CIPP-E practice questions 271–280

1. Question 271 · 290 in bank

   All of the following will be established by the second Network and Information Security Directive ("NIS2") EXCEPT?

   • ABaseline cybersecurity measures that each covered entity must address.
   • BPowers to inspect, audit, or require information from covered organizations.
   • CA common controls framework that every organization must adopt.
   • DA new network for EU member states to cooperate on large-scale breaches.

   Show answer

   Answer: C

   Next question

2. Question 272 · 290 in bank

   According to the Personal Data Protection Commission’s (PDPC) “Guide to basic data anonymization techniques,” recently adopted by the Spanish Data Protection Agency, which of the following is NOT a valid basic anonymization technique?

   • ASwapping.
   • BGeneralization.
   • CData Adjustment.
   • DAttribute Suppression.

   Show answer

   Answer: C

   Next question

3. Question 273 · 290 in bank

   In the EDPB’s Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, all of the following practices follow from the principles relating to the processing of personal data under EU data protection law EXCEPT?

   • AData ownership allocation.
   • BAccess control management.
   • CFrequent pseudonymization key rotation.
   • DError propagation avoidance along the processing chain.

   Show answer

   Answer: A

   Next question

4. Question 274 · 290 in bank

   According to the European Data Protection Board, controllers responding to a data subject access request can refuse to provide a copy of personal data under certain conditions. Which of the following is NOT one of these conditions?

   • AIf the data subject access request was sent to an employee that is not involved in the processing of such requests.
   • BIf there is such a large amount of data that the controller cannot identify the data subject of the request.
   • CIf the controller is unable to use end-to-end encrypted emails for responding to such requests.
   • DIf the personal data was processed in the past but is no longer at the controller’s disposal at the time of the request.

   Show answer

   Answer: C

   Next question

5. Question 275 · 290 in bank

   A high-ranking employee has his laptop bag stolen in a train station. In addition to the laptop, the bag contained the employee’s ID card, confidential company documents (such as financial information and minutes of board meetings, including participants and their roles), company payment cards, and authorization tokens. As the company's Data Protection Officer, what should be your first action?

   • AInform the appropriate supervisory authority of the breach.
   • BVerify whether the laptop contained personal data and, if so, if it was encrypted.
   • CInform the meeting participants of the breach and provide them with next steps to be taken.
   • DRequest deactivation of the authorization tokens to avoid access to company data, and remotely wipe the laptop.

   Show answer

   Answer: B

   Next question

6. Question 276 · 290 in bank

   According to the European Data Protection Board, if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, which supervisory authority or authorities must be notified?

   • AOnly the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.
   • BOnly one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR’s enforcement regime.
   • CEvery supervisory authority of the EU member states where the controller is offering goods or services.
   • DEvery supervisory authority for which affected data subjects reside in their EU member state.

   Show answer

   Answer: A

   Next question

7. Question 277 · 290 in bank

   Which mechanism, introduced by the GDPR as a means of ensuring both compliance and transparency, allows for the possibility of personal data transfers to third countries under Article 42?

   • AApproved certifications.
   • BBinding corporate rules.
   • CLaw enforcement requests.
   • DStandard contractual clauses.

   Show answer

   Answer: A

   Next question

8. Question 278 · 290 in bank

   A private company has establishments in France, Poland, the United Kingdom and, most prominently, Germany, where its headquarters is established. The company offers its services worldwide. Most of the services are designed in Germany and supported in the other establishments. However, one of the services, a Software as a Service (SaaS) application, was defined and implemented by the Polish establishment. It is also supported by the other establishments. What is the lead supervisory authority for the SaaS service?

   • AThe supervisory authority of Germany at federal level.
   • BThe supervisory authority of Germany at regional level.
   • CThe supervisory authority of the Republic of Poland.
   • DThe supervisory authority of the European Union.

   Show answer

   Answer: C

   Next question

9. Question 279 · 290 in bank

   SCENARIO - Please use the following to answer the next question: Gentle Hedgehog Inc. is a privately owned website design agency incorporated in Italy. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers. Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye s software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in. All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France. Based on the scenario, what are the primary privacy risks of the planned surveillance system?

   • AA Chinese vendor and the monitoring of EU-based employees.
   • BFacial recognition data stored in the cloud and lack of encryption.
   • CExcessive scope of monitoring and lack of legitimate purpose for data collection.
   • DMissing E2EE encryption in the monitoring system and unclear data storage duration.

   Show answer

   Answer: C

   Next question

10. Question 280 · 290 in bank

    SCENARIO - Please use the following to answer the next question: Gentle Hedgehog Inc. is a privately owned website design agency incorporated in Italy. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers. Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye s software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in. All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France. Under what condition could the surveillance system be used on the personal devices of employees?

    • AOnly if the monitoring system is manufactured by a European vendor storing the monitoring data within the EU.
    • BOnly if the employees give valid consent and the monitoring is narrowly limited to their professional tasks.
    • COnly if the cloud that stores the monitoring data is certified by the EDPB as GDPR compliant.
    • DOnly if the employer offers an adequate compensation for using the employee’s devices.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-E practice, question 271. 290 questions available.