General Data Privacy and Security Questions and Answers

Question 1

An employee receives an urgent email that appears to be from their CEO, requesting the immediate transfer of sensitive customer data to an external consultant. The email has a slightly unusual tone and sender address. What is the most appropriate first action for the employee to take?

Accepted Answer

Do not reply; instead, use a separate, known communication channel (like a phone call) to verify the request with the CEO and report the email to the IT/Security department.

Answer

This scenario describes a potential Business Email Compromise (BEC) or phishing attack. The correct action is to never trust urgent, unusual requests via email. The employee should verify the request using an 'out-of-band' method (a different, trusted channel) and report the suspicious email to the security team for investigation.

Question 2

Which of the following best describes the principle of "Integrity" within the context of the CIA triad of information security?

Accepted Answer

Ensuring that data is accurate, trustworthy, and has not been tampered with or altered by unauthorized parties.

Answer

The CIA triad consists of Confidentiality, Integrity, and Availability. Integrity specifically refers to maintaining the consistency, accuracy, and trustworthiness of data over its entire lifecycle. Confidentiality is about preventing unauthorized access, and Availability is about ensuring access for authorized users when needed.

Question 3

A company that markets products globally must comply with regulations for protecting the personal data of individuals residing in the European Union. Which regulation establishes strict rules for this, including the "right to be forgotten"?

Accepted Answer

General Data Protection Regulation (GDPR)

Answer

The General Data Protection Regulation (GDPR) is the landmark data protection law from the EU that governs the processing of personal data of EU residents. It is well-known for codifying individual rights such as the right to erasure, also known as the 'right to be forgotten'. HIPAA relates to US healthcare information, CCPA is a California-specific law, and SOX relates to financial reporting.

Question 4

A marketing team is creating a sign-up form for a monthly email newsletter. To comply with the data privacy principle of "data minimization," what information should the form require from users?

Accepted Answer

Only the data that is absolutely necessary for the specific purpose, such as the email address.

Answer

Data minimization is a core privacy principle stating that an organization should only collect personal data that is directly relevant and necessary to accomplish a specified purpose. For a marketing email list, only the email address is strictly necessary to fulfill the function of sending the newsletter.

Question 5

Which of the following is a critical component of a strong password policy designed to prevent unauthorized access?

Accepted Answer

Requiring a mix of character types (e.g., uppercase, lowercase, numbers, symbols) and a sufficient minimum length.

Answer

The foundation of a strong password is a combination of length and complexity (a mix of character types). This makes it significantly harder for attackers to guess or use brute-force methods to crack. While frequent password changes were once common, modern guidance often de-emphasizes this in favor of longer, more complex passwords and multi-factor authentication.

General Practice Test

General Practice Test

General Data Privacy and Security Questions and Answers