I85PREP
⌘ K
CETP-AUD study materials
CETP-AUD study resources

CETP-AUD practice questions

One question at a time. Build your CETP-AUD understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Audit Planning, Scoping, and Risk Assessment

An audit team is defining the scope of a SOC 2 Type 2 engagement for a SaaS provider. Which element most directly determines the boundaries of the system description?

  1. The total revenue reported in the prior fiscal year
  2. The defined system boundary approved by management and the auditor Correct answer.
  3. The number of employees in the engineering department
  4. The marketing budget allocated to the compliance program

Explanation

Scope for a system-level examination is anchored to the system boundary, which identifies the infrastructure, software, people, procedures, and data that support the service commitments. Management and the auditor agree on this boundary so that the description and testing are limited to defined components. Financial and headcount figures do not define which components are in scope.

Question 2Audit Planning, Scoping, and Risk Assessment

During planning, an auditor reviews the prior year's findings and the entity's risk register. Which activity best illustrates a risk-based approach to scoping?

  1. Choosing controls alphabetically to ensure coverage
  2. Testing every control in the control library equally
  3. Limiting testing to controls requested by the client
  4. Selecting controls for testing based on likelihood and impact of control failure Correct answer.

Explanation

A risk-based approach prioritizes controls whose failure would most likely affect the reliability of the system or the fairness of the description. Likelihood and impact assessments guide where testing effort is concentrated. Uniform or arbitrary selection ignores relative risk and consumes resources inefficiently.

Question 3Audit Planning, Scoping, and Risk Assessment

Which document typically establishes the criteria against which an auditor evaluates the suitability of design and operating effectiveness in a trust services engagement?

  1. The entity's internal travel policy
  2. The vendor's product roadmap
  3. The trust services criteria published by the AICPA Correct answer.
  4. The engagement letter's fee schedule

Explanation

Trust services criteria provide the benchmarks an auditor uses when evaluating whether controls meet the applicable trust services categories. They are the measurement standard against which design and operating effectiveness are judged. Internal policies and commercial documents do not serve this purpose.

Question 4Audit Planning, Scoping, and Risk Assessment

An auditor is planning a readiness assessment before a first-time SOC 2 examination. Which planning task is most appropriate at this stage?

  1. Mapping existing controls to the applicable trust services criteria to identify gaps Correct answer.
  2. Issuing an unqualified opinion on operating effectiveness
  3. Reporting the results to the regulator as a final attestation
  4. Concluding on the fairness of the system description

Explanation

A readiness assessment is a gap-analysis activity that maps current controls to the criteria so management can remediate deficiencies before the examination period begins. It does not produce an opinion or a formal conclusion on the description. Those outputs belong to the examination itself, not the preparatory phase.

Question 5Audit Planning, Scoping, and Risk Assessment

Which factor most strongly suggests that an auditor should increase the extent of testing planned for a particular control?

  1. A recent change in the entity's office furniture vendor
  2. A decrease in the number of customer support tickets
  3. A high rate of exceptions observed in prior periods for that control Correct answer.
  4. An increase in the marketing team's headcount

Explanation

Prior-period exception rates are direct evidence about the control's reliability and signal elevated risk of failure. Higher assessed risk normally leads the auditor to expand sample sizes or test more frequently. Unrelated operational changes do not bear on control risk in the same way.

Question 6Audit Planning, Scoping, and Risk Assessment

What is the primary purpose of obtaining an understanding of the entity and its environment during audit planning?

  1. To replace substantive testing entirely
  2. To identify and assess risks that could affect the reliability of the system description Correct answer.
  3. To satisfy a requirement to interview every employee
  4. To determine the audit fee to charge the client

Explanation

Understanding the entity, its environment, and its internal control helps the auditor identify conditions that could cause the description to be misleading or controls to fail. This understanding feeds directly into risk assessment and the design of further procedures. It is not a pricing or staffing exercise.

Question 7Audit Planning, Scoping, and Risk Assessment

An auditor identifies that a key infrastructure control depends on a third-party hosting provider. How should this dependency be treated in planning?

