ISACA CDPSE Certified Data Privacy Solutions Engineer Online Training

Question #21

Which of the following vulnerabilities is MOST effectively mitigated by enforcing multi-factor authentication to obtain access to personal information?

A . End users using weak passwords
B . Organizations using weak encryption to transmit data
C . Vulnerabilities existing in authentication pages
D . End users forgetting their passwords

Reveal Solution Hide Solution

Question #22

Which of the following is the BEST way for an organization to limit potential data exposure when implementing a new application?

A . Implement a data loss prevention (DLP) system.
B . Use only the data required by the application.
C . Encrypt all data used by the application.
D . Capture the application’s authentication logs.

Reveal Solution Hide Solution

Question #23

An online business posts its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities.

Which data protection principle is applied?

A . Data integrity and confidentiality
B . System use requirements
C . Data use limitation
D . Lawfulness and fairness

Reveal Solution Hide Solution

Question #24

What type of personal information can be collected by a mobile application without consent?

A . Full name
B . Geolocation
C . Phone number
D . Accelerometer data

Reveal Solution Hide Solution

Question #25

What is the PRIMARY means by which an organization communicates customer rights as it relates to the use of their personal information?

A . Distributing a privacy rights policy
B . Mailing rights documentation to customers
C . Publishing a privacy notice
D . Gaining consent when information is collected

Reveal Solution Hide Solution

Question #26

A new marketing application needs to use data from the organization’s customer database.

Prior to the application using the data, which of the following should be done FIRST?

A . Ensure the data loss prevention (DLP) tool is logging activity.
B . De-identify all personal data in the database.
C . Determine what data is required by the application.
D . Renew the encryption key to include the application.

Reveal Solution Hide Solution

Question #27

Which of the following MUST be available to facilitate a robust data breach management response?

A . Lessons learned from prior data breach responses
B . Best practices to obfuscate data for processing and storage
C . An inventory of previously impacted individuals
D . An inventory of affected individuals and systems

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Reference: https://securityscorecard.com/blog/the-ultimate-data-breach-response-plan

To facilitate a robust data breach management response, an organization must have an inventory of affected individuals and systems, as this will help to identify the scope, impact and severity of the breach, and to take appropriate actions to contain, mitigate and notify the breach. An inventory of affected individuals and systems should include the following information:

The number and categories of data subjects whose personal data have been compromised. The types and volumes of personal data that have been exposed, altered or deleted

The sources and locations of the personal data, such as databases, servers, devices or third parties. The potential or actual consequences of the breach for the data subjects, such as identity theft, fraud, discrimination or physical harm

The systems and processes that have been compromised or affected by the breach, such as networks, applications, devices or security controls

The vulnerabilities or risks that have been exploited or introduced by the breach, such as malware, phishing, ransomware or human error

An inventory of affected individuals and systems will help the organization to assess the risk level of the breach, and to determine the appropriate response strategy and actions, such as: Isolating or shutting down the affected systems or processes

Restoring or recovering the personal data from backups or other sources

Erasing or encrypting the personal data on the compromised devices or media

Analyzing the root cause and impact of the breach

Reporting the breach to the relevant authorities and stakeholders Notifying the data subjects of their rights and remedies

Implementing corrective and preventive measures to avoid future breaches

Reference: Data Breach Preparation and Response in Accordance With GDPR – ISACA, section 4: “The controller should document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.”

Cybersecurity Incident Response Exercise Guidance – ISACA, section 3: “The IRT should identify all assets involved in an incident (e.g., hardware, software) and determine what information was compromised (e.g., PII).”

Guide to Securing Personal Data in Electronic Medium, section 3.5: “Organisations should maintain an inventory of personal data in their possession or under their control.”

Question #28

Which of the following zones within a data lake requires sensitive data to be encrypted or tokenized?

A . Trusted zone
B . Clean zone
C . Raw zone
D . Temporal zone

Reveal Solution Hide Solution

Question #29

Which of the following poses the GREATEST privacy risk for client-side application processing?

A . Failure of a firewall protecting the company network
B . An employee loading personal information on a company laptop
C . A remote employee placing communication software on a company server
D . A distributed denial of service attack (DDoS) on the company network

Reveal Solution Hide Solution

Question #30

Which of the following is the PRIMARY consideration to ensure control of remote access is aligned to the privacy policy?

A . Access is logged on the virtual private network (VPN).
B . Multi-factor authentication is enabled.
C . Active remote access is monitored.
D . Access is only granted to authorized users.

Reveal Solution Hide Solution