Understand Privacy Issues CCSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is implementing a new customer data analytics platform. The company wants to ensure that its privacy practices align with recognized frameworks. Which of the following actions would best demonstrate alignment with the Generally Accepted Privacy Principles (GAPP)?

   • AObtaining ISO/IEC 27001 certification
   • BImplementing encryption for data at rest
   • CAppointing a data protection officer
   • DConducting a Privacy Impact Assessment (PIA) before the platform launch
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is planning to launch a new mobile app that collects location data from users in the EU and the US. The company's legal team is concerned about GDPR compliance. The company wants to conduct a Privacy Impact Assessment (PIA) but is unsure when it is required. Which of the following is a condition that makes a PIA mandatory under GDPR?

   • AThe processing is likely to result in a high risk to the rights and freedoms of individuals.
   • BThe processing involves data of US citizens.
   • CThe company uses a cloud service provider.
   • DThe company has more than 250 employees.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A cloud service provider (CSP) signs a contract with a financial institution to process customer transaction data. The contract includes clauses on confidentiality and data handling, but the data is not subject to a specific privacy regulation. The financial institution later discovers that the CSP subcontracted data processing to a third party without notifying them, violating the contract. What is the primary source of enforcement for this breach?

   • AThe GDPR
   • BThe Federal Trade Commission Act
   • CThe contract between the CSP and the financial institution
   • DThe HIPAA Privacy Rule
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cloud service provider wants to align its privacy practices with ISO/IEC 27018. Which of the following controls is most likely to be required under ISO/IEC 27018?

   • AThe provider must conduct a PIA for every new service.
   • BThe provider must not use customer personal data for marketing without explicit consent.
   • CThe provider must appoint a data protection officer.
   • DThe provider must encrypt all data at rest and in transit.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency is planning to deploy a new online portal that will collect citizens' personal information for public services. Before launch, the agency wants to identify and mitigate privacy risks associated with the new system. What is the most appropriate action for the agency to take?

   • ASign a data processing agreement with the cloud provider
   • BConduct a Privacy Impact Assessment (PIA)
   • CHire a data protection officer (DPO)
   • DImplement multi-factor authentication
   Reveal Solution Discussion Select an answer first