CCNA Privacy Governance Questions — Page 2 of 2

MCQmedium

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

A.Standardize all data processing to occur only in the home country.

B.Adopt a 'hub and spoke' privacy governance model.

C.Allow each region to define its own privacy framework independently.

D.Enforce a single, global privacy policy that overrides all local laws.

AnswerB

A hub and spoke model centralises policy, standards and oversight in the hub while spokes adapt implementation to local legal requirements, satisfying the need for consistent governance that still accommodates jurisdictional variation. This balances global consistency against regional regulatory differences more effectively than fully centralised or fully devolved alternatives.

Why this answer

A 'hub and spoke' privacy governance model centralizes policy-setting, standards, and oversight at the corporate hub while allowing local spokes to adapt implementation to jurisdictional legal variations. This balances global consistency with local compliance, ensuring that regional requirements (e.g., GDPR, CCPA, PIPL) are met without fragmenting the overall governance framework. It is the recommended approach for multinationals facing divergent privacy laws.

Exam trap

CDPSE often tests the tension between global consistency and local legal compliance, causing candidates to choose extreme options like full centralization or full decentralization instead of the balanced hub-and-spoke model.

How to eliminate wrong answers

Option A is wrong because standardizing all processing in the home country ignores local data residency and sovereignty laws, and may violate cross-border transfer restrictions. Option C is wrong because allowing each region to define its own framework independently creates inconsistency, duplication, and governance gaps — the opposite of centralization. Option D is wrong because a single global policy that overrides local laws is legally untenable; local laws such as GDPR cannot be overridden by corporate policy, and doing so invites enforcement actions.

Practice this question →

MCQhard

A multinational corporation's privacy team is struggling to keep pace with new privacy laws across 20 countries. The chief privacy officer wants to shift from a reactive to a proactive governance model. Which initiative would BEST enable this transformation?

A.Conduct an annual global privacy audit to identify gaps after laws take effect.

B.Implement a privacy management platform that tracks regulatory changes and automates assessments.

C.Hire additional privacy lawyers in each country to monitor legislative changes.

D.Delegate privacy compliance to local business units without central oversight.

AnswerB

A privacy management platform centralizes regulatory tracking, automates assessments, and provides a scalable way to integrate changes across jurisdictions. This enables a proactive approach by giving the team visibility into emerging requirements and streamlining compliance activities, rather than reacting manually to each new law.

Why this answer

Implementing a privacy management platform best enables a proactive governance model by automating regulatory tracking, assessments, and reporting across multiple jurisdictions. It provides scalability and real-time visibility, allowing the privacy team to anticipate and respond to changes efficiently, rather than reacting after the fact.

Exam trap

The trap here is assuming that adding headcount or conducting periodic audits will shift the model from reactive to proactive, when they primarily address symptoms or lag behind change.

Practice this question →

MCQmedium

A CDPSE practitioner at a mid-sized insurance company is designing the privacy governance structure. The Chief Privacy Officer reports to the General Counsel, but privacy decisions frequently require input from IT security, marketing, and product development. The practitioner needs to ensure that privacy requirements are integrated into business processes without creating a bottleneck. Which governance mechanism best achieves this?

A.Require the Chief Privacy Officer to personally approve every initiative that touches personal data, regardless of size or risk.

B.Delegate all privacy decisions to the IT security team, since they control the technical controls that protect personal data.

C.Establish a cross-functional privacy council with representatives from each business unit that meets regularly to review and approve privacy-impacting initiatives.

D.Outsource privacy governance to an external law firm that specializes in data protection regulations.

AnswerC

A cross-functional privacy council embeds privacy accountability across departments, enabling timely decisions and integration into business processes. It avoids the bottleneck of a single decision-maker by distributing responsibility while maintaining central oversight. This structure aligns with CDPSE governance principles, ensuring privacy is considered in product development, marketing, and IT security, and it provides a forum for resolving conflicts and prioritizing privacy risks.

Why this answer

A cross-functional privacy council integrates privacy into business units, enabling risk-based decisions and avoiding bottlenecks. It ensures that privacy requirements are considered by all relevant stakeholders, from IT to marketing, and provides a scalable governance mechanism. This approach aligns with CDPSE guidance on establishing accountability and embedding privacy by design, rather than relying on a single person or external party.

