Isaca Updated CDPSE Exam Questions and Answers by cassie

Authentication is a process of verifying the identity of a user or device that requests access to a system or resource. Authentication can be based on one or more factors, such as something the user knows (e.g., password), something the user has (e.g., token), something the user is (e.g., fingerprint) or something the user does (e.g., signature). When an organization requires a photo on a government-issued identification card to validate an in-person credit card purchase, it is using possession factor authentication, which relies on something the user has as proof of identity. The other options are not applicable in this scenario1, p. 81 References: 1: CDPSE Review Manual (Digital Version)

The primary means by which an organization communicates customer rights as it relates to the use of their personal information is publishing a privacy notice. A privacy notice is a document that informs the customers about how the organization collects, uses, shares, and protects their personal information, and what rights and choices they have regarding their data4. A privacy notice is a legal requirement under many data protection laws and regulations, such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the Personal Information Protection and Electronic Documents Act (PIPEDA)5 . A privacy notice is also a good practice to demonstrate the organization’s commitment to transparency, accountability, and customer trust. References:

• ISACA Glossary of Terms
• Article 13 and 14 of the GDPR
• [Section 1798.100 of the CCPA]
• [Schedule 1, Principle 4.8 of the PIPEDA]
• [ISACA CDPSE Review Manual, Chapter 1, Section 1.3.2]

 Transparency is the most important attribute of a privacy policy because it informs the users about how their personal data is collected, used, shared, and protected by the organization. Transparency also helps to build trust and confidence with the users, and to comply with legal and ethical obligations regarding data privacy.

References:

• ISACA Certified Data Privacy Solutions Engineer Study Guide, Domain 2: Privacy Governance, Task 2.1: Develop and implement privacy policies and procedures, p. 49-50.
• What is a Privacy Policy? | Privacy Policies

Data classification is the process of categorizing data according to its sensitivity, value, and criticality for the organization and the data subjects. Data classification has the greatest impact on the treatment of data within the scope of an organization’s privacy policy, as it determines the appropriate level of protection, access, retention, and disposal for each type of data. Data classification also helps to comply with the privacy principles and regulations, such as data minimization, purpose limitation, accuracy, security, and accountability.

References: CDPSE Review Manual, 2021, p. 80