ISACA CDPSE FINAL EXAM QUESTIONS AND
CORRECT ANSWERS
What should be the PRIMARY consideration of a multinational organization
deploying a user and entity behavior analytics (UEBA) tool to centralize the
monitoring of anomalous employee behavior?
A. Cross-border data transfer
B. Support staff availability and skill set
C. User notification
D. Global public interest
B. Support staff availability and skill set
Which of the following should be the FIRST consideration when conducting a
privacy impact assessment (PIA)?
A. The applicable privacy legislation
B. The quantity of information within the scope of the assessment
C. The systems in which privacy-related data is stored
D. The organizational security risk profile
C. The systems in which privacy-related data is stored
Which of the following BEST represents privacy threat modeling methodology?
A. Mitigating inherent risks and threats associated with privacy control
weaknesses
B. Systematically eliciting and mitigating privacy threats in a software
architecture
C. Reliably estimating a threat actor's ability to exploit privacy vulnerabilities
D. Replicating privacy scenarios that reflect representative software usage
A. Mitigating inherent risks and threats associated with privacy control
weaknesses
An organization is creating a personal data processing register to document
actions taken with personal data. Which of the following categories should
document controls relating to periods of retention for personal data?
A. Data archiving
B. Data storage
, C. Data acquisition
D. Data input
A. Data archiving
Data collected by a third-party vendor and provided back to the organization
may not be protected according to the organization's privacy notice. Which of
the following is the BEST way to address this concern?
A. Review the privacy policy.
B. Obtain independent assurance of current practices.
C. Re-assess the information security requirements.
D. Validate contract compliance.
D. Validate contract compliance.
During the design of a role-based user access model for a new application,
which of the following principles is MOST important to ensure data privacy is
protected?
A. Segregation of duties
B. Unique user credentials
C. Two-person rule
D. Need-to-know basis
A. Segregation of duties
Which of the following should FIRST be established before a privacy office
starts to develop a data protection and privacy awareness campaign?
A. Detailed documentation of data privacy processes
B. Strategic goals of the organization
C. Contract requirements for independent oversight
D. Business objectives of senior leaders
B. Strategic goals of the organization
Which of the following features should be incorporated into an organization's
technology stack to meet privacy requirements related to the rights of data
subjects to control their personal data?
A. Providing system engineers the ability to search and retrieve data
B. Allowing individuals to have direct access to their data
C. Allowing system administrators to manage data access
D. Establishing a data privacy customer service bot for individuals
B. Allowing individuals to have direct access to their data
Which of the following is the GREATEST concern for an organization subject
to cross-border data transfer regulations when using a cloud service provider to
store and process data?
A. The service provider has denied the organization's request for right to audit.
CORRECT ANSWERS
What should be the PRIMARY consideration of a multinational organization
deploying a user and entity behavior analytics (UEBA) tool to centralize the
monitoring of anomalous employee behavior?
A. Cross-border data transfer
B. Support staff availability and skill set
C. User notification
D. Global public interest
B. Support staff availability and skill set
Which of the following should be the FIRST consideration when conducting a
privacy impact assessment (PIA)?
A. The applicable privacy legislation
B. The quantity of information within the scope of the assessment
C. The systems in which privacy-related data is stored
D. The organizational security risk profile
C. The systems in which privacy-related data is stored
Which of the following BEST represents privacy threat modeling methodology?
A. Mitigating inherent risks and threats associated with privacy control
weaknesses
B. Systematically eliciting and mitigating privacy threats in a software
architecture
C. Reliably estimating a threat actor's ability to exploit privacy vulnerabilities
D. Replicating privacy scenarios that reflect representative software usage
A. Mitigating inherent risks and threats associated with privacy control
weaknesses
An organization is creating a personal data processing register to document
actions taken with personal data. Which of the following categories should
document controls relating to periods of retention for personal data?
A. Data archiving
B. Data storage
, C. Data acquisition
D. Data input
A. Data archiving
Data collected by a third-party vendor and provided back to the organization
may not be protected according to the organization's privacy notice. Which of
the following is the BEST way to address this concern?
A. Review the privacy policy.
B. Obtain independent assurance of current practices.
C. Re-assess the information security requirements.
D. Validate contract compliance.
D. Validate contract compliance.
During the design of a role-based user access model for a new application,
which of the following principles is MOST important to ensure data privacy is
protected?
A. Segregation of duties
B. Unique user credentials
C. Two-person rule
D. Need-to-know basis
A. Segregation of duties
Which of the following should FIRST be established before a privacy office
starts to develop a data protection and privacy awareness campaign?
A. Detailed documentation of data privacy processes
B. Strategic goals of the organization
C. Contract requirements for independent oversight
D. Business objectives of senior leaders
B. Strategic goals of the organization
Which of the following features should be incorporated into an organization's
technology stack to meet privacy requirements related to the rights of data
subjects to control their personal data?
A. Providing system engineers the ability to search and retrieve data
B. Allowing individuals to have direct access to their data
C. Allowing system administrators to manage data access
D. Establishing a data privacy customer service bot for individuals
B. Allowing individuals to have direct access to their data
Which of the following is the GREATEST concern for an organization subject
to cross-border data transfer regulations when using a cloud service provider to
store and process data?
A. The service provider has denied the organization's request for right to audit.
