PDF Download Free of CDPSE Valid Practice Test Questions [Q95-Q118]

NEW QUESTION 95
Which encryption method encrypts and decrypts data using two separate yet mathematically connected cryptographic keys?

Hashing

Private key

Asymmetric

Symmetric

NEW QUESTION 96
An organization Wishes to deploy strong encryption to its most critical and sensitive databases. Which of the following is the BEST way to safeguard the encryption keys?

Ensure key management responsibility is assigned to the privacy officer.

Ensure the keys are stored in a remote server.

Ensure the keys are stored in a cryptographic vault.

Ensure all access to the keys is under dual control_

NEW QUESTION 97
Which of the following hard drive sanitation methods provides an organization with the GREATEST level of assurance that data has been permanently erased?

Degaussing the drive

Factory resetting the drive

Crypto-shredding the drive

Reformatting the drive

NEW QUESTION 98
Which of the following would MOST effectively reduce the impact of a successful breach through a remote access solution?

Compartmentalizing resource access

Regular testing of system backups

Monitoring and reviewing remote access logs

Regular physical and remote testing of the incident response plan

NEW QUESTION 99
An online business posts its customer data protection notice that includes a statement indicating information is collected on how products are used, the content viewed, and the time and duration of online activities. Which data protection principle is applied?

Data integrity and confidentiality

System use requirements

Data use limitation

Lawfulness and fairness

NEW QUESTION 100
Which of the following is an example of data anonymization as a means to protect personal data when sharing a database?

The data is encrypted and a key is required to re-identify the data.

Key fields are hidden and unmasking is required to access to the data.

Names and addresses are removed but the rest of the data is left untouched.

The data is transformed such that re-identification is impossible.

Data anonymization is a method of protecting personal data by modifying or removing any information that can be used to identify an individual, either directly or indirectly, in a data set. Data anonymization aims to prevent the re-identification of the data subjects, even by the data controller or processor, or by using additional data sources or techniques. Data anonymization also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to respect the privacy rights and preferences of the data subjects.
The data is transformed such that re-identification is impossible is an example of data anonymization, as it involves applying irreversible techniques, such as aggregation, generalization, perturbation, or synthesis, to alter the original data in a way that preserves their utility and meaning, but eliminates their identifiability. For example, a database of customer transactions can be anonymized by replacing the names and addresses of the customers with random codes, and by adding noise or rounding to the amounts and dates of the transactions.
The other options are not examples of data anonymization, but of other methods of protecting personal data that do not guarantee the impossibility of re-identification. The data is encrypted and a key is required to re-identify the data is an example of data pseudonymization, which is a method of replacing direct identifiers with pseudonyms, such as codes or tokens, that can be linked back to the original data with a key or algorithm. Data pseudonymization does not prevent re-identification by authorized parties who have access to the key or algorithm, or by unauthorized parties who can break or bypass the encryption. Key fields are hidden and unmasking is required to access to the data is an example of data masking, which is a method of concealing or obscuring sensitive data elements, such as names or credit card numbers, with characters, symbols or blanks. Data masking does not prevent re-identification by authorized parties who have permission to unmask the data, or by unauthorized parties who can infer or guess the hidden data from other sources or clues. Names and addresses are removed but the rest of the data is left untouched is an example of data deletion, which is a method of removing direct identifiers from a data set. Data deletion does not prevent re-identification by using indirect identifiers, such as age, gender, occupation or location, that can be combined or matched with other data sources to re-establish the identity of the data subjects.
Reference:
Big Data Deidentification, Reidentification and Anonymization – ISACA, section 2: “Anonymization is the ability for the data controller to anonymize the data in a way that it is impossible for anyone to establish the identity of the data.” Data Anonymization – Overview, Techniques, Advantages, section 1: “Data anonymization is a method of ensuring that the company understands and enforces its duty to secure sensitive, personal, and confidential data in a world of highly complex data protection mandates that can vary depending on where the business and the customers are based.”

NEW QUESTION 101
Which of the following deployed at an enterprise level will MOST effectively block malicious tracking of user Internet browsing?