Exam trap

The trap here is assuming that privacy governance must be centralized in a single role or department, when effective governance actually requires cross-functional integration and distributed accountability.

Practice this question →

MCQhard

A global retailer is expanding into new markets and must align its privacy program with multiple regulatory regimes, including the GDPR and the CCPA. The Chief Privacy Officer wants to ensure the program can adapt to future regulatory changes without requiring a complete redesign each time. Which approach best supports this goal?

A.Delegate privacy compliance to regional legal teams, allowing each to interpret and implement requirements independently.

B.Rely on the strictest regulation among all operating jurisdictions and apply its requirements uniformly worldwide.

C.Adopt a jurisdiction-specific compliance playbook that is updated whenever a new regulation is enacted.

D.Implement a principles-based privacy framework that maps controls to multiple regulatory requirements and is reviewed periodically.

AnswerD

A principles-based framework, such as one aligned with the NIST Privacy Framework or ISO/IEC 27701, establishes core privacy principles and maps controls to various regulations. This allows the organization to adapt to new laws by reassessing mappings rather than redesigning the program. Periodic reviews ensure currency. This approach directly supports scalability and future-proofing, which is what the CPO requires for global expansion.

Why this answer

A principles-based framework provides a stable foundation of privacy principles and maps controls to multiple regulations. When new laws emerge, the organization can update mappings and controls rather than rebuild the program. This scalability and adaptability are essential for a global retailer facing evolving regulatory landscapes, making it the most effective approach for the CPO's goal.

Exam trap

The trap here is assuming that applying the strictest regulation globally automatically future-proofs the program, when in fact new regulations can introduce entirely new obligations not covered by any existing law.

Practice this question →

MCQhard

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

A.Ignore the privacy principle.

B.Conduct a formal Privacy Impact Assessment (PIA).

C.Ask the CEO to override the privacy policy.

D.Immediately terminate the project.

AnswerB

A Privacy Impact Assessment systematically identifies privacy risks, evaluates necessity and proportionality, and documents mitigations before any decision is taken. Conducting it first satisfies the stem's governance requirement, ensuring the conflict is assessed on evidence rather than resolved by defaulting to business preference.

Why this answer

A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Exam trap

CDPSE often tests the misconception that conflicts between business and privacy are resolved by executive authority or by abandoning the project, when the correct governance answer is always the formal assessment process first.

How to eliminate wrong answers

Option A is wrong because unilaterally ignoring a privacy principle bypasses governance and exposes the organization to regulatory and reputational liability. Option C is wrong because asking the CEO to override policy circumvents due process and does not resolve the underlying conflict or document risk. Option D is wrong because immediately terminating the project is a disproportionate reaction that skips assessment and may destroy business value unnecessarily.

Practice this question →

Multi-Selecthard

A privacy program manager is updating the organization's privacy governance charter to reflect new regulatory requirements. The charter must define the authority and responsibilities of the privacy office. Which two of the following are essential to include in the charter to ensure the privacy office can effectively enforce compliance? (Choose two.)

Select 2 answers

A.The privacy office is responsible for negotiating all contracts with third-party data processors.

B.The privacy office reports directly to the Chief Financial Officer to ensure budget alignment.

C.The privacy office has the authority to approve or reject new data processing activities that pose unacceptable privacy risks.

D.The privacy office must obtain approval from the marketing department before updating privacy policies.

E.The privacy office can impose sanctions on business units that violate privacy policies, up to and including suspension of data processing.

AnswersC, E

Granting the privacy office authority to approve or reject new processing activities ensures privacy is considered before data is collected. This is a core enforcement mechanism, often required by regulations like GDPR's data protection by design. Without this authority, the privacy office can only advise, not prevent non-compliant activities, weakening governance.

Why this answer

A governance charter must grant the privacy office both preventive authority (approving or rejecting risky processing) and corrective authority (imposing sanctions). These powers enable the privacy office to enforce compliance effectively and ensure privacy is integrated into business processes. Without them, the privacy office cannot fulfill its oversight role.

