Risk Management Process and Policies CDPSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   During risk identification, which of the following is a common source of privacy risk?

   • AThe color scheme of the company website
   • BThe number of employees in the marketing department
   • CData processing activities that are not documented
   • DThe organization's mission statement
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational company is developing a privacy policy that must comply with multiple jurisdictions with conflicting requirements. For example, one jurisdiction requires data retention for 5 years, while another requires deletion after 2 years. What is the best approach to develop a policy that meets both requirements?

   • AAdopt the least strict requirement (2-year deletion) for all data globally.
   • BChoose the requirements of the company's headquarters location only.
   • CAdopt the strictest requirement (5-year retention) for all data globally.
   • DDevelop a policy that allows for regional variations to meet local legal requirements.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is an example of a privacy risk that could be identified from a third-party relationship?

   • AAn employee's lack of awareness about phishing emails
   • BA misconfigured database that is publicly accessible
   • CA new privacy regulation that affects the organization's data processing
   • DA vendor's data breach that exposes personal data processed on behalf of the organization
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A privacy team has identified a critical risk that requires immediate action. The CEO wants to be informed, but the board meeting is not for another month. What is the best course of action?

   • AKeep the risk confidential until the board meeting.
   • BWait until the board meeting to report the risk.
   • CInform the CEO immediately and provide a summary of the risk and recommended actions.
   • DSend a detailed technical report to the CEO.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company has a privacy policy that requires all employees to complete annual data privacy training. The privacy team notices that many employees have not completed the training. What is the most effective way to enforce the policy?

   • AAutomatically block access to systems that process personal data for employees who have not completed training.
   • BUpdate the policy to make training optional.
   • CIgnore the non-compliance because the policy is just a guideline.
   • DSend a reminder email to all employees.
   Reveal Solution Discussion Select an answer first