CISSP Asset Security Practice Question
An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data minimization
Privacy by design includes data minimization, purpose limitation, and storage limitation among its principles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open data sharing
Why it's wrong here
Privacy by design principles prioritize user control, confidentiality, and strict access governance over unrestricted dissemination. Uncontrolled or open data sharing directly undermines these safeguards by exposing personally identifiable information (PII) to unauthorized third parties without explicit consent or a valid legal basis.
- ✓
Data minimization
Why this is correct
This core privacy principle dictates that organizations must limit the collection of personal data to what is strictly relevant and necessary to accomplish the specified, legitimate processing purposes. By reducing the volume of personally identifiable information (PII) ingested, organizations significantly lower their overall risk profile and potential breach impact.
- ✓
Purpose limitation
Why this is correct
Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those original objectives. This prevents scope creep where user data, once harvested, is repurposed for unauthorized profiling, marketing, or secondary analysis without additional consent.
- ✗
Maximum data retention
Why it's wrong here
Retaining personal data indefinitely or maximizing retention periods increases organizational liability and violates the principle of storage limitation. Keeping data longer than necessary expands the attack surface, making the organization vulnerable to severe regulatory penalties under frameworks like GDPR and CCPA during a data breach.
- ✓
Storage limitation
Why this is correct
Storage limitation mandates that personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Organizations must establish clear retention schedules and implement secure destruction or anonymization protocols once those periods expire.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.