Incident Management CDPSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of a post-incident review?

   • ATo delete all records of the incident
   • BTo notify the data protection authority
   • CTo identify lessons learned and improve future incident response
   • DTo assign blame to individuals responsible
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization's privacy team is reviewing its incident detection capabilities. They want to ensure that privacy incidents are identified even when they do not involve obvious technical alerts, such as a lost paper file or an employee emailing data to a personal account. Which method would BEST supplement their existing technical monitoring?

   • AIncrease the sensitivity of the DLP system to flag more emails
   • BImplement a data classification scheme for all documents
   • CEstablish a clear process for employees to report suspected privacy incidents, including non-technical events
   • DConduct regular audits of all employee email accounts
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's privacy incident response team has successfully contained a malware infection that encrypted some files. The malware has been removed, and the affected systems are being restored from backups. What is the NEXT step in the recovery process?

   • AVerify the integrity of the restored data and ensure the systems are fully functional before returning to normal operations
   • BNotify affected individuals that their data may have been compromised
   • CDelete the infected backups to prevent re-infection
   • DConduct a post-incident review to identify lessons learned
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is an example of a remediation measure after a privacy incident?

   • AIgnoring the incident if it was minor
   • BDeleting the incident response plan
   • CNotifying the media
   • DImplementing additional access controls to prevent recurrence
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A privacy team is triaging two incidents: (1) a laptop containing encrypted customer data was stolen, and (2) a misconfigured database exposed unencrypted customer data for a day. Both incidents involve the same type of data. Which incident should be treated as HIGHER severity?

   • ABoth incidents should be treated equally because they involve the same type of data
   • BThe stolen laptop, because it may contain additional data beyond the customer database
   • CThe stolen laptop, because physical theft is more serious than a configuration error
   • DThe misconfigured database, because the data was unencrypted and potentially accessible to unauthorized parties
   Reveal Solution Discussion Select an answer first