Risk Management Process and Policies CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of risk monitoring and review in the risk management process?

   • ATo eliminate the need for future risk assessments
   • BTo assign risk ownership to external auditors
   • CTo track the status of risks and the effectiveness of controls over time
   • DTo identify new risks only at the end of a project
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A global e-commerce company is assessing the risk of a new feature that will store customer payment information. The risk team has limited resources and must choose between two mitigation options: Option 1 reduces likelihood by 50% but costs $500,000; Option 2 reduces impact by 80% but costs $200,000. The company's risk appetite is low, and the potential impact of a breach is estimated at $2 million. Which option should the company choose?

   • ABoth options, because they address different aspects of risk.
   • BNeither option, because the risk is acceptable.
   • COption 2, because it provides a higher reduction in risk for a lower cost.
   • DOption 1, because reducing likelihood is always more important.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of a privacy policy?

   • ATo satisfy customer expectations for transparency
   • BTo provide a legal defense in case of a data breach
   • CTo document the organization's commitment and approach to handling personal data
   • DTo replace the need for data protection impact assessments
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of implementing a privacy policy through a technical control?

   • AConducting a privacy impact assessment
   • BPublishing the policy on the company intranet
   • CHolding a training session on data privacy
   • DConfiguring access controls to restrict access to personal data
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A software company is updating its privacy policy to comply with a new data protection regulation. The policy will affect how customer data is processed. What is the most important step to ensure the policy is effectively implemented?

   • ADevelop procedures and training to guide employees in applying the policy.
   • BUpdate the policy document and archive the previous version.
   • CConduct a privacy impact assessment for the new policy.
   • DPublish the policy on the company website and intranet.
   Reveal Solution Discussion Select an answer first