Risk Management Process and Policies CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has implemented a risk treatment plan that includes new access controls and employee training. To ensure the plan is effective, the privacy team must monitor its implementation. Which approach provides the most comprehensive monitoring?

   • AMonitor only the technical controls.
   • BConduct a one-time review after implementation.
   • CTrack the completion of training and access control implementation.
   • DRely on employee self-reports of compliance.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of risk communication and reporting in a privacy program?

   • ATo assign blame for risk management failures
   • BTo inform stakeholders about privacy risks and the organization's risk posture
   • CTo publicize the organization's privacy practices to customers
   • DTo satisfy regulatory requirements for data breach notifications
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare organization is evaluating a new patient portal that will store sensitive health data. The risk team has identified a vulnerability in the portal's authentication mechanism. In the risk analysis, they estimate that the likelihood of exploitation is low because the portal is not yet publicly accessible, but the impact of a breach would be severe due to the sensitivity of the data. According to the risk management process, what should the organization do first?

   • AAccept the risk because the portal is not publicly accessible yet.
   • BImplement multi-factor authentication to mitigate the vulnerability immediately.
   • CDocument the risk in the risk register and assign a risk score based on likelihood and impact.
   • DTransfer the risk by purchasing cyber insurance.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a key input when prioritizing privacy risks?

   • ACompliance requirements that mandate certain risk levels be addressed
   • BThe organization's marketing budget
   • CThe number of employees in the organization
   • DThe personal preferences of the privacy officer
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A newly formed privacy team is establishing a risk management process for the organization. They want to ensure that risk decisions align with the organization's strategic objectives. What should be the first step in designing the process?

   • APurchase cyber insurance to cover potential losses.
   • BDefine the organization's risk appetite and tolerance levels.
   • CConduct a privacy impact assessment for every project.
   • DImplement a risk treatment plan for all identified risks.
   Reveal Solution Discussion Select an answer first