Privacy management - Chapter 13,12,11,10

Question 1

How should an acceptable use policy be designed?

Accepted Answer

To be clear and concise, without room for interpretation

Question 2

What is a key objective of a security audit?

Accepted Answer

Inspect enterprise records

Question 3

What topics should be covered by a privacy incident response plan?

Accepted Answer

Preparing the organization for incidents and training the PIRT

Question 4

What is the purpose of the SP 800-53 audit and accountability control set?

Accepted Answer

Timestamps, Audit storage capacity, Response to audit processing failures

Question 5

What is a security incident?

Accepted Answer

Event jeopardizing CIA

Question 6

What are the characteristics of negligent behavior?

Accepted Answer

No motive to harm, but a conscious decision to act out of line

Question 7

What is a security audit trail?

Accepted Answer

Time record of activities

Question 8

What is the relationship between asset, threat, vulnerability, and controls in risk management?

Accepted Answer

Assets face threats and vulnerabilities, which are mitigated by controls

Question 9

Which PII details should be recorded?

Accepted Answer

Accessed PII and actions

Question 10

What are the responsibilities of a typical Chief Information Officer (CIO)?

Accepted Answer

Responsible for IT strategy and systems to support business objectives.

Question 11

What is the OASIS privacy management reference model designed for?

Accepted Answer

To guide system design and ensure privacy requirements are met

Question 12

What are some tools used to impact awareness training?

Accepted Answer

Events, promotional materials, briefings, rules of behavior

Question 13

An acceptable use policy is open to interpretation.

Accepted Answer

False

Question 14

How many steps are in the NIST risk management framework?

Accepted Answer

6

Question 15

What is the difference between privacy risk assessment and privacy impact assessment?

Accepted Answer

Risk assessments focus on identifying and assessing risks

Question 16

What is the purpose of a privacy program plan?

Accepted Answer

To maintain assets and govern privacy in the long term.

Question 17

A privacy impact assessment includes a privacy risk assessment.

Accepted Answer

True

Question 18

What are the characteristics of malicious behavior?

Accepted Answer

Intended harm and action to inflict harm on an entity

Question 19

What is the purpose of a privacy awareness program?

Accepted Answer

To educate on concepts and principles of information privacy

Question 20

What skills and training are important for selecting members of a PIRT?

Accepted Answer

Understanding of known threats and vulnerabilities

Question 21

What is the PbD document for software engineers focused on?

Accepted Answer

Ensuring privacy is considered at each step of the SDLC

Question 22

What is privacy threshold analysis?

Accepted Answer

A brief questionnaire to determine if a system requires a PIA

Question 23

What are the four phases of the incident management process?

Accepted Answer

Preparation, Detection and Analysis, Containment, eradication, and recovery

Question 24

Is privacy impact assessment solely focused on identifying and assessing risks in an organization?

Accepted Answer

False

Question 25

How is residual risk defined in the context of security controls implementation?

Accepted Answer

Risk remaining after security controls are in place

Question 26

What is the purpose of retaining in risk management?

Accepted Answer

To make an informed choice to accept the risk

Question 27

What actions should be logged in privacy events?

Accepted Answer

Actions performed on PII

Question 28

Information security governance focuses on strategies and business objectives.

Accepted Answer

True

Question 29

What is the role of a Data Protection Officer (DPO) in an organization?

Accepted Answer

Internal auditor and complaint manager responsible for privacy supervision.

Question 30

What is the responsibility of a Privacy Counsel in an organization?

Accepted Answer

Handling legal matters related to privacy.

Question 31

What should be included in a privacy-specific control set?

Accepted Answer

Non-repudiation, Session Audit

Question 32

What topics should be covered by a privacy audit checklist?

Accepted Answer

Security issues, Information collected from users, Privacy Policy

Question 33

What is the relation of security policy to audits?

Accepted Answer

Compliance with standards

Question 34

What are the responsibilities of a Chief Privacy Officer (CPO)?

Accepted Answer

Developing and implementing policies to protect employee and customer data.

Question 35

What is the concept of an acceptable use policy?

Accepted Answer

Determines acceptable and unacceptable behaviors for users of an IT system

Question 36

What are the steps involved in the NIST risk management framework?

Accepted Answer

Categorize, Select, Implement, Assess, Authorize, Monitor

Question 37

What should go into a PIA report?

Accepted Answer

All of the above

Question 38

Define security audit in simple terms.

Accepted Answer

Review of system records

Question 39

What is the first step in preparing for a PIA?

Accepted Answer

Identify the team

Question 40

What is the role of a CSO/CISO in an organization?

Accepted Answer

Security

Question 41

What is Role-based training

Accepted Answer

Training for users of a specific system or have a specific responsibility

Question 42

What topics should be covered by a privacy incident response plan?

Accepted Answer

Preparing the organization for incidents and training the PIRT

Question 43

What are the four levels of the cybersecurity learning continuum?

Accepted Answer

Awareness, Essentials, Role-based training, Education/certification

Question 44

How many privacy harms are associated with privacy impacts?

Accepted Answer

5

Question 45

What is the relationship between asset, threat, vulnerability, and controls in risk management?

Accepted Answer

Controls are used to reduce vulnerabilities against assets from threats

Privacy management - Chapter 13,12,11,10

Questions 45

Privacy management - Chapter 13,12,11,10

Questions 45