CRM CRM Security and Compliance 2 — Questions and Answers
Question 1: What is the primary purpose of an audit trail in a CRM system?
- To speed up database query performance
- To track and record all changes made to records for accountability and compliance (Correct answer)
- To automatically back up CRM data to a secondary server
- To notify administrators of login failures
Correct answer: To track and record all changes made to records for accountability and compliance
An audit trail logs who made changes, what was changed, and when, providing an accountability record required by many compliance frameworks.
Question 2: The California Consumer Privacy Act (CCPA) grants consumers which of the following rights regarding their data held in a CRM?
- The right to demand financial compensation for data use
- The right to know, delete, and opt-out of the sale of their personal information (Correct answer)
- The right to prohibit all data storage beyond 90 days
- The right to access the CRM system directly
Correct answer: The right to know, delete, and opt-out of the sale of their personal information
CCPA provides California consumers with rights to know what data is collected, request deletion, and opt-out of the sale of their personal information.
Question 3: Which authentication method adds a second verification step beyond a password when logging into a CRM?
- Single Sign-On (SSO)
- Multi-Factor Authentication (MFA) (Correct answer)
- OAuth 2.0
- SAML Federation
Correct answer: Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) requires users to verify their identity with a second factor (e.g., SMS code or authenticator app) in addition to their password.
Question 4: In the context of CRM data compliance, what does 'data residency' refer to?
- The length of time data is stored before deletion
- The physical or geographic location where customer data is stored (Correct answer)
- The encryption algorithm applied to stored data
- The backup frequency for CRM databases
Correct answer: The physical or geographic location where customer data is stored
Data residency specifies the country or region where customer data must physically reside, often mandated by local privacy laws and regulations.
Question 5: What CRM security practice involves replacing sensitive data with a non-sensitive placeholder that retains format but has no exploitable value?
- Encryption
- Tokenization (Correct answer)
- Data Masking
- Hashing
Correct answer: Tokenization
Tokenization replaces sensitive data (e.g., credit card numbers) with a random token, so the original data is never stored in the CRM but can be referenced via the token.
Question 6: Under HIPAA, which type of CRM data requires the highest level of protection?
- Sales pipeline stage information
- Protected Health Information (PHI) (Correct answer)
- Marketing campaign metrics
- Customer satisfaction scores
Correct answer: Protected Health Information (PHI)
HIPAA specifically governs Protected Health Information (PHI), which includes any data that can identify a patient and relates to their health status or care.
Question 7: What is the role of a Data Processing Agreement (DPA) between a business and its CRM vendor?
- It sets pricing for the CRM subscription
- It defines how the vendor handles personal data on behalf of the business in compliance with privacy laws (Correct answer)
- It outlines the CRM's uptime SLA guarantees
- It specifies the backup and disaster recovery schedule
Correct answer: It defines how the vendor handles personal data on behalf of the business in compliance with privacy laws
A DPA is a legally binding contract required by GDPR and similar laws that specifies the vendor's data processing obligations and security responsibilities.
CRM CRM Security and Compliance 2
What is the primary purpose of an audit trail in a CRM system?