GDPR Security & Access Management 2

Question 1

Under GDPR Article 32, which factor does NOT need to be considered when implementing appropriate technical security measures?

Accepted Answer

The profitability of the data controller

Answer

Article 32 requires considering costs, nature/context, and risks — but profitability of the controller is not a relevant factor.

Question 2

A company implements role-based access control (RBAC) so employees only access personal data needed for their job. Which GDPR principle does this primarily support?

Accepted Answer

Data minimisation

Answer

RBAC limiting access to only necessary data is a technical implementation of the data minimisation principle (Article 5(1)(c)).

Question 3

What is the primary purpose of implementing pseudonymisation as a security measure under GDPR?

Accepted Answer

To replace identifying fields with artificial identifiers, reducing risk while retaining utility

Answer

Pseudonymisation replaces direct identifiers with artificial ones, reducing exposure risk while keeping data useful — it is still personal data under GDPR.

Question 4

Which scenario best demonstrates the principle of 'integrity and confidentiality' under GDPR Article 5(1)(f)?

Accepted Answer

Using encryption and access controls to prevent unauthorised processing

Answer

Article 5(1)(f) requires processing personal data in a manner ensuring appropriate security, including protection against unauthorised access — achieved via encryption and access controls.

Question 5

An organisation discovers that a former employee's credentials were used to access personal data after their contract ended. Which access management failure does this represent?

Accepted Answer

Inadequate offboarding and access revocation procedures

Answer

Using terminated employee credentials indicates the organisation failed to revoke access during offboarding, a fundamental access lifecycle management failure.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR Security & Access Management 2