A retail company's privacy team receives an alert from its data loss prevention (DLP) system indicating that a customer database was exported to a USB drive by a marketing employee. The employee claims it was for a legitimate analysis. What is the FIRST step the privacy team should take?

Verify the alert and gather initial details to determine if a privacy incident has occurred

Disable the employee's access and confiscate the USB drive

Conduct a full forensic investigation of the employee's computer

Notify the data protection authority immediately

Which method is commonly used to detect a privacy incident involving unauthorized access to personal data?

Conducting a privacy impact assessment

Performing a data protection impact assessment

Reviewing access logs for unusual patterns

What is the main objective of the recovery phase in privacy incident management?

To delete all evidence of the incident

To restore affected systems and operations to normal functioning

To identify the attacker's identity

To assign blame for the incident

Who should be notified first when a privacy incident is confirmed?

The incident response team and relevant internal stakeholders

The general public via social media

A company discovers that a former employee's credentials were used to access a customer relationship management (CRM) system after their departure. The account has been disabled, but the company is unsure if the attacker copied customer data. What should be done NEXT to contain the incident?

Change the passwords of all CRM users as a precaution

Notify all affected customers immediately

Restore the CRM system from a backup taken before the incident

Review access logs to determine the scope of data accessed and identify any other compromised accounts

Certified Data Privacy Solutions Engineer

Domain 1Objective 7

Incident Management CDPSE Practice Questions (Page 4)

Part of the Privacy Governance domain, which accounts for 20% of the CDPSE exam.

35questions here

7free pages

8concepts

20%of the exam

Questions 16–20

16application · medium
A retail company's privacy team receives an alert from its data loss prevention (DLP) system indicating that a customer database was exported to a USB drive by a marketing employee. The employee claims it was for a legitimate analysis. What is the FIRST step the privacy team should take?
Select an answer first
17foundation · easy
Which method is commonly used to detect a privacy incident involving unauthorized access to personal data?
Select an answer first
18foundation · easy
What is the main objective of the recovery phase in privacy incident management?
Select an answer first
19foundation · easy
Who should be notified first when a privacy incident is confirmed?
Select an answer first
20application · medium
A company discovers that a former employee's credentials were used to access a customer relationship management (CRM) system after their departure. The account has been disabled, but the company is unsure if the attacker copied customer data. What should be done NEXT to contain the incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CDPSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CDPSE” is a trademark of its owner, used for identification only.