Free Isaca CDPSE Practice Exam with Questions & Answers | Set: 2

Application hardening measures are the most important action to protect a mobile banking app and its data against manipulation and disclosure because they prevent attackers from reverse engineering, tampering, or injecting malicious code into the app. Application hardening measures include techniques such as code obfuscation, encryption, integrity checks, anti-debugging, and anti-tampering mechanisms. These measures make the app more resilient and secure against various types of cyberattacks.

References:

• ISACA Certified Data Privacy Solutions Engineer Study Guide, Domain 3: Privacy Engineering, Task 3.4: Implement privacy engineering techniques to protect data in applications and systems, p. 104-105.
• What is Application Hardening? | Glossary | Digital.ai

Data retention is a process of keeping personal data for a specified period of time for legitimate purposes, such as legal obligations, contractual agreements, business operations or historical records. Data retention should be based on the principle of data minimization, which requires limiting the collection, storage and processing of personal data to what is necessary and relevant for the intended purposes. Data retention should also comply with the principle of storage limitation, which requires deleting or disposing of personal data when it is no longer needed or justified. The most likely valid use case for keeping a customer’s personal data after contract termination is a required retention period due to regulations, such as tax laws, financial laws, health laws or consumer protection laws, that mandate the organization to retain certain types of customer data for a certain period of time after the end of the contractual relationship. The other options are not valid use cases for keeping a customer’s personal data after contract termination, as they do not meet the criteria of necessity, relevance or justification. For the purpose of medical research, the organization would need to obtain the consent of the customer or have another legal basis for processing their personal data for a different purpose than the original contract. A forthcoming campaign to win back customers or ease of onboarding when the customer returns are not legitimate purposes for retaining customer data after contract termination, as they are not related to the original contract and may violate the customer’s privacy rights and preferences. , p. 99-100 References: : CDPSE Review Manual (Digital Version)

The answer is B. Personal data could potentially be exfiltrated through the virtual workspace.

A comprehensive explanation is:

A virtualized workspace is a cloud-based service that provides remote access to a desktop environment, applications, and data. A virtualized workspace can enable software development teams to collaborate and work efficiently across different locations and devices. However, a virtualized workspace also poses significant privacy risks, especially when it is implemented by a third-party provider.

One of the greatest privacy concerns of using a third-party virtualized workspace is the potential for personal data to be exfiltrated through the virtual workspace. Personal data is any information that relates to an identified or identifiable individual, such as name, email, address, phone number, etc. Personal data can be collected, stored, processed, or transmitted by the software development organization or its clients, partners, or users. Personal data can also be generated or inferred by the software development activities or products.

Personal data can be exfiltrated through the virtual workspace by various means, such as:

• Data breaches: A data breach is an unauthorized or unlawful access to or disclosure of personal data. A data breach can occur due to weak security measures, misconfiguration errors, human errors, malicious attacks, or insider threats. A data breach can expose personal data to hackers, competitors, regulators, or other parties who may use it for harmful purposes.
• Data leakage: Data leakage is an unintentional or accidental transfer of personal data outside the intended boundaries of the organization or the virtual workspace. Data leakage can occur due to improper disposal of devices or media, insecure network connections, unencrypted data transfers, unauthorized file sharing, or careless user behavior. Data leakage can compromise personal data to third parties who may not have adequate privacy policies or practices.
• Data mining: Data mining is the analysis of large and complex data sets to discover patterns, trends, or insights. Data mining can be performed by the third-party provider of the virtual workspace or by other authorized or unauthorized parties who have access to the virtual workspace. Data mining can reveal personal data that was not explicitly provided or intended by the organization or the individuals.

The exfiltration of personal data through the virtual workspace can have serious consequences for the software development organization and its stakeholders. It can result in:

• Legal liability: The organization may face legal actions or penalties for violating the privacy laws, regulations, standards, or contracts that apply to the personal data in each jurisdiction where it operates or serves. For example, the General Data Protection Regulation (GDPR) in the European Union imposes strict obligations and sanctions for protecting personal data across borders.
• Reputational damage: The organization may lose trust and credibility among its clients, partners, users, employees, investors, or regulators for failing to safeguard personal data. This can affect its brand image, customer loyalty, market share, revenue, or growth potential.
• Competitive disadvantage: The organization may lose its competitive edge or intellectual property if its personal data is stolen or misused by its rivals or adversaries. This can affect its innovation capability, product quality, or market differentiation.

Therefore, it is essential for the software development organization to implement appropriate measures and controls to prevent or mitigate the exfiltration of personal data through the virtual workspace. Some of these measures and controls are:

• Data minimization: The organization should collect and process only the minimum amount and type of personal data that is necessary and relevant for its legitimate purposes. It should also delete or anonymize personal data when it is no longer needed or required.
• Data encryption: The organization should encrypt personal data at rest and in transit using strong and standardized algorithms and keys. It should also ensure that only authorized parties have access to the keys and that they are stored securely.
• Data segmentation: The organization should segregate personal data into different categories based on their sensitivity and risk level. It should also apply different levels of protection and access control to each category of personal data.
• Data governance: The organization should establish a clear and comprehensive policy and framework for managing personal data throughout its lifecycle. It should also assign roles and responsibilities for implementing and enforcing the policy and framework.
• Data audit: The organization should monitor and review the activities and events related to personal data on a regular basis. It should also conduct periodic assessments and tests to evaluate the effectiveness and compliance of its privacy measures and controls.
• Data awareness: The organization should educate and train its staff and users on the importance and best practices of protecting personal data. It should also communicate and inform its clients, partners, and regulators about its privacy policies and practices.

