CDPSE Privacy Governance Practice Test 3 — 15 Questions

Question 1

When a company faces conflicting privacy regulations (e.g., GDPR vs. local laws), what is the most robust governance stance?

Accepted Answer

Apply the most stringent standard globally.. Applying the most stringent requirement ensures compliance across the board, minimizing risk.

Answer

Apply the weakest regulation to reduce costs.

Answer

Ignore both and wait for the regulator to advise.

Answer

Only comply with the law of the country where the head office is located.

Question 2

Which TWO of the following should be considered when aligning privacy strategy with the business?

Accepted Answer

Primary business objectives and growth plans.. Risk appetite and business goals are the two primary anchors for privacy strategy.

Answer

The local cafeteria menu.

Answer

The current market share of competitors.

Answer

The weather forecast in the corporate headquarters.

Question 3

Which THREE items should be included in a Privacy Impact Assessment (PIA) report?

Accepted Answer

Assessment of privacy risks to individuals.. A PIA must identify the data, the risks, and the mitigation plan.

Answer

The cafeteria's weekly menu.

Answer

The names of all employees in the marketing department.

Question 4

Which THREE factors influence the maturity level of an organization's privacy governance?

Accepted Answer

The consistency of policy application across the enterprise.. Policy adoption, process automation, and monitoring depth define maturity.

Answer

The amount of office space rented.

Answer

The number of employees in the IT department.

Question 5

Which THREE of the following are essential elements of a privacy governance framework?

Accepted Answer

Continuous monitoring and auditing of privacy controls.. Policies, roles, and monitoring are the classic pillars of a governance framework.

Answer

A collection of all company invoices.

Answer

A list of employee salaries.

Question 6

Which THREE of the following are benefits of a centralized privacy governance model?

Accepted Answer

Simplified communication of privacy standards to all regions.. Centralization offers better control, consistency, and efficient reporting.

Answer

Higher costs due to duplicate efforts.

Answer

The ability to ignore local laws.

Question 7

A CDPSE practitioner is tasked with aligning the organization's privacy strategy with business goals. Which of the following activities should be prioritized to ensure that privacy governance is embedded within the Software Development Life Cycle (SDLC)?

Accepted Answer

Conduct a Privacy Impact Assessment (PIA) during the initial requirements gathering phase.. Privacy by design requires early integration into the SDLC, typically through Privacy Impact Assessments (PIA) at the requirements phase.

Answer

Review the privacy policy after the product has been moved to general availability.

Answer

Perform a penetration test on the production environment after the release deployment.

Answer

Automate data deletion scripts after the data retention period has expired.

Question 8

An organization is updating its privacy governance framework to comply with GDPR. The Data Protection Officer (DPO) needs to ensure that the accountability principle is met. Which of the following actions best demonstrates accountability?

Accepted Answer

Establishing a centralized Record of Processing Activities (ROPA).. Accountability requires demonstrating compliance, which is best achieved through comprehensive documentation and audit trails.

Answer

Outsourcing all data processing activities to a third-party vendor.

Answer

Implementing a strong password policy for all employees.

Answer

Creating a public-facing website privacy notice.

Question 9

Which role is primarily responsible for the overall oversight of privacy governance within an organization to ensure that privacy policies are being followed?

Accepted Answer

Data Protection Officer (DPO). The Data Protection Officer (DPO) or Chief Privacy Officer (CPO) is tasked with the independent oversight of the privacy program.

Answer

Chief Financial Officer (CFO)

Answer

Chief Information Officer (CIO)

Answer

External Legal Counsel

Question 10

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

Accepted Answer

Adopt a 'hub and spoke' privacy governance model.. A 'hub and spoke' model allows for central policy oversight while enabling local offices to adapt to specific legal requirements.

Answer

Standardize all data processing to occur only in the home country.

Answer

Allow each region to define its own privacy framework independently.

Answer

Enforce a single, global privacy policy that overrides all local laws.

Question 11

During an audit, it is discovered that privacy policies have not been updated for three years, despite significant changes in business data collection practices. Which governance failure is most evident?

Accepted Answer

Lack of a formal policy review and approval lifecycle.. Privacy policies must reflect current processing activities; failing to update them indicates a breakdown in the policy lifecycle management process.

Answer

Insufficient budget for the privacy office.

Answer

Inadequate training for staff on data privacy.

Answer

Failure of the IT department to implement technical controls.

Question 12

Which tool is best suited for establishing the scope of a privacy governance program by identifying where personal data resides across the organization?

Accepted Answer

Data Inventory / Data Map. A Data Inventory (or Data Mapping) is the foundational tool used to identify data assets and their flows.

Answer

Access Control Matrix

Answer

Privacy Impact Assessment (PIA)

Answer

Incident Response Plan

Question 13

When evaluating a third-party vendor's privacy maturity, which document is most critical for the privacy practitioner to review during the due diligence process?

Accepted Answer

A SOC 2 Type II report or independent privacy audit report.. A SOC 2 Type II report or a dedicated privacy audit report provides independent verification of the vendor's privacy controls.

Answer

The vendor's public stock market performance.

Answer

The vendor's marketing brochure.

Answer

The vendor's internal organizational chart.

Question 14

Which THREE of the following are essential components of an effective privacy governance framework?

Accepted Answer

Clear privacy policies and standards.. A governance framework must include clear policies, defined roles/responsibilities, and a mechanism for monitoring and auditing compliance.

Answer

A list of all IT hardware serial numbers.

Answer

The organization's annual tax filing documentation.

Question 15

Which TWO of the following should be considered when aligning privacy strategy with broader business objectives?

Accepted Answer

The organization's stated risk appetite.. Alignment requires understanding the organization's risk appetite and the legal/regulatory landscape in which it operates.

Answer

The specific font used in corporate emails.

Answer

The number of employees who take public transit.

Answer

The physical location of the office breakroom.