  1. Increase the audit fee to reflect the third party
  2. Assume the provider's controls are effective without evidence
  3. Exclude the hosting provider from all consideration because it is external
  4. Assess the complementary controls at the provider and consider them in the risk assessment Correct answer.

Explanation

When controls depend on a service organization, the auditor must understand the complementary user entity and subservice organization controls and factor them into risk assessment. Ignoring the dependency or assuming effectiveness without evidence would misstate the control environment. Fee changes are not a substitute for assessing risk.

Question 8Audit Planning, Scoping, and Risk Assessment

Which statement best describes materiality in the context of a SOC 2 examination?

  1. It applies only to financial statement audits and never to trust services
  2. It is determined solely by the entity's annual revenue
  3. It is set by the client without auditor involvement
  4. It concerns whether misstatements or omissions could affect the decisions of report users Correct answer.

Explanation

Materiality focuses on whether a misstatement or omission in the description or in control performance would influence the judgments of intended users. It is a matter of professional judgment informed by the engagement circumstances. It is not a mechanical revenue calculation and is not set unilaterally by the client.

Question 9Audit Planning, Scoping, and Risk Assessment

An auditor is deciding whether to use a sample or test the entire population of a control. Which consideration most supports testing the full population?

  1. The population is small and the control is automated Correct answer.
  2. The control owner prefers full testing
  3. The audit team has extra time available
  4. The control is performed annually by a single person

Explanation

When a population is small, examining every instance may be feasible and provides complete coverage. Automated controls often allow testing of the entire population through system interrogation. Client preference or spare capacity are not valid drivers of testing approach.

Question 10Audit Planning, Scoping, and Risk Assessment

Which of the following best represents an inherent risk in a system that processes payment card data?

  1. The auditor has assigned an experienced engagement team
  2. The nature of the data attracts attackers and increases the likelihood of unauthorized access Correct answer.
  3. The entity has a documented incident response plan
  4. The entity has implemented strong encryption

Explanation

Inherent risk arises from the nature of the activity or data before considering controls. Payment card data is a high-value target, which raises the likelihood of unauthorized access regardless of controls. Strong encryption and documented plans are controls that mitigate, rather than constitute, inherent risk.

Question 11Audit Planning, Scoping, and Risk Assessment

What is the auditor's primary objective when performing a walkthrough during planning?

  1. To confirm understanding of the control's design and how it operates in practice Correct answer.
  2. To calculate the sample size for the entire engagement
  3. To document the client's organizational chart
  4. To obtain conclusive evidence that the control is operating effectively for the period

Explanation

A walkthrough traces a transaction or process from start to finish to confirm the auditor's understanding of design and implementation. It is a planning and understanding procedure, not conclusive evidence of operating effectiveness across a period. Sample size calculations and org charts are separate matters.

Question 12Audit Planning, Scoping, and Risk Assessment

An entity changes its core billing system mid-year. How should the auditor respond in the audit plan?

  1. Delay the audit indefinitely until stability is assured
  2. Ignore the change because the year-end system is what matters
  3. Assess the change's effect on controls and adjust the timing and extent of testing Correct answer.
  4. Rely entirely on the prior year's testing results

Explanation

Significant system changes can alter control design and introduce new risks, so the auditor must evaluate the impact and adjust the nature, timing, and extent of procedures. Ignoring the change or relying on stale prior-year results could miss control failures. Indefinite delay is not a proportionate response.

Question 13Audit Planning, Scoping, and Risk Assessment

Which of the following is the best example of a complementary user entity control?

  1. The customer organization reviews access reports provided by the service organization Correct answer.
  2. The service organization monitors its own network
  3. The service organization performs its own backups
  4. The service organization patches its own servers

Explanation

Complementary user entity controls are responsibilities that customer organizations must perform for the service organization's controls to be effective. Customer review of access reports is a classic example because it requires action by the user entity. Server patching, network monitoring, and backups are controls the service organization performs itself.

