Question 1

A privacy strategist has examined a business process and has determined that personnel who perform the process do so consistently, but

there is no written process document. The maturity level of this process is:

Options :

A : Initial

B : Managed

C : Repeatable

D : Defined

Answer: C

Question 2

When configuring information systems for the communication and transport of personal data, an organization should:

Options :

A : adopt the default vendor specifications.

B : review configuration settings for compliance.

C : implement the least restrictive mode.

D : enable essential capabilities only.

Answer: B

Question 3

A privacy manager is attending a planning meeting in which marketing personnel argue for the collection of PII from customers that

may be used sometime in the future. How should the privacy manager respond?

Options :

A : Permit the collection of the additional PII fields.

B : Require that the additional PII fields be encrypted.

C : Update the data retention schedule to include the additional PII fields.

D : Forbid the collection of the additional PII fields.

Answer: D

Question 4

Program responsibilities over the activities of managing data subject requests lie with:

Options :

A :

The chief privacy officer

B : The chief marketing officer

C : Customer support

D : The chief information security officer

Answer: A

Question 5

Why is it important for users of corporate laptops to use VPN when communicating on open Wi-Fi hot spots?

Options :

A :

Privacy laws require that corporate data be encrypted in transit.

B : Traffic on open Wi-Fi networks is not encrypted.

C : A VPN is necessary to reach an internal corporate network.

D : VPNs protect stored data on public networks.

Answer: B