Fast2testでは、GDPR対策に印刷できるPDF、Desktop Test Engine、Online Test Engineの3形式をご用意しています。PECB Certified Data Protection Officerの84問の練習問題を、自宅でも外出先でもライフスタイルに合わせて学べます。

GDPR試験対策に選べる3つの学習形式

• PDF版：印刷して持ち運べる形式で、専門家が作成した内容をすぐにダウンロードして確認できます。学習場所を選ばず、365日間の無料更新と無料PDFサンプルに対応しています。
• Desktop Test Engine：インストールして使用するソフトウェアで、実際の試験環境を再現した2つの練習モードを利用できます。オフライン学習に対応し、Windowsで動作します。
• Online Test Engine：ブラウザーからすぐにアクセスでき、学習履歴と成績を確認できます。Windows、Mac、Android、iOSで利用できます。

Fast2testの安心な購入・利用サポート

• McAfeeのセキュリティサービスにより、お客様の情報を安全に取り扱います。
• ご購入後365日間は無料で更新版をご利用いただけます。更新期間の終了後も、50%割引で継続更新が可能です。
• ご入金確認後はすぐにダウンロードでき、通常1分以内にメールでもお届けします。2時間経っても届かない場合は、カスタマーサポートへご連絡ください。
• インストール可能なパソコン台数に制限はありません。

PECB Certified Data Protection Officerの試験情報

PECB GDPR 試験概要:

GDPR試験の出題範囲

PECB GDPR 試験シラバストピック:

PECB Certified Data Protection Officerに関する受験前Q&A

PECB Certified Data Protection Officer 認定 GDPR 試験問題：

問題 #1

Scenario:2
Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number). When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app. When customers want to make a purchase, they are also required to provide their bank account details. When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following question:
Question:
When completing the sign-up form, the user gets a notification about the purpose for which Soyled collects their email address. Is Soyled required by the GDPR to do so?

A. Yes, but only if the email is used for communication purposes beyond account creation.
B. Yes, users must be informed of the purpose of collecting their personal data.
C. No, Soyled should provide this information only when requested by users.
D. No, Soyled only needs to inform users about how their data is collected, stored, or processed.

問題 #2

Why should the controller implement appropriate technical and organizational measures?

A. To maximize the processing of personal data
B. To enable the processor to create and improve security features
C. To allow the data subject to monitor the processing of their personal data

問題 #3

Question:
What is therole of the European Data Protection Board (EDPB)?

A. Tosupervise and monitorthe application of GDPR within the EU.
B. Tonegotiate and adopt EU lawsas per the proposals from the European Commission.
C. Toadvise the European Commissionregarding data protection issues in the EU.
D. Toconduct audits on organizationssuspected of GDPR violations.

問題 #4

Scenario 8:MA store is an online clothing retailer founded in 2010. They provide quality products at a reasonable cost. One thing that differentiates MA store from other online shopping sites is their excellent customer service.
MA store follows a customer-centered business approach. They have created a user-friendly website with well-organized content that is accessible to everyone. Through innovative ideas and services, MA store offers a seamless user experience for visitors while also attracting new customers. When visiting the website, customers can filter their search results by price, size, customer reviews, and other features. One of MA store's strategies for providing, personalizing, and improving its products is data analytics. MA store tracks and analyzes the user actions on its website so it can create customized experience for visitors.
In order to understand their target audience, MA store analyzes shopping preferences of its customers based on their purchase history. The purchase history includes the product that was bought, shipping updates, and payment details. Clients' personal data and other information related to MA store products included in the purchase history are stored in separate databases. Personal information, such as clients' address or payment details, are encrypted using a public key. When analyzing the shopping preferences of customers, employees access only the information about the product while the identity of customers is removed from the data set and replaced with a common value, ensuring that customer identities are protected and cannot be retrieved.
Last year, MA store announced that they suffered a personal data breach where personal data of clients were leaked. The personal data breach was caused by an SQL injection attack which targeted MA store's web application. The SQL injection was successful since no parameterized queries were used.
Based on this scenario, answer the following question:
According to scenario 8, by storing clients' information in separate databases, MA store used a:

