Threats and Vulnerabilities CDPSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has a policy that allows employees to use personal USB drives to transfer data. The privacy team has identified this as a risk because USB drives can be lost or stolen, leading to data breaches. Which of the following mitigation strategies would be most effective?

   • AImplementing data loss prevention (DLP) software to monitor USB usage
   • BConducting regular security awareness training on the risks of USB drives
   • CProhibiting the use of personal USB drives and providing encrypted company-issued drives
   • DEncrypting all USB drives used by employees
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation stores employee HR data in a legacy on-premises system. The system has a known unpatched vulnerability that could allow remote code execution. The company also uses a modern cloud-based HR platform for new hires, which is fully patched. An attacker has been observed scanning the network for vulnerable systems. Which of the following best describes the risk exposure for the employee data?

   • ALow risk because the cloud platform is fully patched and secure
   • BHigh risk because the legacy system has a vulnerability that is being actively targeted
   • CModerate risk because the attacker is only scanning, not exploiting
   • DNo risk because the legacy system is on-premises and isolated
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a vulnerability in a process that could compromise privacy?

   • AA lack of background checks for employees who handle personal data.
   • BA phishing email that tricks an employee into revealing their password.
   • CAn outdated operating system with known security patches missing.
   • DA firewall misconfiguration that allows unauthorized external access to a database.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a mitigation strategy for a privacy threat?

   • AIdentifying potential threat actors who might target the organization.
   • BImplementing encryption for personal data at rest and in transit.
   • CConducting a privacy impact assessment for a new system.
   • DDocumenting the likelihood and impact of a risk in a risk register.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has two privacy risks: (1) a high-likelihood, low-impact risk of unauthorized access to non-sensitive marketing data, and (2) a low-likelihood, high-impact risk of a data breach of sensitive customer financial data. The company has limited resources. Which risk should be prioritized?

   • AThe marketing data risk because it is more likely to occur
   • BNeither because the risks are not yet realized
   • CBoth equally because all risks must be addressed
   • DThe financial data breach because the impact is severe, even if likelihood is low
   Reveal Solution Discussion Select an answer first