Which of the following helps define data retention time in a stream-fed data lake that includes personal data?
Correct Answer: C
Explanation Data privacy standards are the set of rules, guidelines, and best practices that define the requirements and expectations for the collection, processing, storage, sharing, and disposal of personal data. Data privacy standards help to ensure that personal data is treated in a fair, lawful, transparent, and secure manner, as well as to comply with the applicable privacy laws and regulations. Data privacy standards also help to define the data retention time in a stream-fed data lake that includes personal data, as they specify the criteria and conditions for how long personal data can be kept in the data lake, based on factors such as the purpose, necessity, relevance, and quality of the data. Data retention time is an important aspect of data privacy, as it affects the risk of data breaches, unauthorized access, or misuse of personal data. References: CDPSE Review Manual, 2021, p. 80
Question 32
Which of the following MOST effectively protects against the use of a network sniffer?
Correct Answer: D
Question 33
Which of the following is MOST important to include in a data use policy?
Correct Answer: A
Explanation A data use policy is a document that defines the rules and guidelines for how personal data are collected, used, stored, shared and deleted by an organization. It is an important part of data governance and compliance, as it helps to ensure that personal data are handled in a lawful, fair and transparent manner, respecting the rights and preferences of data subjects. A data use policy should include the requirements for collecting and using personal data, such as the legal basis, the purpose, the scope, the consent, the data minimization, the accuracy, the security and the accountability. These requirements help to establish the legitimacy and necessity of data processing activities, and to prevent unauthorized or excessive use of personal data. References: ISACA Privacy Notice & Usage Disclosures, section 2.1: "We collect Personal Information from you when you provide it to us directly or through a third party who has assured us that they have obtained your consent." Chapter Privacy Policy - Singapore Chapter - ISACA, section 2: "We will collect your personal data in accordance with the PDPA either directly from you or your authorized representatives, and/or through our third party service providers." Data Minimization-A Practical Approach - ISACA, section 2: "Enterprises may only collect as much data as are necessary for the purposes defined at the time of collection, which may also be set out in a privacy notice (sometimes referred to as a privacy statement, a fair processing statement or a privacy policy)." Establishing Enterprise Roles for Data Protection - ISACA, section 3: "Data governance is typically implemented in organizations through policies, guidelines, tools and access controls."
Question 34
Which of the following is the PRIMARY benefit of implementing policies and procedures for system hardening?
Correct Answer: A
Explanation System hardening is a process of applying security measures and configurations to a system to reduce its attack surface and enhance its resistance to threats. System hardening can include disabling unnecessary services, removing default accounts, applying patches and updates, enforcing strong passwords and encryption, and implementing firewalls and antivirus software. The primary benefit of system hardening is that it increases system resiliency, which is the ability of a system to withstand or recover from adverse events that could affect its functionality or performance. The other options are not the primary benefits of system hardening, although they may be secondary benefits or outcomes. System hardening does not necessarily reduce external threats to data, as threats can originate from various sources and vectors. System hardening may reduce exposure of data, but only if the data is stored or processed by the system. System hardening does not eliminate attack motivation for data, as attackers may have different motives and incentives for targeting data. , p. 91-92 References: : CDPSE Review Manual (Digital Version)
Question 35
Which of the following is a PRIMARY objective of performing a privacy impact assessment (PIA) prior to onboarding a new Software as a Service (SaaS) provider for a customer relationship management (CRM) system?
Correct Answer: A
Explanation A primary objective of performing a privacy impact assessment (PIA) prior to onboarding a new Software as a Service (SaaS) provider for a customer relationship management (CRM) system is to identify controls to mitigate data privacy risks, such as data breaches, unauthorized access, misuse or loss of data. A PIA would help to evaluate the potential privacy impacts of using a new SaaS provider for CRM data processing activities, such as collecting, storing, analyzing or transferring customer data, and to implement appropriate controls to mitigate those impacts, such as encryption, access control, backup, audit trail or contractual clauses. A PIA would also help to ensure compliance with privacy principles, laws and regulations, and alignment with customer expectations and preferences. The other options are not primary objectives of performing a PIA prior to onboarding a new SaaS provider for CRM data processing activities. Classifying personal data according to the data classification scheme is an activity that may be part of a PIA process, but it is not an objective in itself. Assessing the risk associated with personal data usage is an activity that may be part of a PIA process, but it is not an objective in itself. Determining the service provider's ability to maintain data protection controls is an activity that may be part of a PIA process, but it is not an objective in itself1, p. 67 References: 1: CDPSE Review Manual (Digital Version)
