Evidence and Artifacts CDPSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Why is it important to periodically review evidence and artifacts?

   • ATo reduce the cost of storage
   • BTo make them available to external parties
   • CTo ensure they are current, complete, and still support privacy risk management
   • DTo comply with a one-time audit requirement
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A privacy analyst is analyzing evidence for a compliance audit. The evidence includes a privacy policy that states personal data is retained for 24 months, but the data inventory shows that some data is retained for 36 months. The analyst also finds that the discrepancy was noted in a previous internal audit but was never resolved. What is the most appropriate conclusion?

   • AThe data inventory is the authoritative source, and the privacy policy is incorrect
   • BThe privacy policy is the authoritative source, and the data inventory is incorrect
   • CThe discrepancy is not material because both documents are internal
   • DThere is a compliance gap between the stated policy and actual practice that must be investigated and remediated
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of mapping evidence and artifacts to privacy requirements?

   • ATo demonstrate compliance and support audits
   • BTo automate the creation of new artifacts
   • CTo reduce the amount of evidence collected
   • DTo make artifacts more difficult to access
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A privacy manager must create an artifact to document the decision to adopt a new consent management platform. The decision was made after a review of vendor security assessments and a cost-benefit analysis. What is the most important element to include in the artifact to make it auditable?

   • AThe names of the vendor's sales representatives
   • BThe cost-benefit analysis spreadsheet without any narrative
   • CThe date of the decision, the rationale, and the individuals who approved it
   • DThe vendor's marketing brochure
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A privacy team is managing artifacts for a multi-year compliance program. They have a data inventory that is updated monthly, a privacy policy that is updated annually, and a set of audit reports that are generated quarterly. The team is required to retain artifacts for six years. What is the most effective approach to manage the lifecycle of these artifacts?

   • ARetain artifacts for six years but allow any team member to delete old versions if they are no longer needed
   • BRetain artifacts for six years but store them in a shared folder with no access controls
   • CRetain only the latest version of each artifact to save storage space
   • DRetain all versions of all artifacts for six years, using version control and secure storage
   Reveal Solution Discussion Select an answer first