Risk Response CDPSE Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   During the implementation of a chosen risk response, which of the following is a key consideration for ensuring successful execution?

   • AInforming external regulators before any action
   • BAllocating sufficient resources and defining a timeline
   • CDocumenting the risk in the risk register only
   • DDeferring stakeholder involvement until after implementation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm identifies a privacy risk in its customer data retention process: customer records are kept longer than necessary, increasing exposure in a breach. The cost to implement automated deletion is high, but the risk is considered high impact. The firm's risk appetite is moderate, and it has budget for one major privacy initiative this year. Which response best balances cost and risk?

   • AAccept the risk because the cost of mitigation is too high
   • BTransfer the risk by purchasing cyber insurance
   • CMitigate the risk by implementing automated deletion for the highest-risk data categories first
   • DAvoid the risk by deleting all customer data immediately
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company implemented a risk response to mitigate the risk of data breaches by implementing intrusion detection systems (IDS). During a review, the privacy team finds that the IDS generates a high number of false positives, causing alert fatigue among the security team. As a result, real alerts may be missed. What is the most appropriate action?

   • ATune the IDS to reduce false positives while maintaining detection capability
   • BAccept the risk because the IDS is still detecting some threats
   • CIncrease the sensitivity of the IDS to catch more potential threats
   • DDisable the IDS to reduce noise
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A marketing firm uses a third-party vendor to process customer data for email campaigns. The vendor has experienced a data breach, and the firm is concerned about the risk of data exposure. The firm's risk appetite is moderate, and the vendor is willing to improve its security controls if the firm shares the cost. Which risk response is most appropriate?

   • AMitigate the risk by collaborating with the vendor to enhance security controls
   • BTransfer the risk by requiring the vendor to indemnify the firm
   • CAvoid the risk by terminating the vendor relationship
   • DAccept the risk because the vendor is willing to improve
   Reveal Solution Discussion Select an answer first