Question 14Audit Planning, Scoping, and Risk Assessment

When planning the engagement, why does the auditor consider the entity's service commitments and system requirements?

  1. They eliminate the need to test controls
  2. They replace the need for a system description
  3. They define what the system is designed to achieve and frame the criteria for evaluation Correct answer.
  4. They determine the auditor's hourly billing rate

Explanation

Service commitments and system requirements articulate what the system promises to deliver, and the auditor evaluates whether controls support those commitments. They frame the criteria and the boundaries of testing. They do not affect billing, nor do they remove the need for testing or a description.

Question 15Audit Planning, Scoping, and Risk Assessment

An auditor plans to rely on a control operated by an automated system with effective IT general controls. What is the most appropriate testing strategy?

  1. Test the control once and rely on ITGCs to support consistent operation Correct answer.
  2. Avoid testing the control because it is automated
  3. Test only at year-end regardless of ITGCs
  4. Test a large random sample of transactions manually

Explanation

When automated controls are supported by effective IT general controls, the auditor may test the control's configuration once and rely on the ITGCs to support consistent operation. This is efficient because the logic does not vary between transactions. Manual sampling of every transaction is unnecessary in that circumstance.

Question 16Audit Planning, Scoping, and Risk Assessment

Which planning document typically records the auditor's assessment of risks and the planned responses?

  1. The vendor contract summary
  2. The employee handbook
  3. The client's invoice register
  4. The audit plan or planning memorandum Correct answer.

Explanation

The audit plan or planning memorandum documents identified risks, the auditor's assessment, and the nature, timing, and extent of planned procedures. It serves as the roadmap for the engagement. Client operational and commercial documents do not fulfill this function.

Question 17Audit Planning, Scoping, and Risk Assessment

An auditor discovers that management's risk assessment process does not consider insider threats. What is the most appropriate auditor response?

  1. Treat the gap as a risk factor and expand procedures around access and monitoring controls Correct answer.
  2. Conclude that insider threats are irrelevant to the engagement
  3. Remove access controls from the scope of testing
  4. Accept management's assessment without further consideration

Explanation

A gap in management's risk identification process is itself a risk indicator that warrants expanded auditor attention. The auditor should increase focus on controls that would detect or prevent the overlooked threat. Accepting the omission or narrowing scope would leave a significant risk unaddressed.

Question 18Audit Planning, Scoping, and Risk Assessment

What role does professional skepticism play in audit planning?

  1. It requires the auditor to assume management is dishonest in all cases
  2. It eliminates the need for documented planning
  3. It guarantees that no misstatements will occur
  4. It prompts the auditor to question assumptions and seek corroborating evidence Correct answer.

Explanation

Professional skepticism is an attitude of questioning and critical assessment that leads the auditor to corroborate assertions rather than accept them at face value. It informs the design of procedures and the evaluation of evidence. It is not a presumption of dishonesty and does not remove documentation requirements.

Question 19Audit Planning, Scoping, and Risk Assessment

An auditor is assessing the competence of the engagement team during planning. Which action best reflects this responsibility?

  1. Avoiding specialists to reduce cost
  2. Assigning work randomly to balance workloads
  3. Assigning members with relevant technical skills and arranging specialist involvement where needed Correct answer.
  4. Relying on the client to train the audit team

Explanation

Engagement planning includes ensuring the team has the competence and capabilities needed, including specialists for complex areas. Matching skills to the engagement's risks supports quality. Random assignment or reliance on the client to train auditors undermines independence and competence.

Question 20Audit Planning, Scoping, and Risk Assessment

Which of the following best describes the relationship between the system description and the auditor's scoping decisions?

  1. The description should reflect the same boundary the auditor used for scoping Correct answer.
  2. The description is unrelated to scoping and prepared after testing
  3. The description may include components the auditor excluded without disclosure
  4. The description is written by the auditor alone

Explanation

The system description and the audit scope must be aligned so that what is described is what was examined. Inconsistency between them would mislead report users. Management prepares the description, and excluded components must be addressed rather than silently omitted.

