nerdexam
Isaca

CRISC · Question #105

An organization is participating in an industry benchmarking study that involves providing customer transaction records for analysis Which of the following is the MOST important control to ensure…

The correct answer is B. Data anonymization. Data anonymization is the most important control to ensure customer privacy when sharing transaction records for benchmarking, as it removes or modifies personally identifiable information (PII) so that data cannot be attributed to specific individuals. This allows analysis…

Submitted by ricky.ec· Apr 18, 2026Risk Response and Reporting

Question

An organization is participating in an industry benchmarking study that involves providing customer transaction records for analysis Which of the following is the MOST important control to ensure the privacy of customer information?

Options

  • ANondisclosure agreements (NDAs)
  • BData anonymization
  • CData cleansing
  • DData encryption

How the community answered

(52 responses)
  • A
    12% (6)
  • B
    79% (41)
  • C
    4% (2)
  • D
    6% (3)

Why each option

Data anonymization is the most important control to ensure customer privacy when sharing transaction records for benchmarking, as it removes or modifies personally identifiable information (PII) so that data cannot be attributed to specific individuals. This allows analysis while protecting privacy.

ANondisclosure agreements (NDAs)

Nondisclosure agreements (NDAs) are contractual agreements to protect data but do not technically prevent the re-identification of individuals if the shared data contains PII.

BData anonymizationCorrect

Data anonymization is the process of removing or modifying personally identifiable information (PII) from data sets so that the individuals involved cannot be identified. This is crucial for privacy in benchmarking studies, as it allows the data to be used for analysis without exposing customer identities.

CData cleansing

Data cleansing focuses on identifying and correcting errors or inconsistencies in data, not primarily on removing PII for privacy purposes.

DData encryption

Data encryption protects data confidentiality during transit or storage but can be decrypted by authorized parties, meaning the PII is still present and viewable if accessed.

Concept tested: Data privacy controls: anonymization

Source: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-data-privacy#anonymization-and-pseudonymization

Topics

#Data Privacy#Data Cleansing#Data Sharing#Risk Response

Community Discussion

No community discussion yet for this question.

Full CRISC Practice