Risk Management Process and Policies CDPSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a trigger for reviewing a privacy policy?

   • AAn increase in the number of employees
   • BA change in the office location
   • CA change in the company's logo
   • DA change in data protection regulations
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A marketing company uses a third-party vendor to process customer data for email campaigns. The vendor has experienced a data breach in the past. What is the first step the company should take to manage the privacy risk associated with this vendor?

   • AConduct a risk assessment of the vendor's data processing practices and security controls.
   • BAccept the risk because the vendor is well-known.
   • CRequire the vendor to sign a new data processing agreement without further review.
   • DTerminate the contract with the vendor immediately.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A retail company has implemented a new data minimization policy that requires deleting customer data after 12 months. The privacy team wants to ensure the policy is effective over time. Which action best supports ongoing monitoring and review of this policy?

   • ARely on the IT department to delete data automatically without further checks.
   • BConduct an annual audit of data deletion logs and compare them against the policy requirements.
   • CSend a one-time communication to all employees about the new policy.
   • DUpdate the policy to reflect the latest regulatory guidance.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the context of privacy program governance, what is the primary purpose of the risk management process?

   • ATo eliminate all privacy risks to the organization
   • BTo ensure compliance with all applicable privacy laws and regulations
   • CTo identify, assess, and prioritize risks to inform decisions on how to address them
   • DTo transfer all privacy risks to third-party vendors
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is planning to use a new cloud service that will store customer data. The service provider is located in a country with different data protection laws. What is the first step the company should take to identify privacy risks?

   • ASign the cloud service provider's standard contract.
   • BConduct a privacy impact assessment that includes the data flows and legal implications.
   • CAssume the cloud provider is compliant because it is a major vendor.
   • DImmediately implement encryption for all data.
   Reveal Solution Discussion Select an answer first