Question 21Audit Planning, Scoping, and Risk Assessment

An auditor plans to test a control at an interim date. What condition best supports this decision?

  1. The control has never been tested before
  2. The client requests interim testing to reduce fees
  3. The auditor has no other engagements scheduled
  4. The control environment is strong and the remaining period is short Correct answer.

Explanation

Interim testing is more defensible when controls are strong and the period remaining after the interim date is short, reducing the risk of undetected changes. The auditor then considers whether to roll forward procedures to period end. Client convenience or scheduling gaps are not valid reasons.

Question 22Audit Planning, Scoping, and Risk Assessment

Which of the following is a key output of the risk assessment phase that shapes the audit program?

  1. A finalized invoice to the client
  2. A list of all employees' job titles
  3. A summary of the client's marketing strategy
  4. A documented linkage between identified risks and planned procedures Correct answer.

Explanation

Risk assessment culminates in a clear linkage between identified risks and the procedures designed to address them, which forms the basis of the audit program. This linkage demonstrates that testing is responsive to risk. Administrative and unrelated documents do not serve this purpose.

Question 23Audit Planning, Scoping, and Risk Assessment

An entity operates in a highly regulated industry with frequent regulatory examinations. How should this affect the auditor's planning?

  1. Disregard regulatory matters because they are outside the audit
  2. Assume regulatory compliance guarantees control effectiveness
  3. Consider regulatory findings and compliance obligations as inputs to risk assessment Correct answer.
  4. Reduce testing because regulators already reviewed the entity

Explanation

Regulatory findings and compliance obligations are relevant inputs to risk assessment because they can reveal control weaknesses and shape the entity's requirements. The auditor uses them to focus procedures, not as a substitute for independent testing. Regulatory review does not eliminate the need for auditor evidence.

Question 24Audit Planning, Scoping, and Risk Assessment

What is the auditor's consideration when the entity's system boundary excludes a component that supports a service commitment?

  1. Expand the boundary without discussing it with management
  2. Ignore the exclusion because it is a management matter
  3. Accept the exclusion because management decides the boundary
  4. Evaluate whether the exclusion is appropriate and whether the description discloses its effect Correct answer.

Explanation

The auditor must evaluate whether an exclusion is appropriate and whether the description clearly communicates its effect to users. Silent exclusions can mislead readers about what was examined. The auditor does not simply accept or unilaterally alter the boundary.

Question 25Audit Planning, Scoping, and Risk Assessment

Which activity is most appropriate for the auditor during the planning phase of a first-year trust services engagement?

  1. Issuing the final report before fieldwork
  2. Reviewing management's readiness materials and prior gap assessments Correct answer.
  3. Relying solely on the client's verbal assurances
  4. Skipping planning because it is a first year

Explanation

In a first-year engagement, readiness materials and prior gap assessments help the auditor understand the control environment and focus risk assessment. Planning remains essential regardless of engagement age. Verbal assurances alone are insufficient evidence.

Question 26Audit Planning, Scoping, and Risk Assessment

During planning, an auditor determines that a service organization's management has never documented its risk assessment process, though managers discuss risks informally. What is the most appropriate audit response?

  1. Treat the absence of documentation as a control deficiency in the risk assessment process and expand testing of related controls. Correct answer.
  2. Postpone all risk assessment work until management produces a formal written policy.
  3. Conclude that risk assessment is outside the system boundary and exclude it from consideration.
  4. Rely on the informal discussions because management asserts that risks are understood.

Explanation

The auditor's own risk assessment must consider whether management identifies and responds to risks, and an undocumented, informal process provides weak evidence that risks are systematically addressed. Because the gap affects the reliability of management's risk identification, the auditor should treat it as a deficiency and broaden procedures over affected controls rather than accepting verbal assurances. Deferring all work is unnecessary because the auditor can still evaluate and test the process as it operates.

Question 27Audit Planning, Scoping, and Risk Assessment

Which factor most directly increases the auditor's assessed risk that a control will fail to operate effectively throughout the examination period?

