CDPSE Practice Questions

Implementing multi-factor authentication is the best way to reduce the risk of compromised

credentials when an organization allows employees to have remote access, as it adds an extra layer

of security and verification to the authentication process. Multi-factor authentication requires the

user to provide two or more pieces of evidence to prove their identity, such as something they know

(e.g., password, PIN), something they have (e.g., token, smart card), or something they are (e.g.,

fingerprint, face scan)135. Reference: 1 Domain 2, Task 8;

A privacy risk assessment is a process of identifying, analyzing and evaluating the privacy risks

associated with the collection, use, disclosure or retention of personal data. A privacy risk

assessment is the best way to distinguish between a privacy risk and compliance risk, as it would

help to determine the likelihood and impact of privacy incidents or breaches that could affect the

rights and interests of the data subjects, as well as the legal obligations and responsibilities of the

organization. A privacy risk assessment would also help to identify and implement appropriate

controls and measures to mitigate or reduce the privacy risks and ensure compliance with privacy

principles, laws and regulations. The other options are not as effective as conducting a privacy risk

assessment in distinguishing between a privacy risk and compliance risk. Performing a privacy risk

audit is a process of verifying and validating the effectiveness and adequacy of the privacy controls

and measures implemented by the organization, but it does not necessarily identify or evaluate the

privacy risks or compliance risks. Validating a privacy risk attestation is a process of confirming and

certifying the accuracy and completeness of the privacy information or statements provided by the

organization, but it does not necessarily identify or evaluate the privacy risks or compliance

risks. Conducting a privacy risk remediation exercise is a process of implementing corrective actions

or improvements to address the identified or reported privacy risks or compliance risks, but it does

not necessarily distinguish between them1, p. 66-67 Reference: 1: CDPSE Review Manual (Digital

Version)

Reference: https://www.imperva.com/learn/data-security/role-based-access-control-rbac/

Role-based access control is a method of managing different IT staff access permissions for personal

data within an organization by assigning roles to users based on their job functions and

responsibilities, and granting access rights to roles based on the principle of least privilege and need

to know. Role-based access control is the best way to manage different IT staff access permissions for

personal data within an organization, as it would help to protect the confidentiality, integrity and

availability of the personal data, and also comply with the privacy principles, laws and regulations.

Role-based access control would also simplify the administration and maintenance of access

permissions, as it would reduce the complexity and redundancy of managing individual user

accounts. The other options are not as effective as role-based access control in managing different IT

staff access permissions for personal data within an organization. Mandatory access control is a

method of managing access permissions for data or resources based on predefined security labels or

classifications, such as confidential, secret or top secret, but it does not consider the job functions or

responsibilities of the users. Network segmentation is a method of dividing a network into separate

segments or zones with different levels of access and control, based on the sensitivity and value of

the data or resources, but it does not consider the job functions or responsibilities of the

users. Dedicated access system is a method of providing access to data or resources through a

separate system or device that is isolated from other systems or networks, but it does not consider

the job functions or responsibilities of the users1, p. 91-92 Reference: 1: CDPSE Review Manual

(Digital Version)

Reference: https://securityscorecard.com/blog/the-ultimate-data-breach-response-plan

To facilitate a robust data breach management response, an organization must have an inventory of

affected individuals and systems, as this will help to identify the scope, impact and severity of the

breach, and to take appropriate actions to contain, mitigate and notify the breach. An inventory of

affected individuals and systems should include the following information:

The number and categories of data subjects whose personal data have been compromised

The types and volumes of personal data that have been exposed, altered or deleted

The sources and locations of the personal data, such as databases, servers, devices or third parties

The potential or actual consequences of the breach for the data subjects, such as identity theft,

fraud, discrimination or physical harm

The systems and processes that have been compromised or affected by the breach, such as

networks, applications, devices or security controls

The vulnerabilities or risks that have been exploited or introduced by the breach, such as malware,

phishing, ransomware or human error

An inventory of affected individuals and systems will help the organization to assess the risk level of

the breach, and to determine the appropriate response strategy and actions, such as:

Isolating or shutting down the affected systems or processes

Restoring or recovering the personal data from backups or other sources

Erasing or encrypting the personal data on the compromised devices or media

Analyzing the root cause and impact of the breach

Reporting the breach to the relevant authorities and stakeholders

Notifying the data subjects of their rights and remedies

Implementing corrective and preventive measures to avoid future breaches

Reference:

Data Breach Preparation and Response in Accordance With GDPR - ISACA, section 4: “The controller

should document any personal data breaches, comprising the facts relating to the personal data

breach, its effects and the remedial action taken.”

Cybersecurity Incident Response Exercise Guidance - ISACA, section 3: “The IRT should identify all

assets involved in an incident (e.g., hardware, software) and determine what information was

compromised (e.g., PII).”

Guide to Securing Personal Data in Electronic Medium, section 3.5: “Organisations should maintain

an inventory of personal data in their possession or under their control.”

Reference: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-dataprotection-regulation-gdpr/principles/data-minimisation/

Data minimization is a privacy principle that requires limiting the collection, storage and processing

of personal data to what is necessary and relevant for the intended purposes. Data minimization

should be used to address data kept beyond its intended lifespan, as it helps to reduce the amount of

data that is stored or retained, and to delete or dispose of data that is no longer needed or justified.

