Threats and Vulnerabilities CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary basis for prioritizing privacy risks?

   • AThe number of vulnerabilities identified in a system.
   • BThe ease of exploiting a vulnerability.
   • CThe cost of implementing mitigation controls.
   • DThe likelihood and impact of each risk.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which activity is MOST directly associated with the threat identification process?

   • ACataloging potential threat actors and their motivations.
   • BReviewing system logs for signs of unauthorized access.
   • CPatching a known software vulnerability in a web application.
   • DConducting a privacy impact assessment (PIA) for a new system.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In threat and vulnerability analysis, what does the relationship between a threat and a vulnerability determine?

   • AThe classification level of the personal data.
   • BThe level of risk exposure to privacy data.
   • CThe number of security controls required to comply with regulations.
   • DThe type of encryption algorithm used to protect the data.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a legacy application that stores customer data and is no longer supported by the vendor. The application has a known vulnerability that could allow unauthorized access. The company is planning to migrate to a new system within six months. Which of the following is the most appropriate risk treatment strategy?

   • AMitigate the risk by implementing compensating controls, such as network segmentation and monitoring
   • BAvoid the risk by immediately decommissioning the application
   • CAccept the risk because the migration will eliminate the vulnerability
   • DTransfer the risk by purchasing cyber insurance
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is considering using a third-party vendor to process customer data. The vendor has experienced a data breach in the past. The company's privacy team is conducting a threat assessment. Which of the following is the most significant threat associated with using this vendor?

   • AThe vendor's systems may be less secure than the company's
   • BThe vendor's past breach indicates a high likelihood of future breaches
   • CThe vendor may not comply with data protection regulations
   • DThe vendor's employees may have access to customer data, increasing the risk of insider threats
   Reveal Solution Discussion Select an answer first