An e-commerce company collects customer data for order processing. They want to use the same data to send promotional emails. Under GDPR, what must they do before using the data for this new purpose?

Anonymize the data before using it for marketing

Delete the data and collect it again with a new consent form

Notify the data protection authority and obtain approval

Obtain explicit consent from customers for the marketing purpose

A security architect is designing a system that must ensure that a user cannot deny having performed a financial transaction. They also need to ensure that the transaction data has not been tampered with. Which combination of security concepts should be implemented?

Authentication and authorization

Confidentiality and availability

Data minimization and purpose limitation

What does the privacy principle of 'purpose limitation' require of an organization?

To delete personal data as soon as it is no longer needed

To use personal data only for the purposes for which it was collected

To collect as much data as possible for future use

To obtain consent from data subjects before any processing

A US-based company that is not a financial institution collects personal data from California residents. They want to ensure compliance with the California Consumer Privacy Act (CCPA). Which of the following rights must they provide to California consumers?

The right to know what personal information is collected and the right to request deletion

The right to data portability in a machine-readable format

The right to be forgotten, which requires deletion of all data without exception

The right to restrict processing of personal data

Certified in Risk and Information Systems Control

Domain 4Objective 4

Security and Privacy CRISC Practice Questions (Page 1)

Part of the Domain 4: Technology and Security domain, which accounts for 20% of the CRISC exam.

32questions here

7free pages

8concepts

20%of the exam

Questions 1–5

1application · medium
An e-commerce company collects customer data for order processing. They want to use the same data to send promotional emails. Under GDPR, what must they do before using the data for this new purpose?
Select an answer first
2expert · medium
A security architect is designing a system that must ensure that a user cannot deny having performed a financial transaction. They also need to ensure that the transaction data has not been tampered with. Which combination of security concepts should be implemented?
Select an answer first
3foundation · easy
What does the privacy principle of 'purpose limitation' require of an organization?
Select an answer first
4foundation · easy
Which data privacy principle requires that an organization only collect personal data that is necessary for its stated purpose?
Select an answer first
5application · medium
A US-based company that is not a financial institution collects personal data from California residents. They want to ensure compliance with the California Consumer Privacy Act (CCPA). Which of the following rights must they provide to California consumers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.