Risk Management Process and Policies CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A multinational corporation's privacy team has completed a risk assessment that identifies a high-risk data processing activity. The board of directors needs to understand the potential financial and reputational impact. Which approach best communicates this risk to the board?

   • APresent a summary of the risk in business terms, including potential financial impact and recommended mitigation options.
   • BProvide a detailed technical report of the vulnerability and the proposed code fix.
   • CEmail the full risk register to the board and ask them to review it.
   • DWait until the risk materializes before informing the board.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes the role of risk management within a privacy program?

   • AIt is a continuous process that supports decision-making and resource allocation
   • BIt is a one-time activity performed at the start of a project
   • CIt is primarily a technical function focused on IT systems
   • DIt is a legal requirement that only applies to regulated industries
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company processes customer data in a legacy system that cannot be patched. The risk assessment shows a high likelihood of a data breach and a high impact on customers. The organization's risk appetite is low, and they have the budget to replace the system. Which risk treatment option best aligns with the organization's risk appetite?

   • ATransfer the risk by purchasing cyber insurance.
   • BAccept the risk and document it in the risk register.
   • CAvoid the risk by replacing the legacy system with a modern, supported platform.
   • DMitigate the risk by implementing compensating controls, such as network segmentation and monitoring.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a typical audience for privacy risk reports?

   • AThe board of directors
   • BData subjects whose data is processed
   • CCompetitors
   • DThe general public
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's privacy policy was written five years ago and has not been updated since. The company has since expanded into new markets with different data protection laws. What should the privacy team do to ensure the policy remains effective?

   • AKeep the policy unchanged to avoid confusion among employees.
   • BReview the policy annually and update it to reflect changes in laws and business practices.
   • CReplace the policy with a new one only when a data breach occurs.
   • DConduct a one-time review and then archive the policy.
   Reveal Solution Discussion Select an answer first