Program Monitoring and Metrics CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How can insights from privacy metrics be used to drive continuous improvement?

   • ABy identifying areas where controls are underperforming and implementing corrective actions
   • BBy sharing metrics only with external regulators
   • CBy discontinuing all monitoring activities once metrics are stable
   • DBy increasing the frequency of privacy training regardless of need
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A privacy team wants to establish a process to monitor the effectiveness of its data retention policy. The policy requires that certain data be deleted after 90 days. What is the most appropriate metric for the team to monitor?

   • AThe percentage of data that is deleted within the required 90-day timeframe.
   • BThe cost of data storage per month.
   • CThe total amount of data stored in the organization's systems.
   • DThe number of data deletion requests received from data subjects.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare organization's privacy team tracks the number of privacy incidents reported each month. Over the past six months, this number has steadily increased from 12 to 28 per month. The team is concerned about this trend. What is the most appropriate initial action for the privacy team to take?

   • ATreat the increase as a negative indicator and immediately implement additional employee training on data handling procedures.
   • BAnalyze the incident data to determine whether the increase reflects a true rise in privacy breaches or an improvement in detection and reporting practices.
   • CReport the increase to senior management as a critical failure of the privacy program that requires immediate budget allocation.
   • DAdjust the metric to only count incidents that resulted in regulatory notification, as this provides a more accurate measure of program performance.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail company's privacy metrics show that 80% of privacy training is completed by employees, but a recent internal audit found that employees who did not complete training were involved in 90% of data handling errors. What is the most appropriate action for the privacy team to take?

   • ADiscontinue the training metric and rely on the audit results to identify and correct errors as they occur.
   • BFocus on improving the training completion rate, particularly for the employees who have not completed it, and analyze why they are not completing it.
   • CIncrease the frequency of privacy training for all employees from annually to quarterly.
   • DReport the audit findings to management and recommend disciplinary action for employees who did not complete training.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of establishing a monitoring process for privacy controls?

   • ATo document the privacy program's budget and resources
   • BTo satisfy all regulatory reporting requirements automatically
   • CTo replace the need for regular privacy risk assessments
   • DTo ensure controls operate as intended and detect failures promptly
   Reveal Solution Discussion Select an answer first