Sample Questions and Answers
Which of the following is a technical control to prevent unauthorized access?
Multi-factor authentication (MFA)
B. Privacy policy
C. Employee training
D. Data classification
Correct Answer: A
Explanation:
MFA strengthens access security beyond passwords.
What is a “privacy risk”?
The potential for harm or loss related to the misuse or breach of personal data
B. Financial risk
C. Marketing risk
D. IT system risk
Correct Answer: A
Explanation:
Identifying risks is key for effective privacy management.
What is a “data subject”?
An individual whose personal data is processed
B. An organization
C. A data processor
D. A system administrator
Correct Answer: A
Explanation:
Data subjects have rights under privacy laws.
What is a “privacy incident”?
Any event that may compromise the confidentiality, integrity, or availability of personal data
B. Routine IT maintenance
C. Marketing campaign
D. Financial report
Correct Answer: A
Explanation:
Incidents may require investigation and mitigation.
What is a “data processing agreement” (DPA)?
A contract outlining how a data processor handles personal data on behalf of a data controller
B. A document describing data storage locations
C. A marketing contract
D. A financial agreement
Correct Answer: A
Explanation:
DPAs ensure processors comply with privacy laws and controller instructions.
What is “pseudonymization”?
Replacing identifying information with artificial identifiers that can be reversed under controlled conditions
B. Irreversibly removing identifiers
C. Encrypting data permanently
D. Sharing data publicly
Correct Answer: A
Explanation:
Pseudonymization protects privacy but allows re-identification if needed.
Which law primarily regulates data privacy in the United States at the federal level?
There is no comprehensive federal law; sector-specific laws like HIPAA, GLBA apply
B. GDPR
C. CCPA
D. PIPEDA
Correct Answer: A
Explanation:
The US has multiple laws by sector but no single comprehensive federal privacy law.
What is “consent” in data privacy?
A freely given, specific, informed, and unambiguous agreement to process personal data
B. Automatic agreement implied by website use
C. Verbal agreement only
D. No requirement for data collection
Correct Answer: A
Explanation:
Consent must be clear and informed to be valid under GDPR and other laws.
What is the role of a “data protection officer” (DPO)?
To oversee compliance with data protection laws and act as a contact point for authorities and individuals
B. To manage IT systems
C. To market products
D. To audit finances
Correct Answer: A
Explanation:
DPOs are responsible for privacy governance within organizations.
What is “privacy engineering”?
Designing systems and processes with privacy built-in from the start
B. Marketing privacy products
C. Legal analysis of privacy laws
D. Data analytics
Correct Answer: A
Explanation:
Privacy engineering integrates technical and organizational measures to protect data.
What does “data retention policy” define?
How long personal data is kept before deletion or anonymization
B. Data backup frequency
C. Data encryption standards
D. Employee training schedules
Correct Answer: A
Explanation:
Retention policies ensure data is not kept longer than necessary.
Which of these is a security control that can detect unauthorized data access?
Audit logs and monitoring
B. Data encryption
C. Data classification
D. Privacy policy
Correct Answer: A
Explanation:
Logging and monitoring help identify suspicious activities.
What is the principle of “accountability” in privacy?
Organizations must take responsibility and demonstrate compliance with privacy laws
B. Shifting responsibility to third parties
C. Ignoring privacy requirements
D. Sharing data freely
Correct Answer: A
Explanation:
Accountability requires documentation and proactive management.
What is “data sovereignty”?
The concept that data is subject to the laws and governance of the country where it is located
B. Ownership of data by users
C. Data shared internationally
D. Data backup location
Correct Answer: A
Explanation:
Sovereignty impacts where and how data can be stored or transferred.
What is “data breach remediation”?
Steps taken to contain, investigate, and recover from a privacy breach
B. Data deletion only
C. Marketing outreach
D. Routine IT maintenance
Correct Answer: A
Explanation:
Effective remediation limits harm and prevents recurrence.
What is “privacy-enhancing technologies” (PETs)?
Tools or methods that help protect privacy by minimizing data use or exposure
B. Marketing software
C. Data analytics tools
D. Backup software
Correct Answer: A
Explanation:
Examples include encryption, anonymization, and access controls.
What is the “right to erasure” (right to be forgotten)?
