Evidence and Artifacts CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In privacy risk management, what is the key difference between an artifact and other forms of evidence?

   • AArtifacts are created to document and support compliance activities, while evidence is any information that proves a fact
   • BArtifacts are not used in audits, while evidence is
   • CArtifacts are always digital, while evidence can be physical
   • DArtifacts are created after an audit, while evidence is created before
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During evidence analysis, a privacy analyst finds that access logs show several employees accessed personal data outside of business hours without a documented business need. What does this finding most likely indicate?

   • AThat the access control policy is being followed
   • BThat the evidence is invalid and should be discarded
   • CThat the employees were likely performing routine maintenance
   • DA compliance gap in access controls
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A privacy officer is preparing for an external audit of the company's data retention practices. The auditor asks for evidence that the company actually deletes personal data after the retention period expires. Which combination of evidence types would most directly support this claim?

   • AAutomated deletion logs showing the date, time, and scope of each deletion job, plus a sample of audit reports confirming deletion
   • BA data flow diagram showing where personal data is stored and when it should be deleted
   • CAn interview transcript with the IT administrator who manually deletes data each month
   • DA signed copy of the data retention policy and a procedure document for deletion
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An auditor asks for evidence that a privacy training program was completed by all employees. Which type of evidence would best support this request?

   • AA training course outline
   • BA training policy document
   • CA training completion report
   • DA privacy awareness poster
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A privacy team is creating a compliance binder for an audit. They have a completed DPIA, a set of access logs, and a vendor risk assessment report. Which of these items is NOT an artifact?

   • AThe completed DPIA
   • BAll of the items are artifacts
   • CThe access logs
   • DThe vendor risk assessment report
   Reveal Solution Discussion Select an answer first