A global e-commerce company processes customer data across multiple regions. A new data protection regulation in one region requires that personal data be stored within that region. The company currently stores all data in a centralized data center in another region. The cost of building a local data center is high, but the company has a moderate risk appetite and wants to continue operating in that region. Which risk response is most appropriate?

Accept the risk and continue storing data in the centralized data center

Transfer the risk by using a third-party cloud provider with a local data center

Mitigate the risk by encrypting the data before storing it in the centralized data center

Avoid the risk by exiting the region entirely

Why is it important to periodically review risk responses even after they have been implemented successfully?

Because stakeholders always require annual reports

Because all risk responses expire after a fixed period

Because regulatory requirements never change

Because risk conditions and organizational objectives can change over time

A logistics company identifies a privacy risk in its mobile app: user location data is stored in plaintext on the device, increasing exposure if the device is lost. The company has a limited budget and must choose between two responses: encrypting the data on the device or implementing remote wipe capabilities. The privacy team must select the response that provides the most comprehensive risk reduction. Which response should they choose?

Accept the risk because the data is only location data

Implement remote wipe capabilities

Implement both encryption and remote wipe

Certified Data Privacy Solutions Engineer

Domain 2Objective 5

Risk Response CDPSE Practice Questions (Page 1)

Part of the Privacy Risk Management and Compliance domain, which accounts for 18% of the CDPSE exam.

19questions here

4free pages

4concepts

18%of the exam

Questions 1–5

1foundation · easy
A privacy risk assessment identifies a data processing activity that exposes customer personal data to unauthorized access. The organization decides to discontinue the activity entirely. Which risk response option does this represent?
Select an answer first
2foundation · easy
An organization decides to purchase cyber liability insurance to cover potential costs from a data breach. Which risk response option does this action represent?
Select an answer first
3expert · hard
A global e-commerce company processes customer data across multiple regions. A new data protection regulation in one region requires that personal data be stored within that region. The company currently stores all data in a centralized data center in another region. The cost of building a local data center is high, but the company has a moderate risk appetite and wants to continue operating in that region. Which risk response is most appropriate?
Select an answer first
4foundation · easy
Why is it important to periodically review risk responses even after they have been implemented successfully?
Select an answer first
5application · medium
A logistics company identifies a privacy risk in its mobile app: user location data is stored in plaintext on the device, increasing exposure if the device is lost. The company has a limited budget and must choose between two responses: encrypting the data on the device or implementing remote wipe capabilities. The privacy team must select the response that provides the most comprehensive risk reduction. Which response should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CDPSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CDPSE” is a trademark of its owner, used for identification only.

Risk Response CDPSE Practice Questions (Page 1)

Questions 1–5

A privacy risk assessment identifies a data processing activity that exposes customer personal data to unauthorized access. The organization decides to discontinue the activity entirely. Which risk response option does this represent?

An organization decides to purchase cyber liability insurance to cover potential costs from a data breach. Which risk response option does this action represent?

Why is it important to periodically review risk responses even after they have been implemented successfully?

Keep studying — Privacy Risk Management and Compliance