Try Free Isaca CDPSE Updated Questions & Answers

Question No. 1

Which of the following is a role PRIMARILY assigned to an internal data owner?

AMonitoring data retention periods

BAuthorizing access rights

CServing as primary contact with regulators

DImplementing appropriate technical controls

Show Answer

Correct Answer: B

The role primarily assigned to an internal data owner is authorizing access rights. A data owner is a person or a role within the organization who has the authority and responsibility for the data assets under their control. A data owner is responsible for defining the data classification, data quality, data retention, and data security requirements for their data assets. A data owner is also responsible for granting, revoking, and reviewing the access rights to their data assets based on the principle of least privilege and the business needs. A data owner is accountable for ensuring that the data assets are used in compliance with the organizational policies and the applicable laws and regulations.Reference:

[ISACA Glossary of Terms]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.1]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.2]

[ISACA CDPSE Review Manual, Chapter 3, Section 3.2.3]

Question No. 2

Which of the following should be the FIRST consideration when selecting a data sanitization method?

ARisk tolerance

BImplementation cost

CIndustry standards

DStorage type

Show Answer

Correct Answer: D

The first consideration when selecting a data sanitization method is the type of storage device that holds the data to be sanitized. Different types of storage devices have different characteristics and limitations that affect the effectiveness and feasibility of data sanitization methods.For example, magnetic media, such as hard disk drives (HDDs), can be sanitized by data degaussing, which is wiping data permanently by weakening the magnetic field1.However, data degaussing is not applicable to devices that use solid state drive (SSD) technology, since SSDs do not store data magnetically2. Therefore, the storage type determines which data sanitization methods are suitable and available for the data disposal process.

ISACA, Why (and How to) Dispose of Digital Data, Data Degaussing1

ISACA, Best Practices for Data Hygiene, Data Hygiene Practices3

TechReset, Data Sanitization and Methods, Cryptographic Erasure2

Imperva, What is Data Sanitization?4

Question No. 3

Which authentication practice is being used when an organization requires a photo on a government-issued identification card to validate an in-person credit card purchase?

APossession factor authentication

BKnowledge-based credential authentication

CMulti-factor authentication

DBiometric authentication

Show Answer

Correct Answer: A

Authentication is a process of verifying the identity of a user or device that requests access to a system or resource. Authentication can be based on one or more factors, such as something the user knows (e.g., password), something the user has (e.g., token), something the user is (e.g., fingerprint) or something the user does (e.g., signature). When an organization requires a photo on a government-issued identification card to validate an in-person credit card purchase, it is using possession factor authentication, which relies on something the user has as proof of identity.The other options are not applicable in this scenario1, p.81Reference:1: CDPSE Review Manual (Digital Version)

Question No. 4

Which of the following is the BEST way to distinguish between a privacy risk and compliance risk?

APerform a privacy risk audit.

BConduct a privacy risk assessment.

CValidate a privacy risk attestation.

DConduct a privacy risk remediation exercise.

Show Answer

Correct Answer: B

A privacy risk assessment is a process of identifying, analyzing and evaluating the privacy risks associated with the collection, use, disclosure or retention of personal data. A privacy risk assessment is the best way to distinguish between a privacy risk and compliance risk, as it would help to determine the likelihood and impact of privacy incidents or breaches that could affect the rights and interests of the data subjects, as well as the legal obligations and responsibilities of the organization. A privacy risk assessment would also help to identify and implement appropriate controls and measures to mitigate or reduce the privacy risks and ensure compliance with privacy principles, laws and regulations. The other options are not as effective as conducting a privacy risk assessment in distinguishing between a privacy risk and compliance risk. Performing a privacy risk audit is a process of verifying and validating the effectiveness and adequacy of the privacy controls and measures implemented by the organization, but it does not necessarily identify or evaluate the privacy risks or compliance risks. Validating a privacy risk attestation is a process of confirming and certifying the accuracy and completeness of the privacy information or statements provided by the organization, but it does not necessarily identify or evaluate the privacy risks or compliance risks.Conducting a privacy risk remediation exercise is a process of implementing corrective actions or improvements to address the identified or reported privacy risks or compliance risks, but it does not necessarily distinguish between them1, p.66-67Reference:1: CDPSE Review Manual (Digital Version)

Question No. 5

A global organization is planning to implement a customer relationship management (CRM) system to be used in offices based in multiple countries. Which of the following is the MOST important data protection consideration for this project?

AIndustry best practice related to information security standards in each relevant jurisdiction

BIdentity and access management mechanisms to restrict access based on need to know

CEncryption algorithms for securing customer personal data at rest and in transit

DNational data privacy legislative and regulatory requirements in each relevant jurisdiction

Show Answer

Correct Answer: D

National data privacy legislative and regulatory requirements in each relevant jurisdiction are the most important data protection consideration for a global organization that is planning to implement a customer relationship management (CRM) system to be used in offices based in multiple countries, as they would determine the legal obligations and responsibilities of the organization with respect to the collection, use, disclosure and transfer of customer personal data across different jurisdictions. National data privacy legislative and regulatory requirements may vary significantly from country to country, depending on the type or nature of personal data or data processing activities, and may impose different rules and standards for obtaining consent, providing notice, ensuring security, enforcing rights, reporting breaches, appointing representatives or transferring data. The organization would need to comply with the national data privacy legislative and regulatory requirements in each relevant jurisdiction where it operates or where its customers are located, and to implement appropriate measures and safeguards to ensure compliance. The other options are not as important as national data privacy legislative and regulatory requirements in each relevant jurisdiction as data protection considerations for a global organization that is planning to implement a CRM system to be used in offices based in multiple countries. Industry best practice related to information security standards in each relevant jurisdiction may provide some guidance or benchmarks for ensuring security of customer personal data, but they may not reflect the specific context or needs of the organization or the customers, or comply with the legal obligations and responsibilities of the organization. Identity and access management mechanisms to restrict access based on need to know may help to protect customer personal data from unauthorized access, modification or disclosure by internal or external parties, but they may not address other aspects of data protection, such as consent, notice, rights, breaches, representatives or transfers.Encryption algorithms for securing customer personal data at rest and in transit may help to protect customer personal data from unauthorized access, modification or disclosure by internal or external parties, but they may not address other aspects of data protection, such as consent, notice, rights, breaches, representatives or transfers1, p.63-64Reference:1: CDPSE Review Manual (Digital Version)

Most Recent Isaca CDPSE Exam Dumps

The questions for CDPSE were last updated on May 5, 2025.

Unlock All Questions for Isaca CDPSE Exam