Data Destruction CDPSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is updating its data destruction policy. The policy must ensure that data is destroyed as soon as it reaches the end of its retention period, but also allow for legal holds. Which procedure should the firm implement?

   • AImplement a process that checks for legal holds before destruction, and only destroys data after the hold is lifted.
   • BDestroy all data at the end of the retention period without exception to minimize risk.
   • CAutomatically destroy data at the end of retention, but require legal and compliance to approve any exceptions.
   • DRetain all data indefinitely to avoid the risk of premature destruction.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is data destruction considered a critical step in the data life cycle for privacy and security?

   • AIt reduces the risk of unauthorized access to residual data on decommissioned or repurposed media
   • BIt ensures that data is backed up before it is deleted from primary storage
   • CIt transfers data ownership to a third party for secure handling
   • DIt allows organizations to retain data indefinitely without legal consequences
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   During a routine audit, a data privacy officer discovers that a batch of decommissioned hard drives was sent to a recycling vendor, but the certificate of destruction is missing. The drives contained customer personal data. What is the most appropriate immediate action?

   • AAssume the drives were destroyed and update the inventory to reflect that the destruction is complete.
   • BContact the recycling vendor to obtain a new certificate of destruction and document the incident.
   • CTreat this as a data breach and notify all affected customers immediately.
   • DInitiate an incident response process to determine whether the drives were actually destroyed, assess the risk of exposure, and document the findings.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which data destruction method is considered most effective for solid-state drives (SSDs) because it addresses the unique way data is stored on NAND flash memory?

   • ADegaussing
   • BOverwriting
   • CCryptographic erasure
   • DPhysical destruction
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is subject to GDPR and has a retention schedule that requires deletion of customer data after five years. However, a customer has filed a lawsuit that involves data that is scheduled for deletion next month. What should the company do?

   • ADelete the data as scheduled to comply with the retention policy.
   • BDelete the data but keep a copy for the legal team.
   • CPlace a legal hold on the data and postpone deletion until the lawsuit is resolved.
   • DAsk the customer for permission to delete the data.
   Reveal Solution Discussion Select an answer first