Data Destruction CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A data destruction vendor reports that a batch of hard drives was destroyed, but a subsequent audit finds that one drive was not actually shredded and contains recoverable data. The drive contains customer personal data. What is the most appropriate response?

   • ADestroy the drive immediately and document the incident as a near miss.
   • BImmediately notify all affected customers of a data breach.
   • CSecure the drive, assess the risk of exposure, and determine whether notification is required based on the likelihood of access.
   • DRequest a new certificate of destruction from the vendor and update the inventory.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company discovers that a batch of decommissioned hard drives was sent to a recycling vendor, but the vendor lost the drives before they were destroyed. The drives contain customer personal data. What is the most appropriate immediate action?

   • AImmediately notify all affected customers of a data breach.
   • BAssume the drives are lost and will not be recovered, and take no further action.
   • CRequest a new certificate of destruction from the vendor.
   • DContact the vendor to locate the drives and, if they cannot be found, assess the risk of data exposure.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which topic should be covered in data destruction awareness training for all employees?

   • AHow to use degaussing equipment
   • BHow to recover data from damaged media
   • CHow to bypass destruction procedures in an emergency
   • DHow to identify data that is eligible for destruction
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which element should be included in a data destruction procedure to ensure it aligns with compliance requirements?

   • AA list of approved destruction methods for each type of data and media
   • BA provision to allow employees to bypass procedures for convenience
   • CA requirement to notify data subjects before any destruction
   • DA step to archive data before destruction
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which regulation explicitly includes the 'right to erasure' (also known as the 'right to be forgotten'), requiring organizations to delete personal data upon request under certain conditions?

   • APCI DSS
   • BSOX
   • CHIPAA
   • DGDPR
   Reveal Solution Discussion Select an answer first