ISACA CDPSE QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Privacy Governance (25 Questions)
1. Which of the following is the PRIMARY objective of a privacy governance framework?
A. To eliminate all data breaches
B. To align privacy practices with business objectives and legal requirements
C. To transfer all privacy risk to a third party
D. To ensure the IT department owns all privacy decisions
Answer: B
Rationale: A privacy governance framework provides structure to ensure privacy practices support business
goals while complying with laws and regulations. Eliminating all breaches (A) is impossible. Transferring all risk
(C) is not the goal of governance. IT alone (D) should not own privacy; it is a cross-functional responsibility.
2. Who is ultimately accountable for an organization's privacy program?
,A. The Chief Information Security Officer (CISO)
B. The Data Protection Officer (DPO)
C. The Board of Directors
D. The IT Manager
Answer: C
Rationale: While the DPO (B) is responsible for monitoring compliance, ultimate accountability rests with the
Board of Directors (C) as part of their fiduciary duty. The CISO (A) and IT Manager (D) have operational roles.
3. What is the PRIMARY purpose of a Records of Processing Activities (ROPA) under GDPR Article 30?
A. To document employee salaries
B. To provide a comprehensive inventory of personal data processing activities
C. To list all software licenses
D. To record customer complaints
Answer: B
Rationale: A ROPA is a detailed inventory of all personal data processing activities, including purposes,
categories of data, recipients, and retention periods. It is a foundational governance tool.
, 4. Which principle states that personal data should be collected for specified, explicit, and legitimate purposes?
A. Data minimization
B. Purpose limitation
C. Storage limitation
D. Accuracy
Answer: B
Rationale: Purpose limitation means data is collected for specific, explicit, and legitimate purposes and not
further processed in a manner incompatible with those purposes. Data minimization (A) is about collecting only
what is necessary. Storage limitation (C) is about retention periods. Accuracy (D) is about keeping data correct.
5. A privacy policy that is written in complex legal jargon and buried on a website violates which principle?
A. Data minimization
B. Transparency
C. Integrity and confidentiality
D. Accountability
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Privacy Governance (25 Questions)
1. Which of the following is the PRIMARY objective of a privacy governance framework?
A. To eliminate all data breaches
B. To align privacy practices with business objectives and legal requirements
C. To transfer all privacy risk to a third party
D. To ensure the IT department owns all privacy decisions
Answer: B
Rationale: A privacy governance framework provides structure to ensure privacy practices support business
goals while complying with laws and regulations. Eliminating all breaches (A) is impossible. Transferring all risk
(C) is not the goal of governance. IT alone (D) should not own privacy; it is a cross-functional responsibility.
2. Who is ultimately accountable for an organization's privacy program?
,A. The Chief Information Security Officer (CISO)
B. The Data Protection Officer (DPO)
C. The Board of Directors
D. The IT Manager
Answer: C
Rationale: While the DPO (B) is responsible for monitoring compliance, ultimate accountability rests with the
Board of Directors (C) as part of their fiduciary duty. The CISO (A) and IT Manager (D) have operational roles.
3. What is the PRIMARY purpose of a Records of Processing Activities (ROPA) under GDPR Article 30?
A. To document employee salaries
B. To provide a comprehensive inventory of personal data processing activities
C. To list all software licenses
D. To record customer complaints
Answer: B
Rationale: A ROPA is a detailed inventory of all personal data processing activities, including purposes,
categories of data, recipients, and retention periods. It is a foundational governance tool.
, 4. Which principle states that personal data should be collected for specified, explicit, and legitimate purposes?
A. Data minimization
B. Purpose limitation
C. Storage limitation
D. Accuracy
Answer: B
Rationale: Purpose limitation means data is collected for specific, explicit, and legitimate purposes and not
further processed in a manner incompatible with those purposes. Data minimization (A) is about collecting only
what is necessary. Storage limitation (C) is about retention periods. Accuracy (D) is about keeping data correct.
5. A privacy policy that is written in complex legal jargon and buried on a website violates which principle?
A. Data minimization
B. Transparency
C. Integrity and confidentiality
D. Accountability
