CDPSE Flashcards
7 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 CDPSE flashcards as text
What would be the BEST justification from a privacy standpoint for including log generation in a system's design?
Answer: Facilitate early detection of abuse or misuse of the data that a system processes.
From a privacy standpoint, log generation is crucial for accountability and oversight of data processing activities. By recording system events and user actions, logs enable organizations to detect and investigate any unauthorized access, misuse, or abuse of personal data early on. This proactive monitoring helps protect privacy by allowing for timely intervention and mitigation of potential breaches.
Data containing end user details was retrieved by an attacker from a test and development environment. Which hardening method from the list below would best stop this assault from becoming a significant privacy breach?
Answer: Data obfuscation
Data obfuscation involves transforming sensitive data to make it unreadable or unusable without specific decryption keys or processes, such as anonymization or pseudonymization. If the end-user details in the test environment had been obfuscated, even if an attacker retrieved them, the actual personal information would be protected, preventing a significant privacy breach.
How should the chief privacy officer of a global company BEST strike a balance between the demands of the company's privacy standards and local laws?
Answer: Create a local version of the organizational standards.
Creating local versions of organizational privacy standards allows a global company to tailor its policies to comply with the specific legal requirements of each jurisdiction. This approach ensures adherence to local laws while maintaining a consistent, overarching privacy framework across the entire organization. It effectively balances global consistency with local legal compliance.
What is one of the privacy professional's BIGGEST worries when adopting data analytics in an organization?
Answer: Ensure the protection of customer information that is collected.
Data analytics often involves collecting, processing, and storing large volumes of personal and sensitive customer information. The privacy professional's paramount concern is to ensure that this data is adequately protected throughout its lifecycle, preventing unauthorized access, misuse, or disclosure. Safeguarding customer information is fundamental to maintaining trust and complying with privacy regulations.
Who is responsible for determining the harm tolerance and privacy risk levels?
Answer: Enterprise risk management committee
The Enterprise Risk Management (ERM) committee is typically responsible for establishing the organization's overall risk appetite and tolerance levels, which encompass all types of risks, including privacy. This committee provides a holistic view of risk, ensuring that privacy risks are assessed and managed within the broader context of the organization's strategic objectives and risk framework.
What would be the BEST justification from a privacy standpoint for including log generation in a system's design?
Answer: Facilitate early detection of abuse or misuse of the data that a system processes.
From a privacy standpoint, log generation is crucial for accountability and oversight of data processing activities. By recording system events and user actions, logs enable organizations to detect and investigate any unauthorized access, misuse, or abuse of personal data early on. This proactive monitoring helps protect privacy by allowing for timely intervention and mitigation of potential breaches.
When data is frequently moved outside of the company as part of its life cycle, which standards in a service level agreement would be BEST to include?
Answer: Quality and privacy requirements
When data is frequently transferred to third-party vendors, it is essential to include explicit quality and privacy requirements in the Service Level Agreement (SLA). This ensures that the vendor maintains the integrity and accuracy of the data, and more importantly, adheres to strict privacy standards for handling, processing, and protecting the personal information, mitigating risks of breaches or non-compliance.