HCT Security & Access Management 3 — Questions and Answers
Question 1: Under GDPR, what must a HubSpot portal have configured before sending marketing emails to EU contacts?
- A custom email domain
- Legitimate interest or consent legal basis recorded per contact (Correct answer)
- A HubSpot Pro subscription or higher
- An active subscription status workflow
Correct answer: Legitimate interest or consent legal basis recorded per contact
GDPR requires that each contact have a documented lawful basis (consent or legitimate interest) before receiving marketing communications.
Question 2: Where in HubSpot do you configure the data retention policy that automatically deletes inactive contacts after a set period?
- Settings > Privacy & Consent > Data Retention (Correct answer)
- Reports > Data Management > Retention Rules
- CRM > Contacts > Lifecycle Automation
- Settings > Account > Compliance Center
Correct answer: Settings > Privacy & Consent > Data Retention
HubSpot's Privacy & Consent settings include data retention rules that automatically purge contacts who haven't engaged within a defined timeframe.
Question 3: A contact submits a 'Right to Erasure' request under GDPR. What is the correct action in HubSpot?
- Unsubscribe the contact from all email lists
- Delete the contact record and all associated data from the portal (Correct answer)
- Mark the contact as 'Do Not Contact' in their properties
- Archive the contact record without deleting personal data
Correct answer: Delete the contact record and all associated data from the portal
The right to erasure (right to be forgotten) requires permanently deleting the contact and all their personal data from the system.
Question 4: What is the function of HubSpot's 'Consent to process' checkbox on forms?
- It triggers a GDPR compliance workflow
- It records explicit consent from contacts for data processing (Correct answer)
- It adds contacts to a GDPR suppression list
- It requires admin approval before the contact is created
Correct answer: It records explicit consent from contacts for data processing
The 'Consent to process' form field records a timestamped consent record indicating the contact agreed to have their data processed.
Question 5: Which HubSpot setting prevents forms from capturing data from contacts in countries where you lack a legal basis to process their information?
- Cookie consent banners with geo-targeting
- GDPR-friendly forms with required consent checkboxes (Correct answer)
- Country-based suppression lists in email settings
- Blocking form submissions via workflow filters
Correct answer: GDPR-friendly forms with required consent checkboxes
GDPR-friendly forms require explicit consent checkboxes so data is only captured when contacts actively agree to processing.
Question 6: A HubSpot trainer is advising a client on cookie tracking. Which tool in HubSpot manages cookie consent banners for website visitors?
- HubSpot CMS Privacy Settings
- Cookie Policy module in Blog settings
- Privacy & Consent > Cookie Banner (Correct answer)
- Website > Pages > Cookie Compliance
Correct answer: Privacy & Consent > Cookie Banner
HubSpot's Privacy & Consent settings include a configurable cookie banner that manages visitor consent for tracking cookies.
Question 7: In HubSpot, what does enabling 'Additional security > Require two-factor authentication' do for a portal?
- Forces all users to set up 2FA on their next login (Correct answer)
- Enables 2FA only for users with Super Admin permissions
- Allows users to optionally enable 2FA from their profile
- Restricts portal access to approved IP addresses only
Correct answer: Forces all users to set up 2FA on their next login
When an admin requires 2FA portal-wide, all users must configure and use two-factor authentication to access the portal.
HCT Security & Access Management 3
Under GDPR, what must a HubSpot portal have configured before sending marketing emails to EU contacts?