Incident Management CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has contained a privacy incident where a misconfigured application exposed customer data. The application has been fixed, and the data exposure has been stopped. What is the NEXT step in the recovery process?

   • AAssess the impact of the exposure and determine if any affected individuals need to be notified
   • BConduct a post-incident review to identify lessons learned
   • CRestore the application from a backup taken before the incident
   • DDelete all data that was exposed to prevent further misuse
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A healthcare organization's privacy incident response plan is being updated. The plan must ensure that a ransomware attack encrypting patient records is detected quickly, escalated appropriately, and communicated to regulators within the required timeframe. Which combination of components should the plan include to meet these requirements?

   • AA detection mechanism, a severity classification matrix, and a notification procedure with defined timelines
   • BA forensic investigation checklist, a root cause analysis template, and a lessons-learned process
   • CA backup restoration procedure, a list of legal counsel, and a public relations strategy
   • DA data inventory, a vendor management policy, and a training schedule
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of classifying a privacy incident during triage?

   • ATo assign a financial value to the incident
   • BTo determine the legal jurisdiction of the incident
   • CTo prioritize response efforts based on the incident's impact and urgency
   • DTo decide which employees to blame
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of containing a privacy incident?

   • ATo notify all affected individuals
   • BTo delete all personal data involved
   • CTo identify the root cause of the incident
   • DTo limit the spread of the incident and prevent further harm
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   During an investigation of a suspected data breach, the incident response team finds that a server was accessed by an unknown IP address. The team needs to determine whether personal data was accessed. Which investigation step is MOST appropriate?

   • AAnalyze server access logs to identify the data accessed and the actions performed by the unknown IP
   • BImmediately shut down the server to prevent further access
   • CRestore the server from a backup to ensure data integrity
   • DNotify the unknown IP address's internet service provider to identify the attacker
   Reveal Solution Discussion Select an answer first