General Data Privacy and Security Questions and Answers

Question 1

An employee receives an urgent email that appears to be from their CEO, requesting the immediate transfer of sensitive customer data to an external consultant.
The email has a slightly unusual tone and sender address.
What is the most appropriate first action for the employee to take?

Accepted Answer

Do not reply; instead, use a separate, known communication channel (like a phone call) to verify the request with the CEO and report the email to the IT/Security department.

Answer

Immediately send the data as requested to be efficient.

Answer

Reply to the email asking for more details about the consultant.

Answer

Delete the email and ignore the request, assuming it's spam.

Question 2

Which of the following best describes the principle of "Integrity" within the context of the CIA triad of information security?

Accepted Answer

Ensuring that data is accurate, trustworthy, and has not been tampered with or altered by unauthorized parties.

Answer

Ensuring that information is accessible only to authorized individuals.

Answer

Ensuring that systems and data are available and operational when needed.

Answer

Ensuring that all data is encrypted both at rest and in transit.

Question 3

A company that markets products globally must comply with regulations for protecting the personal data of individuals residing in the European Union. Which regulation establishes strict rules for this, including the "right to be forgotten"?

Accepted Answer

General Data Protection Regulation (GDPR)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

California Consumer Privacy Act (CCPA)

Answer

Sarbanes-Oxley Act (SOX)

Question 4

A marketing team is creating a sign-up form for a monthly email newsletter. To comply with the data privacy principle of "data minimization," what information should the form require from users?

Accepted Answer

Only the data that is absolutely necessary for the specific purpose, such as the email address.

Answer

Full name, email address, physical address, and date of birth.

Answer

Email address and phone number to have multiple contact methods.

Answer

Email address and consent to share the data with third-party partners.

Question 5

Which of the following is a critical component of a strong password policy designed to prevent unauthorized access?

Accepted Answer

Requiring a mix of character types (e.g., uppercase, lowercase, numbers, symbols) and a sufficient minimum length.

Answer

Forcing users to change their password every 30 days regardless of its strength.

Answer

Allowing users to write their passwords on a sticky note kept at their desk for easy recall.

Answer

Requiring passwords to be common words found in the dictionary for memorability.

Question 6

An organization discovers that a laptop containing unencrypted customer financial data has been stolen. According to most data breach notification laws, what is the organization's primary responsibility?

Accepted Answer

Notify the affected individuals and relevant regulatory authorities without undue delay.

Answer

Immediately fire the employee responsible for the laptop.

Answer

Wait to see if the data appears online before taking any action.

Answer

Issue a press release denying that any sensitive data was on the laptop.