Incident Management CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of including an incident response plan in a privacy governance program?

   • ATo replace the need for privacy impact assessments
   • BTo ensure a structured and timely response to privacy incidents, minimizing harm and meeting legal obligations
   • CTo eliminate all privacy incidents from occurring in the organization
   • DTo assign blame to individuals responsible for the incident
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which step is part of the root cause analysis in a privacy incident investigation?

   • ANotifying the data protection authority
   • BRestoring systems to normal operation
   • CIdentifying the underlying factors that allowed the incident to occur
   • DDeleting all logs related to the incident
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of collecting evidence during a privacy incident investigation?

   • ATo support root cause analysis and potential legal or regulatory proceedings
   • BTo notify affected individuals immediately
   • CTo assign blame to a specific employee
   • DTo delete all traces of the incident
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm experiences a breach where a misconfigured cloud storage bucket exposed customer financial records. The data was not accessed by unauthorized parties, but the exposure lasted for three weeks. How should the incident response team classify this incident?

   • ALow severity because no unauthorized access occurred
   • BHigh severity because sensitive data was exposed, even if no unauthorized access was confirmed
   • CUndetermined until a forensic investigation is completed
   • DMedium severity because the exposure was accidental and not malicious
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key best practice for notifying affected individuals about a privacy incident?

   • ANotify only if the incident was caused by an external attacker
   • BProvide clear and timely information about the incident and steps they can take to protect themselves
   • CProvide minimal details to avoid panic
   • DDelay notification until the investigation is complete
   Reveal Solution Discussion Select an answer first