Threats and Vulnerabilities CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the goal of developing mitigation strategies for identified privacy threats?

   • ATo transfer all privacy risks to a third party.
   • BTo reduce the likelihood or impact of privacy risks to an acceptable level.
   • CTo eliminate all privacy risks completely.
   • DTo document all potential threats in a risk register.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization stores patient records in a cloud database. The security team discovers that a former employee's credentials are still active and have been used to access the database from an unfamiliar IP address. Which of the following is the most immediate threat to the privacy of the patient data?

   • AA phishing campaign targeting current employees to steal new credentials
   • BA misconfigured firewall allowing external access to the database
   • CAn insider threat exploiting valid but unauthorized credentials
   • DA denial-of-service attack overwhelming the database server
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has identified that its customer service team uses a shared email account to communicate with customers, and that emails containing personal data are not encrypted. Which of the following is the most effective mitigation strategy to reduce the risk of unauthorized access to customer data?

   • ATraining employees on how to identify phishing emails
   • BImplementing individual email accounts for each team member
   • CRestricting access to the shared email account to only senior team members
   • DImplementing email encryption for all communications containing personal data
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of a vulnerability assessment in the context of privacy?

   • ATo identify weaknesses in systems, processes, and people that could be exploited to compromise privacy.
   • BTo determine the likelihood and impact of a specific threat occurring.
   • CTo detect and respond to active security incidents in real time.
   • DTo implement security controls to mitigate identified risks.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university's research department stores sensitive personal data of study participants. The department frequently shares this data with external collaborators via email. The privacy team is conducting a vulnerability assessment. Which of the following is a people-related vulnerability that could be exploited?

   • AResearchers are not trained on secure data sharing practices
   • BThe external collaborators' systems are not patched
   • CThe data is stored on a shared network drive
   • DThe email system lacks encryption in transit
   Reveal Solution Discussion Select an answer first