Web application firewall (WAF)

Website URL blacklisting

Domain name system (DNS) sinkhole

Desktop antivirus software

NEW QUESTION 102
To ensure effective management of an organization’s data privacy policy, senior leadership MUST define:

training and testing requirements for employees handling personal data.

roles and responsibilities of the person with oversights.

metrics and outcomes recommended by external agencies.

the scope and responsibilities of the data owner.

NEW QUESTION 103
Which of the following hard drive sanitation methods provides an organization with the GREATEST level of assurance that data has been permanently erased?

Degaussing the drive

Factory resetting the drive

Crypto-shredding the drive

Reformatting the drive

NEW QUESTION 104
Which of the following features should be incorporated into an organization’s technology stack to meet privacy requirements related to the rights of data subjects to control their personal data?

Providing system engineers the ability to search and retrieve data

Allowing individuals to have direct access to their data

Allowing system administrators to manage data access

Establishing a data privacy customer service bot for individuals

NEW QUESTION 105
Using hash values With stored personal data BEST enables an organization to

protect against unauthorized access.

detect changes to the data.

ensure data indexing performance.

tag the data with classification information

NEW QUESTION 106
Which of the following should FIRST be established before a privacy office starts to develop a data protection and privacy awareness campaign?

Detailed documentation of data privacy processes

Strategic goals of the organization

Contract requirements for independent oversight

Business objectives of senior leaders

NEW QUESTION 107
Which of the following vulnerabilities is MOST effectively mitigated by enforcing multi-factor authentication to obtain access to personal information?

End users using weak passwords

Organizations using weak encryption to transmit data

Vulnerabilities existing in authentication pages

End users forgetting their passwords

NEW QUESTION 108
Which of the following is a PRIMARY element of application and software hardening?

Vulnerability analysis

Database configuration

Code review

Software repository

NEW QUESTION 109
What is the BEST method to protect customers’ personal data that is forwarded to a central system for analysis?

Pseudonymization

Deletion

Encryption

Anonymization

NEW QUESTION 110
An IT privacy practitioner wants to test an application in pre-production that will be processing sensitive personal dat a. Which of the following testing methods is BEST used to identity and review the application’s runtime modules?

Static application security testing (SAST)

Dynamic application security testing (DAST)

Regression testing

Software composition analysis

NEW QUESTION 111
What should be the PRIMARY consideration of a multinational organization deploying a user and entity behavior analytics (UEBA) tool to centralize the monitoring of anomalous employee behavior?

Cross-border data transfer

Support staff availability and skill set

User notification

Global public interest

NEW QUESTION 112
Which of the following is the BEST way for senior management to verify the success of its commitment to privacy by design?

Review the findings of an industry benchmarking assessment

Identify trends in the organization’s amount of compromised personal data

Review the findings of a third-party privacy control assessment

Identify trends in the organization’s number of privacy incidents.

Explanation
A third-party privacy control assessment is an independent and objective evaluation of the design and effectiveness of the privacy controls implemented by an organization to protect personal data and comply with privacy laws and regulations. A third-party privacy control assessment can help senior management to verify the success of its commitment to privacy by design, by providing the following benefits:
It can measure the extent to which the organization has adopted and integrated the principles and practices of privacy by design throughout its products, services, processes and systems.
It can identify the strengths and weaknesses of the organization’s privacy governance, policies, procedures, standards and guidelines, and provide recommendations for improvement.
It can validate the organization’s compliance with the applicable privacy requirements and expectations of its customers, stakeholders, regulators and auditors.
It can enhance the organization’s reputation and trustworthiness as a responsible and transparent data controller and processor.
The other options are less effective or irrelevant for verifying the success of the commitment to privacy by design. Reviewing the findings of an industry benchmarking assessment may provide some insights into how the organization compares with its peers or competitors in terms of privacy performance, but it may not reflect the specific privacy goals, risks and challenges of the organization. Identifying trends in the organization’s amount of compromised personal data or number of privacy incidents may indicate some aspects of the organization’s privacy maturity, but they are reactive and lagging indicators that do not capture the proactive and preventive nature of privacy by design. Moreover, these metrics may not account for other factors that may influence the occurrence or impact of data breaches or privacy violations, such as external threats, human errors or environmental changes.
References:
Privacy by Design: How Far Have We Come? – ISACA, section 1: “Privacy by design challenges conventional system thinking. It mandates that any system, process or infrastructure that uses personal data consider privacy throughout its development life cycle.” Privacy Control Assessment – ISACA, section 1: “A Privacy Control Assessment (PCA) is an independent evaluation performed by a qualified assessor to determine whether an entity’s controls are suitably designed and operating effectively to meet its objectives related to protecting personal information.” Privacy by Design: The New Competitive Advantage – ISACA, section 2: “Privacy by design is a proactive approach to embedding privacy into the design specifications of various technologies, business practices and networked infrastructure.”

