Isaca Updated CDPSE Exam Questions and Answers by taylor

Before de-identifying data, it is important to determine the categories of personal data collected, such as names, addresses, phone numbers, email addresses, social security numbers, health information, and so on. This will help to identify which data elements are considered identifiers or quasi-identifiers, and which de-identification techniques are appropriate for each category. For example, some data elements may need to be removed completely, while others may be masked, generalized, or perturbed.

References:

• Anonymize and De-identify | Research Data Management
• Data De-identification: An Overview of Basic Terms - ed

The availability of application data flow diagrams is the most significant factor that impacts an organization’s ability to respond to data subject access requests. Data subject access requests are requests made by data subjects to exercise their rights under privacy laws or regulations, such as the right to access, rectify, erase, or port their personal data. To respond to these requests effectively and efficiently, the organization needs to have a clear and accurate understanding of how personal data is collected, processed, stored, shared, and disposed of within its applications and systems. Application data flow diagrams are graphical representations of the data lifecycle that show the sources, destinations, transformations, and dependencies of the data. Having these diagrams readily available helps the organization to locate, retrieve, modify, or delete the personal data in response to the data subject access requests. The other options are less significant or relevant than the availability of application data flow diagrams, as they do not directly affect the organization’s ability to identify and access the personal data.

References: CDPSE Review Manual, 2021, p. 83

Anonymization is a technique that removes or modifies personal data in such a way that it can no longer be attributed to a specific data subject. Anonymization can be achieved by various methods, such as encryption, pseudonymization, aggregation, generalization, etc. When using anonymization techniques to prevent unauthorized access to personal data, the most important consideration to ensure the data is adequately protected is that the key must be kept separate and distinct from the data it protects. The key is a piece of information that is used to reverse the anonymization process and restore the original personal data. The key must be stored and managed in a secure location that is different from where the anonymized data is stored and processed. This way, even if the anonymized data is compromised, the key cannot be accessed or used to re-identify the data subjects. References: : CDPSE Review Manual (Digital Version), page 29

A bug bounty program is an assurance approach that involves offering rewards to external security researchers who find and report vulnerabilities in an API or other software. A bug bounty program can be more effective than other assurance approaches in identifying API vulnerabilities because it leverages the skills, creativity, and diversity of a large pool of ethical hackers who can test the API from different perspectives and scenarios. A bug bounty program can also incentivize continuous testing and reporting of vulnerabilities, which can help improve the security posture of the API over time.

References:

• 10 top API security testing tools, CSO Online
• Bug Bounty Programs: What You Need to Know, ISACA Journal