QUESTION 81
Which of the following is the BEST indication that an organization needs to perform a privacy impact assessment (PIA)?

A. The privacy policy is included in an online training course.
B. New personal information categories are being collected about customers.
C. An inventory of personal information is reported to stakeholders.
D. The privacy practices are being reviewed by clients.

Correct Answer: B

QUESTION 82
Which of the following is a privacy by design principle?

A. Trust but verify
B. Respect for user privacy
C. Shared privileged access
D. Reactive privacy controls

Correct Answer: B

QUESTION 83
An organization has developed a tracking system to better understand customer purchasing behavior. Prior to deployment, it is discovered that the consumer privacy policy does not properly convey that customer purchases may be tracked in this way. Which of the following is the BEST course of action?

A. When the system is launched, collect the data but do not analyze it until the policy and notice have been updated.
B. Include a notice in the purchase confirmation that informs customers of the tracking.
C. Delay launching the system until the privacy policy and notice have been updated.

Correct Answer: C

QUESTION 84
Of the following, who is the BEST resource for determining which privacy laws must be followed for data that crosses international borders?

A. The government in the country where the data is initially collected
B. The chief risk officer (CRO) for the organization that plans to collect the data
C. The chief information security officer (CISO) in the country that processes the data
D. The legal counsel for the organization that plans to collect the data

Correct Answer: D

QUESTION 85
At a minimum, records metadata in data retention files should include:

A. the record creation date.
B. the record creator.
C. the record version history.
D. the record event date.

Correct Answer: A

QUESTION 86
Which of the following poses the GREATEST privacy risk for users of an application that collects their geolocation information?

A. Inaccurate cell tower triangulation
B. Use of the location data for user profiling
C. Third-party access to aggregated location data

D. Complex legal disclosures

Correct Answer: B

QUESTION 87
Which of the following is MOST important to help determine the controls required to secure the servers that support a customer portal?

A. Data classification policy
B. Configuration management tool
C. Control self-assessments (CSAs)
D. Patch management software

Correct Answer: A

QUESTION 88
Which of the following is the BEST way to protect the confidentiality of the information returned by a new application programming interface (API) integration?

A. Update the privacy policy to include use of the API.
B. Require all API requests to be monitored
C. Ensure all API traffic is encrypted in transit.
D. Use only APIs with de-identified data.

Correct Answer: C

QUESTION 89
Which type of data is produced by using a more complex method of analytics to find correlations between data sets and using them to categorize or profile people?

A. Provided data
B. Inferred data
C. Observed data
D. Derived data

Correct Answer: D

QUESTION 90
Which of the following is the MOST effective method to obfuscate personal data in a public cloud environment?

A. Tokenization
B. Multi-factor authentication (MFA)
C. Digital hashing
D. Access control

Correct Answer: A

QUESTION 91
Which of the following is the PRIMARY reason that regulatory authorities would require permission for corporate use of drones with mounted video cameras for visual surveillance?

A. To prevent compromise of network security
B. To facilitate investigation of privacy incidents
C. To provide sufficient notice to the public
D. To minimize disruption in wireless networks

Correct Answer: C

QUESTION 92
An organization is designing a new human resources (HR) system. Which of the following should be implemented to BEST enable detection of unauthorized access to personal data?

A. Vulnerability scanning and management software
B. Web application firewall (WAF)
C. Security information and event management (SIEM) solution
D. Data loss prevention (DLP) solution

Correct Answer: C

QUESTION 93
Which of the following is the GREATEST privacy risk factor for data stored on disk?

A. Users storing data locally
B. Hardware degradation
C. Lack of encryption at rest
D. Lack of periodic backups

Correct Answer: C

QUESTION 94
To increase productivity, an organization is planning to implement movement tracking devices in the vehicles of field employees. Which of the following MUST be in place before installing the devices?

A. Location accuracy mechanisms
B. End-user agreements
C. Mobile device management (MDM)
D. Bring your own device (BYOD) policy

Correct Answer: B

QUESTION 95
Which of the following BEST ensures an organization’s data retention requirements will be met in the public cloud environment?

A. Automated data deletion schedules
B. Service level agreements (SLAs)
C. Data classification schemes
D. Cloud vendor agreements

Correct Answer: B

QUESTION 96
A business unit is considering the use of cloud services to automate internal processes. Which of the following is MOST important for the business manager to consider when preparing a proposal for approval from senior management?

A. Resource deployment plan
B. Organizational readiness assessment
C. Risk assessment results
D. IT goals and objectives

Correct Answer: D

QUESTION 97
When identifying improvements focused on the information asset life cycle, which of the following is CRITICAL for enabling data interoperability?

A. Sanitization
B. Replication
C. Segregation
D. Standardization

Correct Answer: D

QUESTION 98
An enterprise recognizes that a large percentage of its IT employees are eligible for retirement in the next five years. A significant amount of institutional knowledge resides with retirement- eligible staff. From the board’s perspective, which of the following is the GREATEST potential risk for the enterprise?

A. Lack of IT expertise to assist with onboarding
B. Lack of a business impact analysis (BIA)
C. Loss of IT competitive edge within the industry
D. Interruption of service delivery to the business

Correct Answer: D

QUESTION 99
An enterprise has a strategic objective to implement a new enterprise resource planning (ERP) system that will improve user mobility and reduce delivery time. Which of the following should the CIO do FIRST?

A. Engage the human resources (HR) department to map technical knowledge gaps.
B. Explain the strategy to the product development team.
C. Ensure enough financial resources exist to enable project execution.
D. Participate in solution design to ensure strategic goal alignment.

Correct Answer: C

QUESTION 100
Which of the following is MOST helpful to obtain senior management support for IT governance activities?

A. Engaging in strategic IT investment portfolio analysis
B. Highlighting opportunity losses resulting from risk aversion
C. Defining IT value delivery in each business unit
D. Incorporating insights from competitors

Correct Answer: C