ISACA CDPSE Certified Data Privacy Solutions Engineer Online Training

Question #31

Which of the following scenarios poses the GREATEST risk to an organization from a privacy perspective?

A . The organization lacks a hardware disposal policy.
B . Emails are not consistently encrypted when sent internally.
C . Privacy training is carried out by a service provider.
D . The organization’s privacy policy has not been reviewed in over a year.

Question #32

Within a business continuity plan (BCP), which of the following is the MOST important consideration to ensure the ability to restore availability and access to personal data in the event of a data privacy incident?

A . Offline backup availability
B . Recovery time objective (RTO)
C . Recovery point objective (RPO)
D . Online backup frequency

Reveal Solution Hide Solution

Question #33

In which of the following should the data record retention period be defined and established?

A . Data record model
B . Data recovery procedures
C . Data quality standard
D . Data management plan

Reveal Solution Hide Solution

Question #34

When tokenizing credit card data, what security practice should be employed with the original data before it is stored in a data lake?

A . Encoding
B . Backup
C . Encryption
D . Classification

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Reference: https://cpl.thalesgroup.com/faq

Encryption is a security practice that transforms data into an unreadable format using a secret key or algorithm. Encryption protects the confidentiality and integrity of data, especially when they are stored in a data lake or other cloud-based storage systems. Encryption ensures that only authorized parties can access and use the original data, while unauthorized parties cannot decipher or modify the data without the key or algorithm. Encryption also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.

The other options are less effective or irrelevant for securing the original data before storing them in a data lake. Encoding is a process of converting data from one format to another, such as base64 or hexadecimal. Encoding does not protect the data from unauthorized access or use, as it can be easily reversed without a key or algorithm. Backup is a process of creating a copy of data for recovery purposes, such as in case of data loss or corruption. Backup does not protect the data from unauthorized access or use, as it may create additional copies of sensitive data that need to be secured. Classification is a process of assigning labels or categories to data based on their sensitivity, value or risk level, such as public, confidential or restricted. Classification helps to identify and manage the data according to their security requirements, but it does not protect the data from unauthorized access or use by itself.

Reference: Tokenization: Your Secret Weapon for Data Security? – ISACA, section 2: “Encryption is one of the most effective security controls available to enterprises, but it can be challenging to deploy and maintain across a complex enterprise landscape.”

Credit Card Tokenization: What It Is, How It Works – NerdWallet, section 2: “Encrypting personal data automatically before sending them through email, using encryption standards and algorithms that are compliant with data protection laws and regulations.”

Tokenized Credit Card Data: Everything You Need to Know – Koombea, section 3: “The sensitive card data itself is stored on a server with much higher security.”

What is Data Tokenization and Why is it Important? | Immuta, section 2: “Tokenization replaces the original sensitive data with randomly generated, nonsensitive substitute characters as placeholder data.”

Question #35

Which key stakeholder within an organization should be responsible for approving the outcomes of a privacy impact assessment (PIA)?

A . Data custodian
B . Privacy data analyst
C . Data processor
D . Data owner

Reveal Solution Hide Solution

Question #36

Which of the following is the best reason for a health organization to use desktop virtualization to implement stronger access control to systems containing patient records?

A . Limited functions and capabilities of a secured operating environment
B . Monitored network activities for unauthorized use
C . Improved data integrity and reduced effort for privacy audits
D . Unlimited functionalities and highly secured applications

Reveal Solution Hide Solution

Question #37

What is the BEST way for an organization to maintain the effectiveness of its privacy breach incident response plan?

A . Require security management to validate data privacy security practices.
B . Involve the privacy office in an organizational review of the incident response plan.
C . Hire a third party to perform a review of data privacy processes.
D . Conduct annual data privacy tabletop exercises.

Reveal Solution Hide Solution

Question #38

Which of the following is MOST important when developing an organizational data privacy program?

A . Obtaining approval from process owners
B . Profiling current data use
C . Following an established privacy framework
D . Performing an inventory of all data

Reveal Solution Hide Solution

Question #39

Which of the following should be considered personal information?

A . Biometric records
B . Company address
C . University affiliation
D . Age

Reveal Solution Hide Solution

Question #40

Which of the following should an IT privacy practitioner do FIRST following a decision to expand

remote working capability to all employees due to a global pandemic?

A . Evaluate the impact resulting from this change.
B . Revisit the current remote working policies.
C . Implement a virtual private network (VPN) tool.
D . Enforce multi-factor authentication for remote access.

Reveal Solution Hide Solution