Risk Management Process and Policies CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In risk assessment and analysis, what two factors are primarily used to determine the level of a privacy risk?

   • ASeverity and urgency
   • BProbability and frequency
   • CCost and time
   • DLikelihood and impact
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When an organization decides to accept a privacy risk, what does that imply?

   • AThe organization is unaware of the risk
   • BThe organization has transferred the risk to an insurance company
   • CThe organization has formally acknowledged the risk and decided not to take further action
   • DThe organization has implemented controls to reduce the risk
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization has a risk appetite that allows for moderate risks in exchange for business growth. They have identified a risk with a high likelihood and moderate impact. The cost to mitigate the risk is high, and the mitigation would not significantly reduce the likelihood. What is the most appropriate risk treatment decision?

   • AMitigate the risk regardless of cost.
   • BTransfer the risk to a third party.
   • CAvoid the risk by stopping the business activity.
   • DAccept the risk because the cost of mitigation outweighs the benefit.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following should a privacy policy align with?

   • ALegal and regulatory requirements
   • BThe latest industry trends
   • CThe marketing department's goals
   • DThe personal preferences of the CEO
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a policy that requires all employees to use encryption for sensitive data. However, the IT department reports that many employees are not encrypting files because the encryption software is slow. What is the most effective way to enforce the policy while addressing the employees' concern?

   • AIgnore the issue because employees are busy.
   • BMake encryption optional for non-critical data.
   • CReplace the encryption software with a faster solution and provide training.
   • DDiscipline employees who do not encrypt files.
   Reveal Solution Discussion Select an answer first