  1. The control is performed manually and depends heavily on judgment. Correct answer.
  2. The control owner has held the position for many years.
  3. The control was designed with input from process owners.
  4. The control is supported by documented procedures.

Explanation

Manual controls that rely on human judgment carry greater risk of inconsistency, error, and circumvention than automated or highly standardized controls, so the auditor generally plans more extensive testing. Long tenure, written procedures, and owner involvement in design may support reliability rather than undermine it. Risk assessment focuses on what makes failure more likely, and judgment-based manual performance is a primary driver.

Question 28Audit Planning, Scoping, and Risk Assessment

An auditor is defining the scope of a SOC 2 examination and must decide which infrastructure components to include. Which approach best reflects sound scoping judgment?

  1. Exclude any component operated by a vendor because the auditor cannot obtain evidence over it.
  2. Include components that support the services and commitments covered by the examination, documenting the rationale for exclusions. Correct answer.
  3. Include every component the entity owns regardless of whether it supports the services examined.
  4. Include only components that management lists in its marketing materials.

Explanation

Scoping should follow the services and commitments within the examination's boundaries, so the auditor includes supporting infrastructure and documents why any component is excluded. This creates a defensible link between the system description, the criteria, and the evidence gathered. Marketing materials and ownership are not the basis for scope, and vendor-operated components can often be addressed through complementary controls or other procedures.

Question 29Audit Planning, Scoping, and Risk Assessment

What is the primary purpose of establishing an overall engagement materiality level during audit planning?

  1. To set the fee the service organization will be charged.
  2. To guide the nature, timing, and extent of procedures and the evaluation of identified misstatements. Correct answer.
  3. To determine the exact number of samples the auditor must select.
  4. To replace the need for a detailed risk assessment.

Explanation

Materiality provides a threshold that shapes how much and what kind of evidence the auditor gathers and how misstatements are judged at the end of the engagement. It is a planning judgment, not a sampling formula, fee determinant, or substitute for risk assessment. The auditor applies it with professional judgment throughout the engagement.

Question 30Audit Planning, Scoping, and Risk Assessment

An auditor is planning a first-year examination and learns that a significant portion of the entity's processing was migrated to a new platform two months before the period began. How should this history most influence the risk assessment?

  1. It eliminates the need to test general IT controls for the new platform.
  2. It increases risk because limited operating history means controls have not yet demonstrated sustained effectiveness. Correct answer.
  3. It reduces risk because the new platform is presumably more modern than the prior one.
  4. It has no effect because the migration occurred before the examination period started.

Explanation

A recently implemented platform has a short operating history, so the auditor cannot yet assume controls are designed and operating effectively over time, which raises assessed risk and typically expands testing. The timing relative to the period start does not remove the need to evaluate design and implementation. Modern technology is not inherently lower risk, and general IT controls remain relevant regardless of platform age.

Question 31Privacy and Trust Governance, Policies, and Accountability

Which principle requires an organization to collect only the personal data that is necessary for a stated business purpose?

  1. Accountability
  2. Purpose limitation
  3. Storage limitation
  4. Data minimization Correct answer.

Explanation

Data minimization limits collection to what is adequate, relevant, and necessary for the declared purpose. Purpose limitation instead restricts how collected data may be used, and storage limitation governs retention periods.

Question 32Privacy and Trust Governance, Policies, and Accountability

A privacy notice must be written so that a typical customer can understand what happens to their data. Which privacy notice quality does this describe?

  1. Retention-aligned
  2. Plain language Correct answer.
  3. Cross-border
  4. Legally binding

Explanation

Plain-language notices use clear, accessible wording so individuals can make informed choices about their data. Comprehensibility is a core fairness element of transparency obligations.

Question 33Privacy and Trust Governance, Policies, and Accountability

Which role is primarily responsible for deciding why and how personal data is processed?

  1. Supervisory authority
  2. Data subject
  3. Data processor
  4. Data controller Correct answer.

Explanation

The controller determines the purposes and means of processing and therefore carries the primary compliance obligations. Processors act on the controller's documented instructions.

