PECB GDPR Quiz 1 Topic 1 Questions 1-5

Question: 1

Scenario:

A marketing company discovers that an unauthorized party accessed its customer database, exposing 5,000 records containing names, email addresses, and phone numbers. The breach occurred due to a misconfigured server.

Questio n:

To comply with GDPR, which information must the company include in its notification to the supervisory authority?

AA description of the nature of the personal data breach.

BThe approximate number of data subjects and records affected.

CBoth A and B.

DThe identity of the attacker and their potential motive.

Show Answer

Question: 2

Scenario 9: Soin is a French travel agency with the largest network of professional travel agents throughout Europe. They aim to create unique vacations for clients regardless of the destinations they seek. The company specializes in helping people find plane tickets, reservations at hotels, cruises, and other activities.

As any other industry, travel is no exception when it comes to GDPR compliance. Soin was directly affected by the enforcement of GDPR since its main activities require the collection and processing of customers' dat

a. Data collected by Soin includes customer's ID or passport details, financial and payment information, and contact information. This type of data is defined as personal by the GDPR; hence, Soin's data processing activities are built based on customer's consent.

At the beginning, as for many other companies, GDPR compliance was a complicated issue for Soin. However, the process was completed within a few months and later on the company appointed a DPO. Last year, the supervisory authority of France, requested the conduct of a data protection external audit in Soin without an early notice. To ensure GDPR compliance before an external audit was conducted, Soin organized an internal audit. The data protection internal audit was conducted by the DPO of the company. The audit was initiated by firstly confirming the accuracy of records related to all current Soin's data processing activities. The DPO considered that verifying compliance to Article 30 of GDPR would help in defining the data protection internal audit scope. The DPO noticed that not all processing activities of Soin were documented as required by the GDPR. For example, processing activities records of the company did not include a description of transfers of personal data to third countries. In addition, there was no clear description of categories of personal data processed by the company. Other areas that were audited included content of data protection policy, data retention guidelines, how sensitive data is stored, and security policies and practices. The DPO conducted interviews with some employees at different levels of the company. During the audit, the DPO came across some emails sent by Soin's clients claiming that they do not have access in their personal data stored by Soin. Soin's Customer Service Department answered the emails saying that, based on Soin's policies, a client cannot have access to personal data stored by the company. Based on the information gathered, the DPO concluded that there was a lack of employee awareness on the GDPR.

All these findings were documented in the audit report. Once the audit was completed, the DPO drafted action plans to resolve the nonconformities found. Firstly, the DPO created a new procedure which could ensure the right of access to clients. All employees were provided with GDPR compliance awareness sessions. Moreover, the DPO established a document which described the transfer of personal data to third countries and the applicability of safeguards when this transfer is done to an international organization.

Based on this scenario, answer the following Questio n:

Soin's DPO conducted an internal data protection audit. Is this acceptable?

ANo, the role of the DPO is to only assist the company in conducting an internal data protection audit

BNo, only the supervisory authority is responsible for conducting investigations in the form of internal data protection audits

CYes, the DPO can conduct an internal data protection audit as part of monitoring compliance

Show Answer

Question: 3

Scenario:

Bankbio is a financial institution that handles personal data of its customers. Its data processing activities involve processing that is necessary for the legitimate interests pursued by the institution. In such cases, Bankbio processes personal data without obtaining consent from data subjects.

Questio n:

Is the data processing lawful under GDPR?

AYes, processing is lawful when it is necessary for the legitimate interests pursued by the controller, except where such interests are overridden by the interests of fundamental rights.

BNo, the processing is lawful only if the data subject has given explicit consent to the processing of personal data for the specified purpose.

CYes, GDPR allows the processing of personal data for the legitimate interest pursued by the controller or by a third party in all cases.

DNo, financial institutions must always obtain explicit consent before processing personal data.

Show Answer

Question: 4

Scenario:

An organization suffered a personal data breach due to a phishing email attack, which allowed attackers to access employee names, email addresses, and phone numbers.

Questio n:

What could the DPO do to prevent a similar breach from happening again?

AProvide training and awareness sessions on data protection within the organization.

BClassify incidents into categories and take decisions based on this categorization.

CCreate a data breach response plan that includes information on how breaches should be handled.

DBoth A and C.

Show Answer

Question: 5

Which statement below regarding the difference between anonymization and pseudonymization is correct?

AAnonymization is reversible and the original data can be retrieved with the use of a public key encryption, while pseudonymization is not reversible and can be used only for non-identifiable data, such as gender, nationality, and occupation

BAnonymization is not reversible and the original data cannot be attributed to an individual, while pseudonymization is reversible and the original data can be attributed to an individual with the use of additional information

CAnonymization is the process of replacing a portion of the data with a common value to keep the identity of individuals anonymous, whereas pseudonymization is the process of adding mathematical noise to the data

Show Answer

PECB GDPR Quiz:1 Topic:1 Questions:1-5