Identify Privacy Requirements CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What must a data retention requirement specify to ensure data is not kept longer than necessary?

   • AThe deletion schedule and retention period
   • BThe backup frequency for disaster recovery
   • CThe access control list for data owners
   • DThe encryption algorithm used for stored data
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a requirements document for an e-commerce site, which data element would be considered within the minimal collection scope for processing an order?

   • ACustomer's annual income
   • BCustomer's date of birth
   • CCustomer's shipping address
   • DCustomer's shoe size
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company is deploying a customer relationship management (CRM) system. The EU subsidiary requires that personal data of EU citizens be processed within the EU. The US headquarters wants to access the same data for global analytics. Which requirement should the software architecture address?

   • AStore all customer data in the US and allow EU employees to access it via VPN.
   • BAnonymize all EU customer data before storing it in the US.
   • CStore all data in the EU, but allow US employees to access it directly without any legal review.
   • DStore EU customer data in an EU data center, and implement data transfer mechanisms like standard contractual clauses for US access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A clinical research platform collects patient data from multiple countries. The platform must share data with international partners for research, but must comply with strict privacy regulations. Which approach best balances research utility and privacy?

   • AShare only aggregated statistics, such as averages, without any underlying records.
   • BShare raw patient data with partners, as they are bound by confidentiality agreements.
   • CObtain explicit consent from each patient for every data sharing request.
   • DDe-identify the data using a combination of generalization and suppression, and share only the de-identified dataset.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A cloud service provider is offering a collaboration tool to multinational companies. The tool must comply with data residency requirements of multiple countries. The provider wants to minimize infrastructure costs while meeting these requirements. Which architecture is most cost-effective?

   • AUse a few regional data centers, and implement data routing to ensure data is stored in the appropriate region for each customer.
   • BStore all data in the cloud provider's headquarters country, and rely on legal agreements to satisfy residency requirements.
   • CDeploy data centers in every country where customers are located, to ensure data stays within the country.
   • DUse a single data center in a region that is acceptable to all customers, such as a neutral country.
   Reveal Solution Discussion Select an answer first