Question 34Privacy and Trust Governance, Policies, and Accountability

What is the main purpose of maintaining a record of processing activities (ROPA)?

  1. To calculate marketing conversion rates
  2. To replace the need for a privacy notice
  3. To advertise the organization's data practices to competitors
  4. To document what data is processed, why, and by whom Correct answer.

Explanation

A ROPA inventories processing operations, purposes, categories of data, recipients, and retention so the organization can demonstrate accountability. It supports audits, impact assessments, and regulator inquiries.

Question 35Privacy and Trust Governance, Policies, and Accountability

An individual asks an organization to delete their account data. Which privacy right does this request exercise?

  1. Right to erasure Correct answer.
  2. Right to portability
  3. Right to restriction
  4. Right to rectification

Explanation

The right to erasure allows individuals to request deletion of personal data in defined circumstances. Rectification corrects inaccurate data, while portability provides a copy in a usable format.

Question 36Privacy and Trust Governance, Policies, and Accountability

Which document defines how an organization handles personal data across its lifecycle and assigns responsibilities?

  1. A privacy policy framework Correct answer.
  2. A service level agreement
  3. An incident response playbook
  4. A marketing style guide

Explanation

A privacy policy framework sets principles, roles, and controls governing personal data throughout collection, use, retention, and disposal. It provides the governance spine for operational procedures.

Question 37Privacy and Trust Governance, Policies, and Accountability

What does the accountability principle require of an organization?

  1. Publishing every internal audit report publicly
  2. Demonstrating compliance with privacy obligations Correct answer.
  3. Obtaining consent for every processing activity
  4. Transferring all risk to third-party vendors

Explanation

Accountability requires the organization to be able to demonstrate that it complies with privacy obligations, through records, policies, training, and monitoring. It is broader than any single mechanism such as consent.

Question 38Privacy and Trust Governance, Policies, and Accountability

A company plans a new analytics feature that profiles customer behavior. Under privacy-by-design, at which stage should privacy requirements be identified?

  1. After the feature launches and complaints arrive
  2. At the first annual audit after launch
  3. During the design and planning phase Correct answer.
  4. Only when a regulator opens an inquiry

Explanation

Privacy by design embeds protections into systems before development, when requirements and risks can shape architecture. Retrofitting controls after launch is costlier and less effective.

Question 39Privacy and Trust Governance, Policies, and Accountability

An organization wants to use existing customer data for a new purpose unrelated to the original collection. What should it do first?

  1. Assess compatibility and identify a lawful basis for the new purpose Correct answer.
  2. Sell the data to a partner to offset costs
  3. Delete the data and restart collection without notice
  4. Proceed because the data is already held

Explanation

Purpose limitation requires that new uses be compatible with the original purpose or supported by a separate lawful basis, often with fresh notice or consent. Reusing held data without assessment breaches that principle.

Question 40Privacy and Trust Governance, Policies, and Accountability

A vendor processes personal data strictly on the instructions of a client organization. Which obligation most clearly falls on the vendor?

  1. Publishing its own privacy notice as controller
  2. Determining the retention period independently
  3. Implementing security measures and assisting with data subject requests Correct answer.
  4. Deciding the business purposes of processing

Explanation

Processors must secure data, act only on documented instructions, and help controllers respond to individual rights requests. Purpose decisions and retention periods remain with the controller.

Question 41Privacy and Trust Governance, Policies, and Accountability

During a privacy impact assessment, a team finds a high risk that cannot be mitigated with available controls. What is the appropriate next step?

  1. Reduce the assessment scope to remove the risk
  2. Document the risk and take no further action
  3. Launch the project and monitor for incidents
  4. Consult the supervisory authority before proceeding Correct answer.

Explanation

When residual risk remains high after mitigation, the organization should consult the regulator before processing. Proceeding without consultation exposes individuals and the organization to harm.

Question 42Privacy and Trust Governance, Policies, and Accountability

A customer requests a copy of their data in a machine-readable format to move to another provider. Which right applies?

