Privacy-Focused Assessment (Privacy Impact Assessment) CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In which scenario is a Privacy Impact Assessment most likely to be beneficial?

   • AWhen developing a new mobile application that collects location data
   • BWhen updating the organization's employee dress code policy
   • CWhen purchasing office furniture for a new branch
   • DWhen scheduling routine maintenance for company vehicles
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A non-profit organization is conducting a PIA for a new donor management system. The system will store donor names, contact details, and donation history. The PIA identifies a medium risk of unauthorized access to donor data due to weak access controls. The organization has a limited budget and cannot afford a major security overhaul. Which mitigation strategy would be most cost-effective and appropriate?

   • AEncrypt the entire donor database at rest.
   • BPurchase a new, more secure donor management system.
   • CAccept the risk because the data is not highly sensitive.
   • DImplement role-based access control (RBAC) so that only staff who need donor data can access it.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What should be included in the final PIA report?

   • AThe personal data of all employees involved in the assessment
   • BThe source code of the system being assessed
   • CIdentified risks and the mitigation measures taken
   • DThe organization's financial statements
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A privacy officer has completed a PIA for a new customer feedback system. The PIA identified a moderate risk that customer email addresses could be exposed if the system is compromised. The recommended mitigation is to encrypt the email addresses at rest. The development team has implemented the encryption. What should the privacy officer do to ensure the PIA remains accurate and useful?

   • AClose the PIA and archive it, as the risk has been mitigated.
   • BConduct a new PIA to verify the encryption was implemented correctly.
   • CUpdate the PIA documentation to record the implemented mitigation and the residual risk.
   • DInform the development team that the PIA is complete and no further action is needed.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which stakeholder group is most likely to provide insight into how personal data is actually used in daily operations?

   • AMarketing department
   • BExternal auditors
   • CShareholders
   • DBusiness units
   Reveal Solution Discussion Select an answer first