NEW QUESTION 113
Which of the following technologies BEST facilitates protection of personal data?

Data loss prevention (DLP) tools

Data discovery and mapping tools

Data log file monitoring tools

Data profiling tools

NEW QUESTION 114
Which of the following is the BEST way to reduce the risk of compromise when transferring personal information using email?

Centrally managed encryption

End user-managed encryption

Private cloud storage space

Password-protected .zip files

Explanation
Encryption is a security practice that transforms data into an unreadable format using a secret key or algorithm. Encryption protects the confidentiality and integrity of data, especially when they are transferred using email or other communication channels. Encryption ensures that only authorized parties can access and use the data, while unauthorized parties cannot decipher or modify the data without the key or algorithm.
Encryption also helps to comply with data protection laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), which require data controllers and processors to implement appropriate technical and organizational measures to safeguard personal data.
Centrally managed encryption is a type of encryption that is implemented and controlled by a central authority or system, such as an organization or a service provider. Centrally managed encryption has the following advantages over end user-managed encryption, private cloud storage space, or password-protected .zip files, for reducing the risk of compromise when transferring personal information using email:
It can enforce consistent and standardized encryption policies and procedures across the organization or the service, such as the encryption standards, algorithms, keys, modes, and formats.
It can automate the encryption and decryption processes for the users, without requiring them to perform any manual actions or install any software or plug-ins on their devices.
It can monitor and audit the encryption activities and incidents, and provide visibility and accountability for the data protection and compliance status.
It can reduce the human errors or negligence that may compromise the encryption security, such as losing or sharing the keys, forgetting or reusing the passwords, or sending the data to the wrong recipients.
References:
Encryption in the Hands of End Users – ISACA, section 2: “A key goal of encryption is to protect the file even when direct access is possible or the transfer is intercepted.” The Complexity Conundrum: Simplifying Data Security – ISACA, section 3: “Centrally managed encryption solutions can help enterprises overcome these challenges by providing a unified platform for encrypting data across different environments and applications.” Email Encryption: What You Need to Know – Lifewire, section 1: “Email encryption is a way of protecting your email messages from being read by anyone other than the intended recipients.”

NEW QUESTION 115
During which of the following system lifecycle stages is it BEST to conduct a privacy impact assessment (PIA) on a system that holds personal data?

Functional testing

Development

Production

User acceptance testing (UAT)

NEW QUESTION 116
Which of the following would MOST effectively reduce the impact of a successful breach through a remote access solution?

Compartmentalizing resource access

Regular testing of system backups

Monitoring and reviewing remote access logs

Regular physical and remote testing of the incident response plan

NEW QUESTION 117
Which of the following is MOST important to ensure when developing a business case for the procurement of a new IT system that will process and store personal information?

The system architecture is clearly defined.

A risk assessment has been completed.

Security controls are clearly defined.

Data protection requirements are included.

NEW QUESTION 118
Which of the following describes a user’s “right to be forgotten”?

The data is being used to comply with legal obligations or the public interest.

The data is no longer required for the purpose originally collected.

The individual objects despite legitimate grounds for processing.

The individual’s legal residence status has recently changed.

Leave a Reply Cancel reply