Data minimization also reduces the privacy risks and costs associated with data storage and

retention, such as data breaches, unauthorized access, misuse or loss of data. The other options are

not effective ways to address data kept beyond its intended lifespan. Data anonymization is a

technique that removes or modifies all identifiers in a data set to prevent or limit the identification of

the data subjects, but it does not address the issue of data retention or deletion. Data security is a

process of applying technical, administrative and physical measures to protect the confidentiality,

integrity and availability of data, but it does not address the issue of data retention or deletion. Data

normalization is a technique that organizes the data in a database to reduce redundancy and improve

consistency, but it does not address the issue of data retention or deletion1, p. 75-76 Reference: 1:

CDPSE Review Manual (Digital Version)

The best approach for handling personal data that has been restricted is to flag users’ email

addresses to make sure they do not receive promotional information, because this will respect the

users’ p

and rights to opt out of marketing communications. This will also help the

company comply with the data protection laws and regulations that require consent and

transparency for sending marketing emails, such as the General Data Protection Regulation (GDPR)

and the CAN-SPAM Act12. The other options are not appropriate or sufficient for handling restricted

data, because they may violate the users’ rights, expectations, or agreements, or cause operational

issues for the company.

Reference:

CDPSE Review Manual, Chapter 3 – Data Lifecycle, Section 3.1 – Data Classification3.

CDPSE Certified Data Privacy Solutions Engineer All-in-One Exam Guide, Chapter 3 – Data Lifecycle,

Section 3.2 – Data Classification4.

Anonymization is a technique that removes or modifies personal data in such a way that it can no

longer be attributed to a specific data subject. Anonymization can be achieved by various methods,

such as encryption, pseudonymization, aggregation, generalization, etc. When using anonymization

techniques to prevent unauthorized access to personal data, the most important consideration to

ensure the data is adequately protected is that the key must be kept separate and distinct from the

data it protects. The key is a piece of information that is used to reverse the anonymization process

and restore the original personal data. The key must be stored and managed in a secure location that

is different from where the anonymized data is stored and processed. This way, even if the

anonymized data is compromised, the key cannot be accessed or used to re-identify the data

subjects. Reference: : CDPSE Review Manual (Digital Version), page 29

A raw zone is a zone within a data lake that contains unprocessed or unstructured data that is

ingested from various sources without any transformation or validation. A raw zone may contain

sensitive data that has not been identified or classified yet, such as personal data. Therefore,

sensitive data in a raw zone should be encrypted or tokenized to protect its confidentiality and

integrity. Encryption is a process of transforming data into an unreadable form using a secret key or

algorithm. Tokenization is a process of replacing sensitive data with non-sensitive substitutes called

tokens. Both encryption and tokenization help to prevent unauthorized or unlawful access, use,

disclosure, or transfer of sensitive data in a raw zone. Reference: : CDPSE Review Manual (Digital

Version), page 169

Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2014/selecting-the-rightcloud-operating-model-privacy-and-data-security-in-the-cloud

When evaluating cloud-based services for backup, one of the most important factors to consider

from a privacy regulation standpoint is data residing in another country. This is because different

countries may have different privacy laws and regulations that apply to the personal data stored or

processed in their jurisdictions. Some countries may have more stringent or protective privacy laws

than others, while some countries may have more intrusive or invasive practices that pose threats to

data privacy. Therefore, an organization should be aware of the location of its cloud-based backup

service provider and its servers, and ensure that there are adequate safeguards and agreements in

place to protect the personal data from unauthorized or unlawful access, use, disclosure, or

transfer. Reference: : CDPSE Review Manual (Digital Version), page 159

Reference: https://www.isaca.org/resources/isaca-journal/past-issues/2014/data-ownersresponsibilities-when-migrating-to-the-cloud

Cross-border data transfer regulations are laws and rules that govern the movement of personal data

across national or regional boundaries. They aim to protect the privacy rights and interests of the

data subjects, and to ensure that their personal data are not subject to lower or incompatible

standards of protection in other jurisdictions. Examples of cross-border data transfer regulations

include the General Data Protection Regulation (GDPR) in the European Union, the California

Consumer Privacy Act (CCPA) in the United States, and the Personal Information Protection Law

(PIPL) in China.

When an organization uses a cloud service provider to store and process data, it may face the risk of

transferring personal data to a region with different data protection requirements, such as a region

that has not been recognized as providing adequate or equivalent levels of protection by the original

jurisdiction, or a region that has conflicting or incompatible laws or regulations with the original

jurisdiction. This may result in the following consequences for the organization:

It may violate the cross-border data transfer regulations of the original jurisdiction, and face legal

sanctions, fines, or lawsuits from the regulators, customers, or data subjects.

It may lose control or visibility over the personal data, and expose them to unauthorized or unlawful

access, use, modification, or disclosure by the cloud service provider or third parties.

It may compromise the trust and confidence of the customers and data subjects, and damage its

reputation and competitiveness.

Therefore, an organization subject to cross-border data transfer regulations should carefully assess

and manage the risks of using a cloud service provider to store and process data, and ensure that it

has appropriate safeguards and mechanisms in place to protect the privacy of personal data across

borders.

Reference:

Cross-Border Data Transfer and Data Localization Requirements … - ISACA, section 1: “As a result,

China’s National People’s Congress (NPC) and the National Committee of the Chinese People’s

Political Consultative Conference (PCC) put forward suggestions on legislation addressing cross-

border data transfer.”

Regulatory Approaches to Cross-Border Data Transfers, section 1: “Cross-border transfers of personal

information are increasingly common in today’s globalised economy. However, different jurisdictions

have different approaches to regulating such transfers.”

Cross-Border Data Transfer Requirements: Global Privacy Laws - Securiti, section 1: “Data transfer

conditions, mechanisms, localization and regulatory authority of each law.”

The Regulation of Cross-Border Data Transfers in the Context … - Springer, section 1: “No Party shall

prohibit or restrict the cross-border transfer of information, including personal information, by

electronic means if this activity is for the conduct of the business of a covered person.”