A. Data protection by default technology
B. Pseudonymization method
C. Data protection by design strategy

問題 #5

Scenario6:
Bus Spot is one of the largest bus operators in Spain. The company operates in local transport and bus rental since 2009. The success of Bus Spot can be attributed to the digitization of the bus ticketing system, through which clients can easily book tickets and stay up to date on any changes to their arrival or departure time. In recent years, due to the large number of passengers transporteddaily. Bus Spot has dealt with different incidents including vandalism, assaults on staff, and fraudulent injury claims. Considering the severity of these incidents, the need for having strong security measures had become crucial. Last month, the company decided to install a CCTV system across its network of buses. This security measure was taken to monitor the behavior of the company's employees and passengers, enabling crime prevention and ensuring safety and security. Following this decision, Bus Spot initiated a data protection impact assessment (DPIA). The outcome of each step of the DPIA was documented as follows: Step 1: In all 150 buses, two CCTV cameras will be installed. Only individuals authorized by Bus Spot will have access to the information generated by the CCTV system. CCTV cameras capture images only when the Bus Spot's buses are being used. The CCTV cameras will record images and sound. The information is transmitted to a video recorder and stored for 20 days. In case of incidents, CCTV recordings may be stored for more than 40 days and disclosed to a law enforcement body. Data collected through the CCTV system will be processed bv another organization. The purpose of processing this tvoe of information is to increase the security and safety of individuals and prevent criminal activity. Step 2: All employees of Bus Spot were informed for the installation of a CCTV system. As the data controller, Bus Spot will have the ultimate responsibility to conduct the DPIA. Appointing a DPO at that point was deemed unnecessary. However, the data processor's suggestions regarding the CCTV installation were taken into account. Step 3: Risk Likelihood (Unlikely, Possible, Likely) Severity (Moderate, Severe, Critical) Overall risk (Low, Medium, High) There is a risk that the principle of lawfulness, fairness, and transparency will be compromised since individuals might not be aware of the CCTV location and its field of view. Likely Moderate Low There is a risk that the principle of integrity and confidentiality may be compromised in case the CCTV system is not monitored and controlled with adequate security measures.
Possible Severe Medium There is a risk related to the right of individuals to be informed regarding the installation of CCTV cameras. Possible Moderate Low Step 4: Bus Spot will provide appropriate training to individuals that have access to the information generated by the CCTV system. In addition, it will ensure that the employees of the data processor are trained as well. In each entrance of the bus, a sign for the use of CCTV will be displayed. The sign will be visible and readable by all passengers. It will show other details such as the purpose of its use, the identity of Bus Spot, and its contact number in case there are any queries.
Only two employees of Bus Spot will be authorized to access the CCTV system. They will continuously monitor it and report any unusual behavior of bus drivers or passengers to Bus Spot. The requests of individuals that are subject to a criminal activity for accessing the CCTV images will be evaluated only for a limited period of time. If the access is allowed, the CCTV images will be exported by the CCTV system to an appropriate file format. Bus Spot will use a file encryption software to encrypt data before transferring onto another file format. Step 5: Bus Spot's top management has evaluated the DPIA results for the processing of data through CCTV system. The actions suggested to address the identified risks have been approved and will be implemented based on best practices. This DPIA involves the analysis of the risks and impacts in only a group of buses located in the capital of Spain. Therefore, the DPIA will be reconducted for each of Bus Spot's buses in Spain before installing the CCTV system. Based on this scenario, answer the following question:
Question:
Which step of theDPIA methodologydid Bus Spotmisswhen conducting the DPIA?

A. Thealignment with GDPR-defined DPIA guidelines, where it should have adhered to the regulatory framework and methodology outlined by the GDPR.
B. Thesupervisory authority approvalstep, where it should have obtained prior authorization before implementing the CCTV system.
C. The stepdescribing the data processing activities, where it should have detailed thescope, nature, context, and purposes of the processing.
D. Thenecessity and proportionality evaluationstep, where it should have determined thelawful basis for data processing.

解説：