General Data Privacy and Security Questions and Answers — Questions and Answers
Question 1: An employee receives an urgent email that appears to be from their CEO, requesting the immediate transfer of sensitive customer data to an external consultant. The email has a slightly unusual tone and sender address. What is the most appropriate first action for the employee to take?
- Immediately send the data as requested to be efficient.
- Reply to the email asking for more details about the consultant.
- Do not reply; instead, use a separate, known communication channel (like a phone call) to verify the request with the CEO and report the email to the IT/Security department. (Correct answer)
- Delete the email and ignore the request, assuming it's spam.
Correct answer: Do not reply; instead, use a separate, known communication channel (like a phone call) to verify the request with the CEO and report the email to the IT/Security department.
This scenario describes a potential Business Email Compromise (BEC) or phishing attack. The correct action is to never trust urgent, unusual requests via email. The employee should verify the request using an 'out-of-band' method (a different, trusted channel) and report the suspicious email to the security team for investigation.
Question 2: Which of the following best describes the principle of "Integrity" within the context of the CIA triad of information security?
- Ensuring that information is accessible only to authorized individuals.
- Ensuring that systems and data are available and operational when needed.
- Ensuring that data is accurate, trustworthy, and has not been tampered with or altered by unauthorized parties. (Correct answer)
- Ensuring that all data is encrypted both at rest and in transit.
Correct answer: Ensuring that data is accurate, trustworthy, and has not been tampered with or altered by unauthorized parties.
The CIA triad consists of Confidentiality, Integrity, and Availability. Integrity specifically refers to maintaining the consistency, accuracy, and trustworthiness of data over its entire lifecycle. Confidentiality is about preventing unauthorized access, and Availability is about ensuring access for authorized users when needed.
Question 3: A company that markets products globally must comply with regulations for protecting the personal data of individuals residing in the European Union. Which regulation establishes strict rules for this, including the "right to be forgotten"?
- Health Insurance Portability and Accountability Act (HIPAA)
- General Data Protection Regulation (GDPR) (Correct answer)
- California Consumer Privacy Act (CCPA)
- Sarbanes-Oxley Act (SOX)
Correct answer: General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the landmark data protection law from the EU that governs the processing of personal data of EU residents. It is well-known for codifying individual rights such as the right to erasure, also known as the 'right to be forgotten'. HIPAA relates to US healthcare information, CCPA is a California-specific law, and SOX relates to financial reporting.
Question 4: A marketing team is creating a sign-up form for a monthly email newsletter. To comply with the data privacy principle of "data minimization," what information should the form require from users?
- Full name, email address, physical address, and date of birth.
- Only the data that is absolutely necessary for the specific purpose, such as the email address. (Correct answer)
- Email address and phone number to have multiple contact methods.
- Email address and consent to share the data with third-party partners.
Correct answer: Only the data that is absolutely necessary for the specific purpose, such as the email address.
Data minimization is a core privacy principle stating that an organization should only collect personal data that is directly relevant and necessary to accomplish a specified purpose. For a marketing email list, only the email address is strictly necessary to fulfill the function of sending the newsletter.
Question 5: Which of the following is a critical component of a strong password policy designed to prevent unauthorized access?
- Requiring a mix of character types (e.g., uppercase, lowercase, numbers, symbols) and a sufficient minimum length. (Correct answer)
- Forcing users to change their password every 30 days regardless of its strength.
- Allowing users to write their passwords on a sticky note kept at their desk for easy recall.
- Requiring passwords to be common words found in the dictionary for memorability.
Correct answer: Requiring a mix of character types (e.g., uppercase, lowercase, numbers, symbols) and a sufficient minimum length.
The foundation of a strong password is a combination of length and complexity (a mix of character types). This makes it significantly harder for attackers to guess or use brute-force methods to crack. While frequent password changes were once common, modern guidance often de-emphasizes this in favor of longer, more complex passwords and multi-factor authentication.
Question 6: An organization discovers that a laptop containing unencrypted customer financial data has been stolen. According to most data breach notification laws, what is the organization's primary responsibility?
- Immediately fire the employee responsible for the laptop.
- Wait to see if the data appears online before taking any action.
- Notify the affected individuals and relevant regulatory authorities without undue delay. (Correct answer)
- Issue a press release denying that any sensitive data was on the laptop.
Correct answer: Notify the affected individuals and relevant regulatory authorities without undue delay.
Virtually all data breach laws in the U.S. and abroad require organizations to notify affected individuals (and often regulatory bodies) in a timely manner. This allows individuals to take protective measures, such as monitoring their credit or changing passwords, to mitigate potential harm.
General Data Privacy and Security Questions and Answers
An employee receives an urgent email that appears to be from their CEO, requesting the immediate transfer of sensitive customer data to an external consultant.
The email has a slightly unusual tone and sender address.
What is the most appropriate first action for the employee to take?