  1. Right to data portability Correct answer.
  2. Right to object
  3. Right to restriction
  4. Right of access

Explanation

Portability provides personal data in a structured, commonly used, machine-readable format for transfer. A general access request supplies a copy but does not necessarily enable transmission.

Question 43Privacy and Trust Governance, Policies, and Accountability

An organization receives a deletion request but must retain certain records for a statutory tax obligation. How should it respond?

  1. Delete all records immediately to satisfy the request
  2. Refuse the entire request without explanation
  3. Transfer the retained records to a marketing database
  4. Delete data not legally required and explain the retained records Correct answer.

Explanation

Erasure rights are balanced against legal retention duties, so the organization should erase what it lawfully can and explain the exception. Blanket refusal or over-deletion both misapply the rule.

Question 44Privacy and Trust Governance, Policies, and Accountability

Which control best supports the storage limitation principle in an operational system?

  1. Encrypting backups indefinitely without review
  2. Collecting additional data for future unknown uses
  3. Granting all staff administrator access
  4. Automated deletion schedules tied to retention rules Correct answer.

Explanation

Storage limitation is enforced through defined retention periods and automated deletion or anonymization when those periods end. Retaining data indefinitely or collecting speculative data undermines the principle.

Question 45Privacy and Trust Governance, Policies, and Accountability

A privacy manager is drafting a policy on cross-border transfers. Which element is essential to include?

  1. The company's marketing budget
  2. The office floor plan
  3. The transfer mechanism and required safeguards Correct answer.
  4. A list of employee birthdays

Explanation

Transfer policies must specify the legal mechanism, such as adequacy decisions or contractual clauses, and the safeguards applied. Irrelevant operational details do not support transfer governance.

Question 46Privacy and Trust Governance, Policies, and Accountability

What is the primary purpose of a data processing agreement between a controller and a processor?

  1. To set binding obligations on how the processor handles data Correct answer.
  2. To eliminate the controller's accountability
  3. To allow the processor to sell data freely
  4. To transfer controllership to the processor

Explanation

A data processing agreement binds the processor to documented instructions, security, confidentiality, and assistance duties. Controllership and accountability cannot be contracted away.

Question 47Privacy and Trust Governance, Policies, and Accountability

A privacy team wants to measure whether training reduced risky behavior. Which approach is most appropriate?

  1. Asking only senior managers for their opinions
  2. Tracking metrics such as incident rates and phishing simulation results over time Correct answer.
  3. Recording attendance once and closing the program
  4. Counting the number of slides in the training deck

Explanation

Effective monitoring uses outcome metrics like incident trends and simulation performance to show behavioral change. Input measures such as slide counts or attendance do not demonstrate effectiveness.

Question 48Privacy and Trust Governance, Policies, and Accountability

An organization adopts a privacy framework but never assigns owners or reviews progress. Which governance weakness does this illustrate?

  1. Overly strict retention limits
  2. Lack of operational accountability Correct answer.
  3. Excessive data minimization
  4. Redundant consent capture

Explanation

A framework without owners, milestones, or review lacks operational accountability and will not translate into practice. Governance requires clear responsibility and monitoring.

Question 49Privacy and Trust Governance, Policies, and Accountability

A privacy officer reviews a new vendor contract and finds no clause restricting sub-processors. Why is this a concern?

  1. It guarantees better security controls
  2. It automatically makes the vendor a controller
  3. It removes the need for a data processing agreement
  4. It increases the risk of uncontrolled data handling downstream Correct answer.

Explanation

Without sub-processor restrictions and approval requirements, data may flow to unknown parties with weaker safeguards. Controllers must authorize and monitor the chain of processors.

Question 50Privacy and Trust Governance, Policies, and Accountability

A company applies one global retention period of ten years to all customer data. What is the main privacy problem?

  1. It is too short for any business purpose
  2. It prevents any data from being encrypted
  3. It requires consent from every employee
  4. It ignores purpose-specific necessity and minimization Correct answer.

Explanation

Retention must reflect the necessity of each processing purpose; a single long period keeps data beyond what most purposes require. Uniform periods conflict with storage limitation and minimization.