nerdexam
CompTIA

CAS-002 · Question #701

There has been a recent security breach which has led to the release of sensitive customer information. As part of improving security and reducing the disclosure of customer data, a training company…

The correct answer is A. Explain how customer data is gathered, used, disclosed, and managed. Effective privacy compliance training must cover the full data lifecycle - collection, use, disclosure, and management - so staff understand their responsibilities at every stage.

Integration of Computing, Communications and Business Disciplines

Question

There has been a recent security breach which has led to the release of sensitive customer information. As part of improving security and reducing the disclosure of customer data, a training company has been employed to educate staff. Which of the following should be the primary focus of the privacy compliance training program?

Options

  • AExplain how customer data is gathered, used, disclosed, and managed.
  • BRemind staff of the company's data handling policy and have staff sign an NDA.
  • CFocus on explaining the "how" and "why" customer data is being collected.
  • DRepublish the data classification and the confidentiality policy.

How the community answered

(30 responses)
  • A
    87% (26)
  • B
    3% (1)
  • C
    7% (2)
  • D
    3% (1)

Why each option

Effective privacy compliance training must cover the full data lifecycle - collection, use, disclosure, and management - so staff understand their responsibilities at every stage.

AExplain how customer data is gathered, used, disclosed, and managed.Correct

A comprehensive privacy training program must address the entire data lifecycle: how data is gathered, the purposes for which it is used, the conditions under which it is disclosed, and how it is managed and protected. This holistic approach ensures staff understand their obligations at every point of contact with customer data, which directly reduces the risk of improper handling that leads to breaches. Covering only one phase (collection) or only republishing documents fails to build the behavioral understanding needed for compliance.

BRemind staff of the company's data handling policy and have staff sign an NDA.

Having staff sign an NDA and review the data handling policy addresses legal acknowledgment but does not educate staff on the practical steps required to protect customer data.

CFocus on explaining the "how" and "why" customer data is being collected.

Explaining only the 'how' and 'why' of data collection is incomplete because it omits staff responsibilities during data use, disclosure, and retention or deletion.

DRepublish the data classification and the confidentiality policy.

Republishing classification and confidentiality policies is a passive administrative action that does not constitute active training or ensure staff can apply the policies correctly.

Concept tested: Privacy compliance training program scope and data lifecycle

Source: https://www.nist.gov/privacy-framework

Topics

#privacy compliance#data handling#security training#breach response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice