CDPSE - Certified Data Privacy Solutions Engineer Privacy Incident Response Questions and Answers — Questions and Answers
Question 1: An analyst detects unusual outbound traffic from a server storing customer PII, suggesting potential data exfiltration. According to the NIST incident response lifecycle, what is the IMMEDIATE next step after this initial detection?
- Notify the affected data subjects and regulatory authorities.
- Isolate the server from the network to prevent further data loss.
- Analyze the event to understand its scope, nature, and impact. (Correct answer)
- Deploy a patch to the vulnerability that allowed the unauthorized access.
Correct answer: Analyze the event to understand its scope, nature, and impact.
According to the NIST incident response lifecycle, the phase immediately following 'Detection' is 'Analysis'. Before taking containment actions like isolating the server or making notifications, the response team must first analyze the event to confirm it is a genuine incident, understand the type and volume of data involved, and assess the potential impact. This analysis informs all subsequent steps, ensuring the response is proportional and effective.
Question 2: An organization is creating its privacy incident response plan. Which of the following components is MOST critical for ensuring a coordinated and effective real-time response during a crisis?
- A predefined communication and escalation matrix with clearly defined roles and responsibilities. (Correct answer)
- A detailed log of all past security incidents and their resolutions.
- A budget pre-approved for post-incident credit monitoring services.
- A complete inventory of all third-party data processors and their contact information.
Correct answer: A predefined communication and escalation matrix with clearly defined roles and responsibilities.
During a high-stress privacy incident, clear communication and established authority are paramount to prevent chaos. A predefined communication and escalation matrix that outlines roles (like an incident commander), responsibilities, and who to contact for specific issues ensures a coordinated, efficient, and timely response. While other elements are important parts of a mature privacy program, the communication and roles matrix is the foundational component for managing the response itself.
Question 3: Under the GDPR, which of the following is the PRIMARY trigger that elevates a privacy incident to a notifiable data breach requiring communication to a supervisory authority within 72 hours?
- The incident was caused by a malicious external actor.
- The incident affected more than 1,000 data subjects.
- The incident is likely to result in a risk to the rights and freedoms of natural persons. (Correct answer)
- The incident involved the accidental disclosure of encrypted personal data.
Correct answer: The incident is likely to result in a risk to the rights and freedoms of natural persons.
According to GDPR Article 33, the core criterion for mandatory notification to the supervisory authority is whether the breach is "likely to result in a risk to the rights and freedoms of natural persons." If the breach is unlikely to pose such a risk, notification is not required. The cause, number of subjects, and type of data are factors in assessing the risk, but the likelihood of risk itself is the legal trigger for notification.
Question 4: A privacy engineer discovers that an internal sales dashboard, which aggregates unanonymized customer data, has been misconfigured and is publicly accessible on the internet. What is the MOST appropriate immediate action to contain this incident?
- Perform a full forensic backup of the dashboard's database.
- Begin identifying which customers' data was exposed.
- Draft a notification letter for the relevant data protection authority.
- Immediately revoke public access and restrict it to authorized personnel. (Correct answer)
Correct answer: Immediately revoke public access and restrict it to authorized personnel.
The primary goal of the containment phase in incident response is to stop the ongoing unauthorized access or disclosure and prevent further damage. Immediately revoking public access directly addresses the cause of the exposure and is the fastest, most effective way to contain the incident. Other actions like analysis (identifying exposed data) and notification preparation are critical but follow immediately after the bleeding has been stopped.
Question 5: Following the complete resolution of a significant data breach, what is the MOST important activity in the post-incident phase of the response lifecycle?
- Conducting a 'lessons learned' review to identify the root cause and improve future responses. (Correct answer)
- Calculating the final financial cost of the incident for insurance purposes.
- Archiving all forensic evidence and documentation related to the incident.
- Delivering a final report on the incident to executive management.
Correct answer: Conducting a 'lessons learned' review to identify the root cause and improve future responses.
The post-incident phase is crucial for continuous improvement and maturing the organization's resilience. Conducting a 'lessons learned' or post-mortem review allows the team to perform a root cause analysis, identify weaknesses in controls or procedures, and implement corrective actions to prevent similar incidents from recurring. This activity provides the greatest long-term value for the privacy program.
Question 6: A database administrator unintentionally runs a script that discloses sensitive employee salary data to a wide group of project managers who are not authorized to view it. The data never left the company's internal network. Which statement BEST describes this event?
- This is a security incident but not a privacy incident because no data was exfiltrated.
- This is a privacy incident because personal data was disclosed to unauthorized individuals. (Correct answer)
- This is not an incident of any kind because the action was unintentional.
- This is a data quality issue that should be handled through a standard IT support ticket.
Correct answer: This is a privacy incident because personal data was disclosed to unauthorized individuals.
A privacy incident is any unauthorized use or disclosure of personal data. It is not limited to external attacks or data leaving the network. In this scenario, the disclosure to unauthorized internal recipients constitutes a breach of confidentiality, making it a privacy incident, regardless of intent. While it is also a security incident, its classification as a privacy incident is key because it involves personal data.
CDPSE - Certified Data Privacy Solutions Engineer Privacy Incident Response Questions and Answers
An analyst detects unusual outbound traffic from a server storing customer PII, suggesting potential data exfiltration.
According to the NIST incident response lifecycle, what is the IMMEDIATE next step after this initial detection?