Privacy Training and Awareness CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following employee groups would MOST likely require specialized privacy training on handling sensitive personal data?

   • AGeneral administrative assistants who schedule meetings
   • BHuman resources staff who process employee health records
   • CIT help desk staff who reset user passwords
   • DFacilities management staff who maintain office access logs
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is it important to maintain records of privacy training completion?

   • ATo determine which employees should receive a bonus
   • BTo justify the training budget to senior management
   • CTo demonstrate due diligence to regulators and auditors
   • DTo compare the performance of different departments
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A technology company is developing a privacy training program. The company has three main groups: sales representatives who handle customer contact information, product managers who define data collection features, and IT administrators who manage access controls. The training budget is limited. How should the company prioritize training content for these groups?

   • AProvide the same general privacy training to all groups, focusing on basic principles and company policy.
   • BPrioritize training for sales representatives, since they interact with customers directly and handle personal data daily.
   • CConduct a single workshop for product managers and IT admins, and provide sales reps with an online manual.
   • DTailor training by role: sales reps get data handling and consent basics, product managers get privacy by design and data minimization, and IT admins get access control and breach response procedures.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is updating its privacy training content. The company operates in multiple jurisdictions and has recently updated its data retention policy. The training must cover key privacy principles and regulatory obligations. What is the most important consideration when developing the updated content?

   • AEnsure the content reflects the latest legal requirements and the updated data retention policy, and is relevant to employees' daily tasks.
   • BKeep the content as short as possible to minimize employee time away from work.
   • CUse technical jargon to demonstrate expertise and ensure the content is taken seriously.
   • DFocus primarily on the company's internal policies, since legal requirements are handled by the legal department.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a high rate of privacy incidents related to emailing personal data to the wrong recipients. The annual training covered email security, but incidents persist. The privacy team wants to implement an awareness campaign to reduce these incidents. Which campaign would be most effective?

   • ALaunch a monthly campaign that includes simulated phishing and misdirected email exercises, with immediate feedback and tips on verifying recipients.
   • BPost posters in common areas reminding employees to be careful when sending emails.
   • CIncrease the frequency of the annual training to quarterly, but keep the same content.
   • DSend a weekly email reminder to all employees to double-check email recipients before sending.
   Reveal Solution Discussion Select an answer first