Exam trap

The trap here is confusing operational responsibilities like contract negotiation with governance authority, which focuses on decision rights and enforcement.

Practice this question →

MCQmedium

A financial services company is revising its privacy governance framework to better integrate privacy risk management with its enterprise risk management (ERM) program. The Chief Privacy Officer wants to ensure that privacy risks are consistently identified, assessed, and treated in alignment with other organizational risks. Which of the following is the MOST critical action to achieve this integration?

A.Assign all privacy risk management responsibilities to the internal audit department

B.Develop a separate privacy risk register that is maintained independently from the ERM risk register

C.Adopt the enterprise risk management framework's risk assessment methodology and scales for privacy risk assessments

D.Conduct annual privacy risk assessments separately from the ERM risk assessment cycle

AnswerC

Adopting the ERM framework's methodology and scales ensures that privacy risks are assessed using the same criteria as other risks, enabling consistent prioritization and treatment. This integration allows privacy risks to be compared directly with operational, financial, and strategic risks, facilitating better decision-making and resource allocation. It also promotes a common language for risk across the organization, which enhances communication and collaboration.

Why this answer

Using the ERM framework's risk assessment methodology and scales for privacy risks is critical because it enables consistent evaluation, prioritization, and treatment of privacy risks alongside other organizational risks. This alignment supports integrated risk reporting and decision-making, ensuring that privacy risks receive appropriate attention and resources within the broader risk management context.

Exam trap

The trap here is thinking that privacy risks are unique and require a separate methodology, when in fact using the enterprise risk framework promotes consistency and better integration.

Practice this question →

MCQhard

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

A.Conducting periodic penetration tests.

B.Maintaining a comprehensive Record of Processing Activities (ROPA).

C.Updating the external privacy policy annually.

D.Signing NDAs with all employees.

AnswerB

A ROPA documents purposes, categories, recipients and retention for every processing activity, providing the demonstrable evidence GDPR Article 30 and the accountability principle demand. It satisfies the stem's mapping requirement by showing, rather than merely asserting, how personal data flows are governed across the enterprise.

Why this answer

A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

Exam trap

CDPSE often tests the confusion between external transparency documents (privacy policy) and the internal accountability record (ROPA) — the trap is selecting a data-subject-facing artifact instead of the Article 30 processing inventory.

How to eliminate wrong answers

Option A is wrong because penetration tests assess technical security vulnerabilities, not privacy accountability or lawful processing documentation. Option C is wrong because updating the external privacy policy annually is a transparency measure aimed at data subjects, not the internal accountability record regulators examine under Article 5(2). Option D is wrong because NDAs are contractual confidentiality controls for employees and vendors; they do not document processing activities or demonstrate GDPR accountability.

Practice this question →

MCQmedium

A financial services company has a privacy steering committee that meets quarterly. The committee has approved a new privacy policy, but implementation across business units is inconsistent. An internal audit reveals that some units have not adopted the policy, while others have modified it to suit their needs. Which action should the privacy governance team take first to address this issue?

A.Establish a policy implementation and compliance monitoring process with clear deadlines and accountability.

B.Escalate the non-compliant units to the board of directors for disciplinary action.

C.Revise the policy to allow business units to customize it as needed.

D.Conduct a privacy awareness campaign to educate employees about the new policy.

AnswerA

The core problem is inconsistent implementation, which stems from a lack of enforcement and oversight. Establishing a formal implementation process with deadlines, assigned owners, and monitoring ensures that business units adopt the approved policy. This addresses the root cause and aligns with governance best practices for policy management, including communication, training, and compliance checks. It also provides a mechanism to detect and correct deviations.

Why this answer

The inconsistency in policy adoption across business units indicates a lack of implementation oversight. The most effective first step is to establish a formal implementation and compliance monitoring process with clear deadlines and accountability. This ensures that all units adopt the approved policy and provides a mechanism to track and enforce compliance, addressing the root cause rather than treating symptoms.

Exam trap

The trap here is assuming that awareness alone will drive compliance, when in fact policy adoption requires explicit accountability and monitoring mechanisms.

Practice this question →