IASDP

What is the primary objective of a risk assessment process?

• To completely eliminate all security risks
• To determine an appropriate security budget and implement optimal protection controls
• To identify all potential threats to an organization
• To punish employees who cause security breaches

In the context of information security, what defines a "threat severity"?

• The number of potential threats
• The magnitude of potential damage a threat event can impose on an organization
• The technical complexity of a potential breach
• The frequency of threat attempts

Which of the following best describes a "vulnerability" in information security?

• An active attack on a system
• A weakness that could be exploited by a threat source
• The total cost of potential security breaches
• The specific methods used by hackers

According to the Data Privacy Act of 2012, companies are required to register with the National Privacy Commission if they:

• Have more than 100 employees
• Process any type of personal information
• Have at least 250 employees or access to personal information of 1,000 people
• Are located in major urban areas

What is the key difference between a data controller and a data processor?

• Data controllers are always government agencies
• Data processors handle more sensitive information
• Data controllers determine the purposes and procedures of data usage, while processors simply process data
• There is no significant difference between the two

In privacy impact assessment, "prejudicial potential" refers to:

• The legal risks of data collection
• An estimation of potential damage from threat consequences
• The likelihood of a data breach
• The cost of implementing privacy controls

What constitutes "consent" under the Data Privacy Law?

• Implied agreement through continued use of a service
• A freely given, specific, informed indication of will to collect or process personal data
• Written permission from a company's legal department
• Verbal agreement with a customer service representative

Which of the following is NOT a power of the National Privacy Commission?

• Monitoring compliance with the Data Privacy Act
• Receiving and resolving complaints
• Directly prosecuting individuals for data privacy violations
• Issuing cease and desist orders

In the cybersecurity learning continuum, what is the purpose of "role-based training"?

• To provide a universal baseline of security concepts
• To develop secure practices for all IT resource users
• To provide knowledge specific to an individual's security responsibilities
• To prepare for advanced cybersecurity certifications

What is a key characteristic of a privacy awareness program?

• It only targets IT staff
• It focuses solely on digital security
• It reaches all employees and covers various topics like physical security and social engineering
• It is a one-time training session