CDPSE Incident Response 5

Question 1

Which NIST framework phase corresponds most closely to identifying that a privacy incident has occurred and classifying its scope?

Accepted Answer

Detection and Analysis

Answer

The Detection and Analysis phase of the NIST incident response lifecycle covers identifying, classifying, and characterizing the scope of an incident.

Question 2

A breach involves the unauthorized disclosure of 50,000 patient records. The organization's DPA contact list is outdated. What risk does this create?

Accepted Answer

Missed regulatory notification deadlines due to inability to reach the correct authority

Answer

Outdated regulatory contact information can cause the organization to miss mandatory notification windows, resulting in additional violations and penalties.

Question 3

Under a data processing agreement, a processor discovers a breach at 6 PM Friday. When must they notify the controller under GDPR?

Accepted Answer

Without undue delay after becoming aware

Answer

GDPR requires processors to notify controllers without undue delay after becoming aware of a breach, enabling the controller to meet its own 72-hour notification obligation.

Question 4

Which privacy engineering principle, if applied before an incident occurs, MOST reduces the volume of data exposed during a breach?

Accepted Answer

Data minimization

Answer

Data minimization limits the collection and retention of personal data, directly reducing the number of records and fields that can be exposed in a breach.

Question 5

An incident response team concludes that a breach was caused by an employee who mishandled data without malicious intent. What corrective action is MOST appropriate from a privacy program perspective?

Accepted Answer

Review and strengthen training, access controls, and data handling procedures

Answer

Non-malicious insider incidents signal gaps in training and controls; the appropriate response is to improve safeguards rather than pursue punitive action alone.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Incident Response 5