacy threats in a software architecture
C . Reliably estimating a threat actor’s ability to exploit privacy vulnerabilities
D . Replicating privacy scenarios that reflect representative software usage

Reveal Solution Hide Solution

Question #4

An organization is creating a personal data processing register to document actions taken with personal data.

Which of the following categories should document controls relating to periods of retention for personal data?

A . Data archiving
B . Data storage
C . Data acquisition
D . Data input

Reveal Solution Hide Solution

Question #5

Data collected by a third-party vendor and provided back to the organization may not be protected according to the organization’s privacy notice.

Which of the following is the BEST way to address this concern?

A . Review the privacy policy.
B . Obtain independent assurance of current practices.
C . Re-assess the information security requirements.
D . Validate contract compliance.

Reveal Solution Hide Solution

Question #6

During the design of a role-based user access model for a new application, which of the following principles is MOST important to ensure data privacy is protected?

A . Segregation of duties
B . Unique user credentials
C . Two-person rule
D . Need-to-know basis

Reveal Solution Hide Solution

Question #7

Which of the following should FIRST be established before a privacy office starts to develop a data protection and privacy awareness campaign?

A . Detailed documentation of data privacy processes
B . Strategic goals of the organization
C . Contract requirements for independent oversight
D . Business objectives of senior leaders

Reveal Solution Hide Solution

Question #8

Which of the following features should be incorporated into an organization’s technology stack to meet privacy requirements related to the rights of data subjects to control their personal data?

A . Providing system engineers the ability to search and retrieve data
B . Allowing individuals to have direct access to their data
C . Allowing system administrators to manage data access
D . Establishing a data privacy customer service bot for individuals

Reveal Solution Hide Solution

Question #9

Which of the following is the GREATEST concern for an organization subject to cross-border data transfer regulations when using a cloud service provider to store and process data?

A . The service provider has denied the organization’s request for right to audit.
B . Personal data stored on the cloud has not been anonymized.
C . The extent of the service provider’s access to data has not been established.
D . The data is stored in a region with different data protection requirements.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2014/data-owners-responsibilities-when-migrating-to-the-cloud

Cross-border data transfer regulations are laws and rules that govern the movement of personal data across national or regional boundaries. They aim to protect the privacy rights and interests of the data subjects, and to ensure that their personal data are not subject to lower or incompatible standards of protection in other jurisdictions. Examples of cross-border data transfer regulations

include the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) in the United States, and the Personal Information Protection Law (PIPL) in China.

When an organization uses a cloud service provider to store and process data, it may face the risk of transferring personal data to a region with different data protection requirements, such as a region that has not been recognized as providing adequate or equivalent levels of protection by the original jurisdiction, or a region that has conflicting or incompatible laws or regulations with the original jurisdiction. This may result in the following consequences for the organization:

It may violate the cross-border data transfer regulations of the original jurisdiction, and face legal sanctions, fines, or lawsuits from the regulators, customers, or data subjects.

It may lose control or visibility over the personal data, and expose them to unauthorized or unlawful access, use, modification, or disclosure by the cloud service provider or third parties.

It may compromise the trust and confidence of the customers and data subjects, and damage its reputation and competitiveness.

Therefore, an organization subject to cross-border data transfer regulations should carefully assess

and manage the risks of using a cloud service provider to store and process data, and ensure that it

has appropriate safeguards and mechanisms in place to protect the privacy of personal data across

borders.

Reference: Cross-Border Data Transfer and Data Localization Requirements … – ISACA, section 1: “As a result, China’s National People’s Congress (NPC) and the National Committee of the Chinese People’s Political Consultative Conference (PCC) put forward suggestions on legislation addressing cross-border data transfer.”

Regulatory Approaches to Cross-Border Data Transfers, section 1: “Cross-border transfers of personal information are increasingly common in today’s globalised economy. However, different jurisdictions have different approaches to regulating such transfers.”

Cross-Border Data Transfer Requirements: Global Privacy Laws – Securiti, section 1: “Data transfer conditions, mechanisms, localization and regulatory authority of each law.”

The Regulation of Cross-Border Data Transfers in the Context … – Springer, section 1: “No Party shall prohibit or restrict the cross-border transfer of information, including personal information, by electronic means if this activity is for the conduct of the business of a covered person.”

Question #10

When configuring information systems for the communication and transport of personal data, an organization should:

A . adopt the default vendor specifications.
B . review configuration settings for compliance.
C . implement the least restrictive mode.
D . enable essential capabilities only.

Reveal Solution Hide Solution

ISACA CDPSE Certified Data Privacy Solutions Engineer Online Training