The other options are not as great of a concern as option B.

The third-party workspace being hosted in a highly regulated jurisdiction (A) may pose some challenges for complying with different privacy laws and regulations across borders. However it may also offer some benefits such as higher standards of privacy protection and enforcement.

The organization’s products being classified as intellectual property © may increase the value and attractiveness of the personal data related to the products, but it does not necessarily increase the risk of exfiltration of the personal data through the virtual workspace.

The lack of privacy awareness and training among remote personnel (D) may increase the likelihood of human errors or negligence that could lead to exfiltration of personal data through the virtual workspace. However it is not a direct cause or source of exfiltration, and it can be addressed by providing adequate education and training.

References:

• 8 Risks of Virtualization: Virtualization Security Issues1
• Security & Privacy Risks of the Hybrid Work Environment2
• The Risk of Virtualization - Concerns and Controls3
• What is Virtualized Security?4

Following an established privacy framework is the most important step when developing an organizational data privacy program because it provides a structured and consistent approach to identify, assess, and manage privacy risks and compliance obligations. A privacy framework can also help to align the privacy program with the organization’s strategic goals, values, and culture, as well as to communicate and demonstrate the privacy program’s effectiveness to internal and external stakeholders. Some examples of established privacy frameworks are the NIST Privacy Framework, the ISO/IEC 27701:2019, and the AICPA Privacy Maturity Model.

References:

• NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, NIST
• ISO/IEC 27701:2019 Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines, ISO
• Privacy Maturity Model, AICPA

Any organization collecting information about EU residents is required to operate with transparency in collecting and using their personal information. Chapter III of the GDPR defines eight data subject rights that have become foundational for other privacy regulations around the world:

Right to access personal data. Data subjects can access the data collected on them.

One of the privacy requirements related to the rights of data subjects is the right to access, which means that individuals have the right to obtain a copy of their personal data, as well as information about how their data is processed, by whom, for what purposes, and for how long. To meet this requirement, an organization’s technology stack should incorporate features that allow individuals to have direct access to their data, such as self-service portals, dashboards, or applications. This way, individuals can exercise their right to access without relying on intermediaries or manual processes, which can be inefficient, error-prone, or insecure. References: : CDPSE Review Manual (Digital Version), page 137

Pseudonymization is a technique that replaces direct identifiers in a data set with pseudonyms or artificial identifiers that do not reveal the identity of the data subjects. Pseudonymization reduces the linkability of the data set with the original identity of the data subjects and thus enhances the privacy and security of the data. However, pseudonymization is not irreversible and the original identity can be re-established if the pseudonym or key is compromised. Therefore, it is important to keep the identifier separate and distinct from the data it protects and to apply additional security measures to safeguard the identifier. The other options are not relevant to pseudonymization1, p. 74-75 References: 1: CDPSE Review Manual (Digital Version)

The principle of data minimization states that personal data should be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. By using only the data required by the application, the organization can reduce the amount of data that is collected, stored, processed and potentially exposed. This can also help the organization comply with privacy laws and regulations that require data minimization, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

References:

• CDPSE Review Manual, 2021 Edition, ISACA, page 98
• [Data minimization], European Commission

The best time during the secure development life cycle to perform privacy threat modeling is early in the design phase, because this will help identify and mitigate the potential privacy risks and vulnerabilities of the system or application before they become costly or difficult to fix. Privacy threat modeling is a systematic process of analyzing the data flows, assets, actors, and scenarios of a system or application to identify and prioritize the privacy threats and countermeasures12. Performing privacy threat modeling early in the design phase will also help ensure that privacy is built into the system or application from the start, rather than as an afterthought.

References:

• CDPSE Exam Content Outline, Domain 2 – Privacy Architecture (Privacy Architecture Implementation), Task 2: Implement privacy solutions3.
• CDPSE Review Manual, Chapter 2 – Privacy Architecture, Section 2.3 – Privacy Architecture Implementation4.

Asymmetric encryption, also known as public-key encryption, encrypts and decrypts data using two separate yet mathematically connected cryptographic keys. One key is called the public key and can be shared with anyone, while the other key is called the private key and must be kept secret. The public key is used to encrypt the data, and only the corresponding private key can decrypt it. Likewise, the private key can be used to sign the data, and only the corresponding public key can verify it. This method provides confidentiality, integrity, authentication and non-repudiation for data.

References: CDPSE Review Manual, 2021, p. 117

User behavior analytics is a technology that uses data analysis and machine learning to monitor, detect and respond to anomalous or malicious user activities, such as accessing sensitive personal customer information to use for unauthorized purposes. User behavior analytics is the best choice to mitigate this risk, as it would help to identify and prevent insider threats, data breaches, fraud or misuse of data by authorized individuals. User behavior analytics can also help to enforce policies and controls, such as access control, audit trail or data loss prevention. The other options are not as effective as user behavior analytics in mitigating this risk. Email filtering system is a technology that scans and blocks incoming or outgoing emails that contain spam, malware or phishing attempts, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Intrusion monitoring is a technology that monitors and alerts on unauthorized or malicious attempts to access a system or network, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes. Mobile device management (MDM) is a technology that manages and secures mobile devices that are used to access or store organizational data, but it does not address the issue of authorized individuals accessing sensitive personal customer information to use for unauthorized purposes1, p. 92 References: 1: CDPSE Review Manual (Digital Version)