Practice Test GeeksCDPSE - Certified Data Privacy Solutions Engineer Practice Test
← All CDPSE Flashcard Decks

Risk Management Flashcards

6 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Risk Management flashcards as text

  1. A financial services company is developing a new mobile application that will use customer transaction data to provide personalized investment recommendations using an AI-powered algorithm. According to GDPR Article 35, which of the following is the MOST critical first step in the privacy risk management process for this new application?

    Answer: Performing a Data Protection Impact Assessment (DPIA).

    According to Article 35 of the GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing is 'likely to result in a high risk to the rights and freedoms of natural persons'. The scenario involves large-scale processing of sensitive financial data and uses new technology (AI), which automatically triggers the need for a DPIA to systematically assess and mitigate privacy risks before the processing begins.

  2. A data privacy engineer is tasked with integrating privacy risk management into the organization's existing Information Security Management System (ISMS). Which international standard provides a framework for establishing, implementing, and continually improving a Privacy Information Management System (PIMS) as an extension to ISO/IEC 27001?

    Answer: ISO/IEC 27701

    ISO/IEC 27701 is an extension to the ISO/IEC 27001 and ISO/IEC 27002 standards for information security management. It specifies the requirements for, and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is designed to help organizations manage privacy risks related to personally identifiable information (PII).

  3. Which of the following principles of Privacy by Design (PbD) is BEST demonstrated by configuring an application's data sharing settings to 'off' by default, requiring the user to actively enable sharing?

    Answer: Privacy as the Default Setting

    The principle of 'Privacy as the Default Setting' ensures that personal data is automatically protected in any given system or business practice. No action is required on the part of the individual to protect their privacy; it is built into the system by default. Setting data sharing to 'off' is a direct implementation of this principle.

  4. A privacy engineer is conducting a privacy risk assessment for a new HR system. The process involves identifying potential threats to personal data, analyzing the likelihood and impact of these threats, and then determining the overall level of risk. This phase of the risk management process is known as:

    Answer: Risk Analysis

    Risk analysis is the process of comprehending the nature of risk and determining the level of risk. It involves analyzing potential threats and vulnerabilities, and considering the likelihood and consequences of an incident to determine the magnitude of the risk. This step follows risk identification and precedes risk evaluation.

  5. When managing privacy risks, it is crucial to distinguish them from security risks. Which of the following scenarios describes a privacy risk arising from authorized data processing, rather than a security risk from unauthorized access?

    Answer: Customer data collected for marketing is used to make automated, adverse credit decisions without transparency.

    Privacy risks can arise from authorized data processing activities that are problematic, while security risks typically stem from unauthorized access. Using data for a secondary purpose that is incompatible with the original purpose for which it was collected, and which has a significant negative impact on the individual (like an adverse credit decision), is a classic example of a privacy risk resulting from authorized, but inappropriate, data processing.

  6. The NIST Privacy Framework is designed to help organizations manage privacy risks. The Framework's 'Core' is a set of activities and outcomes that enables communication of privacy priorities. Which of the following is NOT one of the five high-level Functions of the NIST Privacy Framework Core?

    Answer: Remediate-P

    The five Functions of the NIST Privacy Framework Core are Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P. These functions are designed to help an organization manage privacy risks from the executive level to the operational level. 'Remediate' is not one of the core functions, although remediation activities would fall under the other functions as part of a risk response.