Question 1

Scenario: Bankbio is a financial institution that handles personal data of its customers. Its data processing activities involve processing that is necessary for the legitimate interests pursued by the institution. In such cases, Bankbio processes personal data without obtaining consent from data subjects. Is the data processing lawful under GDPR?

Options :

A :

Yes, processing is lawful when it is necessary for the legitimate interests pursued by the controller, except where such interests are overridden by the interests of fundamental rights.

B :

No, the processing is lawful only if the data subject has given explicit consent to the processing of personal data for the specified purpose.

C :

Yes, GDPR allows the processing of personal data for the legitimate interest pursued by the controller or by a third party in all cases.

D : No, financial institutions must always obtain explicit consent before processing personal data.

Answer: A

Question 2

Scenario 8: MA store is an online clothing retailer founded in 2010. They provide quality products at areasonable cost. One thing that differentiates MA store from other online shopping sites is theirexcellent customer service.MA store follows a customer-centered business approach. They have created a user-friendly websitewith well-organized content that is accessible to everyone. Through innovative ideas and services,MA store offers a seamless user experience for visitors while also attracting new customers. Whenvisiting the website, customers can filter their search results by price, size, customer reviews, andother features. One of MA store's strategies for providing, personalizing, and improving its productsis data analytics. MA store tracks and analyzes the user actions on its website so it can createcustomized experience for visitors.In order to understand their target audience, MA store analyzes shopping preferences of itscustomers based on their purchase history. The purchase history includes the product that wasbought, shipping updates, and payment details. Clients' personal data and other information relatedto MA store products included in the purchase history are stored in separate databases. Personalinformation, such as clients' address or payment details, are encrypted using a public key. Whenanalyzing the shopping preferences of customers, employees access only the information about theproduct while the identity of customers is removed from the data set and replaced with a commonvalue, ensuring that customer identities are protected and cannot be retrieved.Last year, MA store announced that they suffered a personal data breach where personal data ofclients were leaked. The personal data breach was caused by an SQL injection attack which targetedMA stores web application. The SQL injection was successful since no parameterized queries wereused.Based on this scenario, answer the followingHow could MA store prevent the SQL attack described in scenario 8?

Options :

A : Using security measures that support data protection at the database level, such as authorized queries

B : Using cryptographic protocols such as TLS as encryption mechanisms instead of a public key encryption

C : Processing only the data they actually need to achieve processing purposes in database and application servers

Answer: A

Question 3

According to the principle of data minimization, data must be:

Options :

A : In a form which permits the identification of data subjects for no longer than is necessary.

B : Acquired only for specified, explicit, and legitimate purposes.

C : Adequate, relevant, and limited to what is necessary in relation to the purposes of processing.

D : Stored for no more than five years from the date of collection.

Answer: C

Question 4

Under GDPR, the controller must demonstrate that data subjects have consented to the processing of their personal data, and the consent must be freely given. What is the role of the DPO in ensuring compliance with this requirement?

Options :

A : The DPO should ensure that the controller has informed data subjects about their right to withdraw consent.

B : The DPO should ensure that the controller has implemented procedures to provide evidence that consent has been obtained for all relevant personal data.

C : The DPO should personally record information such as who consented, when they consented, and how consent was given

D : The DPO should approve the legal basis for consent processing before the controller can collect personal data.

Answer: B

Question 5

According to the principle of data minimization, data must be:

Options :

A : In a form which permits the identification of data subjects for no longer than is necessary.

B : Acquired only for specified, explicit, and legitimate purposes.

C : Adequate, relevant, and limited to what is necessary in relation to the purposes of processing.

D : Stored for no more than five years from the date of collection.

Answer: C

Free GDPR Mock Exam – Practice Online Confidently

Buying Options: