General Data Privacy and Security 4 — Questions and Answers
Question 1: What is 'data anonymization'?
- Deleting personal data after a set period
- Removing or altering information so individuals can no longer be identified (Correct answer)
- Encrypting data so only authorized users can read it
- Storing data on a separate server away from production
Correct answer: Removing or altering information so individuals can no longer be identified
Data anonymization is the process of transforming personal data so that the individual cannot be identified, either directly or indirectly.
Question 2: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Trojan horse (Correct answer)
- Rootkit
- Adware
Correct answer: Trojan horse
A Trojan horse is malware that appears to be legitimate software but contains hidden malicious code that executes once installed.
Question 3: What does 'the right to be forgotten' (erasure) allow individuals to do under GDPR?
- Request that all cookies be cleared from their browser
- Ask organizations to delete their personal data under certain conditions (Correct answer)
- Remove themselves from marketing lists only
- Have their search history deleted from their own device
Correct answer: Ask organizations to delete their personal data under certain conditions
Under GDPR, the right to erasure (right to be forgotten) allows individuals to request deletion of their personal data when it is no longer necessary or when consent is withdrawn.
Question 4: What is 'spear phishing'?
- A broad phishing campaign targeting thousands of random recipients
- A targeted phishing attack directed at a specific individual or organization (Correct answer)
- An attack that compromises email servers to send malware
- A type of phishing that uses phone calls instead of email
Correct answer: A targeted phishing attack directed at a specific individual or organization
Spear phishing is a highly targeted form of phishing that uses personalized information about a specific victim to make the fraudulent message appear more credible.
Question 5: What is 'patch management' in the context of cybersecurity?
- Monitoring network traffic for anomalies
- The process of regularly applying updates to fix vulnerabilities in software (Correct answer)
- Creating backup copies of sensitive data
- Configuring user access permissions
Correct answer: The process of regularly applying updates to fix vulnerabilities in software
Patch management is the practice of identifying, acquiring, testing, and applying software updates to close security vulnerabilities before they can be exploited.
Question 6: What is 'pseudonymization' as defined under GDPR?
- Deleting all direct identifiers from a dataset permanently
- Replacing identifying information with artificial identifiers while keeping data useful (Correct answer)
- Encrypting data so it cannot be accessed without a key
- Storing personal data under a false name to protect identity
Correct answer: Replacing identifying information with artificial identifiers while keeping data useful
Pseudonymization replaces directly identifying data with a pseudonym (an artificial identifier), but re-identification is still possible with additional information kept separately.
Question 7: Which security concept describes the practice of granting users only the permissions they need to perform their job?
- Defense in depth
- Principle of least privilege (Correct answer)
- Zero trust architecture
- Role-based isolation
Correct answer: Principle of least privilege
The principle of least privilege limits user access rights to only what is necessary for their role, reducing the risk of accidental or malicious misuse.
General Data Privacy and Security 4
What is 'data anonymization'?