Program Monitoring and Metrics CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A privacy team has analyzed its metrics and found that the number of data subject access requests (DSARs) has increased by 50%, but the team has also improved its processing time, resulting in a higher percentage of on-time completions. The team needs to report this to the board of directors. The board is primarily concerned with regulatory risk. What is the most important message for the team to convey?

   • AThe team should focus on the increased volume and recommend hiring more staff to handle the workload.
   • BThe improvement in on-time completion rate demonstrates that the organization is effectively managing its regulatory compliance obligations despite the increased volume.
   • CThe team should report the raw numbers of DSARs received and completed on time, without any analysis.
   • DThe increase in DSAR volume is a positive sign of increased customer trust in the organization.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A privacy team is defining metrics for a new program. They are considering two metrics: (1) the number of privacy training sessions completed and (2) the percentage of employees who pass a post-training assessment. The team wants a metric that is a strong indicator of actual privacy behavior. Which metric is more appropriate, and why?

   • ABoth metrics are equally effective, as they both measure the success of the training program.
   • BThe number of training sessions completed, because it measures the volume of training delivered.
   • CNeither metric is useful, as training metrics cannot predict actual privacy behavior.
   • DThe percentage of employees who pass the assessment, because it measures the effectiveness of the training in imparting knowledge.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which metric is most directly tied to assessing compliance with data subject rights requests?

   • ANumber of data processing agreements signed
   • BNumber of privacy impact assessments completed
   • CAmount of personal data stored in backups
   • DPercentage of data subject requests fulfilled within the regulatory timeframe
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A privacy team has collected data showing that the number of privacy incidents caused by human error has decreased by 20% since a new training program was implemented. The team needs to report this outcome to the business unit leaders. What is the most effective way to communicate this result?

   • AReport the raw number of incidents before and after the training without any analysis or context.
   • BPresent the decrease in human-error incidents and connect it directly to the implementation of the training program, while noting this is a positive indicator of the program's effectiveness.
   • CState that the training program was successful and no further action is needed.
   • DFocus on the remaining incidents and recommend a complete overhaul of the training program.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which metric is most appropriate for measuring the effectiveness of a privacy program's incident response process?

   • APercentage of privacy training modules completed by employees
   • BAverage time to detect and contain a privacy incident
   • CNumber of privacy policies published on the intranet
   • DTotal budget allocated to the privacy program
   Reveal Solution Discussion Select an answer first