Identify Privacy Requirements CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A global health research consortium is sharing genomic data across borders. The data is highly sensitive and subject to strict privacy regulations. The consortium wants to enable research while minimizing the risk of re-identification. Which approach is most appropriate?

   • AShare only summary statistics, such as allele frequencies, without any individual-level data.
   • BDe-identify the genomic data using a robust technique, and share it through a secure data access committee that approves each request.
   • CObtain explicit consent from each participant for every data sharing request.
   • DShare raw genomic data with all partners, as they are all bound by the same research ethics agreements.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A global HR system stores employee records. The legal team requires that employee data be retained only as long as necessary for employment and legal obligations. Which retention requirement is most appropriate?

   • ARetain all employee data for 10 years after termination, as it may be needed for future lawsuits.
   • BRetain employee data only in the country of employment, and delete it immediately upon termination.
   • CRetain employee data indefinitely, as the company may need it for background checks.
   • DRetain employee data for the duration of employment, and then delete it after a defined period based on legal requirements.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A smart home device manufacturer is developing a new product that collects audio data to improve voice recognition. The product team wants to collect audio continuously to improve the model. Privacy advocates are concerned about constant surveillance. Which requirement best addresses privacy concerns?

   • ACollect audio continuously, but process it locally on the device and only send anonymized voice commands to the cloud.
   • BCollect audio only when the user activates the device with a wake word, and allow the user to review and delete voice recordings.
   • CCollect audio continuously, but only for users who have opted in to data sharing.
   • DCollect audio continuously, but store it in an encrypted format and restrict access to authorized personnel.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A company must retain customer transaction records for tax purposes for seven years. Which aspect of data retention does this requirement address?

   • AData classification
   • BRetention period
   • CStorage location
   • DData encryption
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational corporation is implementing a new HR system. The system will store employee performance reviews, which are subject to different retention laws in different countries. The company wants to minimize legal risk while ensuring data is available for potential litigation. Which approach should the software requirements specify?

   • ARetain all performance reviews for 10 years, regardless of country, to ensure availability for litigation.
   • BRetain performance reviews according to the laws of each country, and implement a data deletion schedule that complies with the most restrictive requirement.
   • CRetain performance reviews indefinitely, but encrypt them to protect privacy.
   • DRetain performance reviews only in the employee's country of residence, and delete them immediately upon termination.
   Reveal Solution Discussion Select an answer first