CDPSE Incident Response 4

Question 1

A privacy officer receives a credible tip that an employee has been emailing customer personal data to a personal account. Which incident response step should occur FIRST?

Accepted Answer

Preserve evidence by capturing email logs before the employee is confronted

Answer

Preserving forensic evidence before taking containment or notification actions ensures the organization has an accurate record for investigation and legal purposes.

Question 2

Under GDPR Article 34, when must data controllers notify affected individuals directly about a breach?

Accepted Answer

When the breach is likely to result in a high risk to rights and freedoms of natural persons

Answer

GDPR Article 34 requires direct notification to individuals only when the breach is likely to result in a high risk to their rights and freedoms.

Question 3

A privacy engineer recommends 'pseudonymization' as a post-breach control. What is the primary privacy benefit of this technique?

Accepted Answer

It reduces re-identification risk so future exposure causes less harm

Answer

Pseudonymization reduces the risk that exposed data can be directly linked to individuals, limiting harm if a future breach occurs.

Question 4

Which incident response role is MOST responsible for determining whether a privacy breach notification obligation exists?

Accepted Answer

Chief Privacy Officer or Privacy Counsel

Answer

The Chief Privacy Officer or Privacy Counsel interprets applicable privacy laws to determine whether a breach triggers mandatory notification obligations.

Question 5

An organization uses a cloud service provider to store personal data. The CSP experiences a breach. Under GDPR, which party must notify the supervisory authority?

Accepted Answer

The organization (controller) must notify the supervisory authority

Answer

The controller holds the notification obligation under GDPR; the processor must notify the controller without undue delay so the controller can meet its obligations.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Incident Response 4