Risk Management Process and Policies CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to periodically review and update privacy policies?

   • ATo reflect changes in laws, technology, and business operations
   • BTo satisfy the preferences of external auditors
   • CTo ensure the policies are written in complex legal language
   • DTo increase the length of the policies
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company's privacy policy has not been updated in three years. During that time, the company has adopted new technologies and entered new markets. The privacy team is planning to update the policy. What is the most important factor to consider during the review?

   • AThe cost of updating the policy.
   • BThe changes in laws, technology, and business practices since the last update.
   • CThe opinions of external auditors.
   • DThe preferences of the marketing department.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has implemented a new encryption control to protect customer data. Six months later, the privacy team wants to verify that the control is working as intended. Which approach provides the most reliable evidence of control effectiveness?

   • AReview the encryption configuration and test decryption on a sample of data.
   • BWait for the next audit to assess the control.
   • CAsk the IT department to confirm that encryption is working.
   • DCheck that the encryption policy is still in place.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a risk monitoring activity?

   • ADeveloping a new privacy policy
   • BReviewing audit logs for unauthorized access to personal data
   • CConducting a one-time risk assessment at the start of a project
   • DTraining employees on data privacy
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A privacy officer must report to the board on the organization's risk posture. The board is concerned about regulatory fines and reputational damage. Which reporting approach best addresses the board's concerns?

   • AReport only the risks that have been fully mitigated.
   • BPresent the risk register in its entirety for the board to review.
   • CSummarize the top risks, their potential financial and reputational impact, and the status of mitigation efforts.
   • DProvide a detailed list of all identified risks and their technical controls.
   Reveal Solution Discussion Select an answer first