Threats and Vulnerabilities CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A privacy team has identified the following risks: (1) a critical vulnerability in a public-facing web application that could expose customer data, and (2) a low-likelihood phishing campaign targeting employees. Which risk should be prioritized for mitigation?

   • AThe phishing campaign because it targets employees, who are the weakest link
   • BBoth equally because all risks must be mitigated immediately
   • CNeither because the risks are not yet realized
   • DThe web application vulnerability because it has high likelihood and high impact
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has identified that its customer support team uses shared login credentials for a CRM system containing personal data. Which of the following mitigation strategies would be most effective in reducing the risk of unauthorized access?

   • AEncrypting the CRM database at rest
   • BConducting regular security awareness training for the support team
   • CIncreasing the password complexity for the shared account
   • DImplementing individual user accounts with role-based access controls
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which scenario BEST illustrates the analysis of the relationship between a threat and a vulnerability?

   • AA company reviews its privacy policy to ensure it meets regulatory requirements.
   • BA company conducts a phishing simulation to test employee awareness.
   • CA company identifies that its customer database has a known unpatched vulnerability that could be exploited by a ransomware group.
   • DA company backs up its data to a secure offsite location.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A privacy team has identified three risks: (1) a high-likelihood, medium-impact risk of phishing attacks, (2) a medium-likelihood, high-impact risk of a data breach due to unpatched servers, and (3) a low-likelihood, low-impact risk of unauthorized access to a test database. Which risk should be addressed first?

   • AThe unpatched server risk because it has a high impact and medium likelihood
   • BAll three equally because all risks are important
   • CThe phishing risk because it has the highest likelihood
   • DThe test database risk because it is the easiest to fix
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A government agency is transitioning to a cloud-based case management system. The agency handles sensitive citizen data and is subject to strict data residency requirements. The cloud provider offers regions in multiple countries, but the agency's legal team insists that data must remain within the country's borders. Which of the following is the most critical threat to consider during the transition?

   • AThe cloud provider's staff having access to the data
   • BThe cloud provider storing data in a region outside the country
   • CA denial-of-service attack on the cloud service
   • DA misconfigured cloud storage bucket that allows public access
   Reveal Solution Discussion Select an answer first