The ability of individuals to request deletion of their personal data under certain conditions
B. Data retention requirement
C. Sharing data
D. Data encryption
Correct Answer: A
Explanation:
This right is part of GDPR and similar laws.
What is “role-based access control” (RBAC)?
Restricting system access based on users’ roles within an organization
B. Granting all users full access
C. Open data sharing
D. Physical security control
Correct Answer: A
Explanation:
RBAC enforces principle of least privilege.
What is a “privacy impact assessment” (PIA)?
Evaluating how a project or system affects the privacy of individuals
B. Financial audit
C. Marketing strategy
D. IT performance report
Correct Answer: A
Explanation:
PIAs identify and mitigate privacy risks proactively.
What is the “purpose limitation” principle?
Personal data must be collected for specified, explicit, and legitimate purposes only
B. Data can be used for any purpose
C. Data must be deleted immediately
D. Data shared freely
Correct Answer: A
Explanation:
Purpose limitation prevents misuse of personal data.
What is “privacy by design”?
Integrating privacy protections into technologies and business practices from the outset
B. Privacy policies written after product launch
C. Ignoring privacy requirements
D. Data breach response
Correct Answer: A
Explanation:
Designing with privacy upfront reduces risks.
Which is a valid reason for data processing without consent under GDPR?
Compliance with legal obligations
B. Marketing purposes only
C. No reason needed
D. Personal curiosity
Correct Answer: A
Explanation:
Other lawful bases include contracts and legitimate interests.
What does “data controller” mean?
The entity that determines purposes and means of processing personal data
B. The person who physically stores data
C. Marketing team
D. IT support
Correct Answer: A
Explanation:
Controllers have primary responsibility for compliance.
What is the significance of “data subject access requests” (DSARs)?
Requests by individuals to obtain their personal data held by an organization
B. Internal audit requests
C. Marketing inquiries
D. System performance requests
Correct Answer: A
Explanation:
Handling DSARs promptly is legally required.
What does “end-to-end encryption” protect?
Data confidentiality from the sender to the receiver, preventing interception
B. Only stored data
C. Only public data
D. Only backups
Correct Answer: A
Explanation:
This encryption prevents eavesdropping during transmission.
What is the role of a “privacy notice”?
Inform individuals about how their data is collected and used
B. Internal IT documentation
C. Financial statement
D. Marketing brochure
Correct Answer: A
Explanation:
Privacy notices support transparency and trust.
What is “data portability”?
Ability to move personal data from one service provider to another in a usable format
B. Data deletion
C. Data encryption
D. Sharing data publicly
Correct Answer: A
Explanation:
Portability empowers user control over data.
Which is a common example of biometric data?
Fingerprints
B. Email addresses
C. IP addresses
D. Social security numbers
Correct Answer: A
Explanation:
Biometric data is sensitive and requires special protection.
What is “data integrity”?
Ensuring data is accurate, complete, and unaltered
B. Encrypting data
C. Sharing data
D. Deleting data
Correct Answer: A
Explanation:
Integrity protects against unauthorized modification.
What is a “data subject”?
The individual to whom personal data relates
B. The organization collecting data
C. The IT administrator
D. The marketing team
Correct Answer: A
Explanation:
Data subjects have rights regarding their data.
What is “data governance”?
Framework of policies and procedures to manage data availability, usability, integrity, and security
B. Marketing strategy
C. Financial planning
D. Software development
Correct Answer: A
Explanation:
Governance ensures data is managed responsibly.
What is “information lifecycle management” (ILM)?
Managing information from creation through archival and deletion
B. Only data backup
C. Data sharing
D. Data encryption
Correct Answer: A
Explanation:
ILM aligns data management with compliance and business needs.
What is the “principle of transparency” in privacy?
Organizations must be clear about how personal data is processed
B. Organizations can hide data practices
C. Sharing data secretly
D. No information provided to data subjects
Correct Answer: A
Explanation:
Transparency builds trust and supports compliance.
What is “access control”?
Mechanisms to restrict data access to authorized users only
B. Data sharing policies
C. Encryption methods
D. Data deletion
Correct Answer: A
Explanation:
Controls like passwords and roles protect sensitive data.
Reviews
There are no reviews yet.