Die PECB Certified Data Protection Officer Prüfung gilt als anspruchsvoll, und viele Kandidaten unterschätzen das Niveau der GDPR Fragen. Die 84 Praxisfragen von ExamFragen zeigen Ihnen realistisch, was Sie im Prüfungsraum erwartet.

PECB GDPR Prüfungsübersicht:

Zertifizierungsanbieter:	PECB
Prüfungsname:	PECB-zertifizierter Datenschutzbeauftragter
Prüfungsnummer:	CDPO
Anzahl der Fragen:	80
Gültigkeitsdauer des Zertifikats:	3 Jahre
Prüfungsdauer:	180 Minuten
Verfügbare Sprachen:	Französisch, Spanisch, Englisch
Prüfungsgebühr:	USD 500
Verwandte Zertifizierungen:	PECB Certified Data Protection Officer (CDPO)
Prüfungsformat:	Mehrfachauswahl
Mindestpunktzahl:	70 %
Beispielfragen:
Prüfungsmethode:	Online (Fernüberwachung) oder schriftlich bei zugelassenen Prüfungsstellen
Voraussetzungen:	Grundlegendes Verständnis der DSGVO sowie grundlegende Kenntnisse der geltenden datenschutzrechtlichen Anforderungen.
Offizielle Syllabus-URL:	https://pecb.com/en/education-and-certification-for-individuals/pecb-gdpr-certified-data-protection-officer

PECB GDPR Prüfungsthemen:

FAQ rund um die GDPR Zertifizierungsprüfung

PECB Certified Data Protection Officer GDPR Prüfungsfragen mit Lösungen

Frage #1

Scenario3:
COR Bank is an international banking group that operates in 31 countries. It was formed as the merger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions.
Therefore, they process large information, including clients' personal data. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Basedon the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments, including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following question:
Question:
According to scenario 3,Tibko stores archived data on behalf of COR Bank. This means that Tibko is a:

A. Data controller, since they control some of the data from the application processes of COR Bank.
B. Data processor, since they store COR Bank's data based on the purpose and conditions defined by COR Bank.
C. Joint controller with COR Bank, since they archive COR Bank's data and take technical decisions regarding data protection.
D. Independent controller, since Tibko handles data security and storage.

Frage #2

Scenario5:
Recpond is a German employment recruiting company. Their services are delivered globally and include consulting and staffing solutions. In the beginning. Recpond provided its services through an office in Germany. Today, they have grown to become one of the largest recruiting agencies, providing employment to more than 500,000 people around the world. Recpond receives most applications through its website. Job searchers are required to provide the job title and location. Then, a list of job opportunities is provided. When a job position is selected, candidates are required to provide their contact details and professional work experience records. During the process, they are informed that the information will be used only for the purposes and period determined by Recpond. Recpond's experts analyze candidates' profiles and applications and choose the candidates that are suitable for the job position. The list of the selected candidates is then delivered to Recpond's clients, who proceed with the recruitment process. Files of candidates that are not selected are stored in Recpond's databases, including the personal data of candidates who withdraw the consent on which the processing was based. When the GDPR came into force, the company was unprepared.
The top management appointed a DPO and consulted him for all data protection issues. The DPO, on the other hand, reported the progress of all data protection activities to the top management. Considering the level of sensitivity of the personal data processed by Recpond, the DPO did not have direct access to the personal data of all clients, unless the top management deemed it necessary. The DPO planned the GDPR implementation by initially analyzing the applicable GDPR requirements. Recpond, on the other hand, initiated a risk assessment to understand the risks associated with processing operations. The risk assessment was conducted based on common risks that employment recruiting companies face. After analyzing different risk scenarios, the level of risk was determined and evaluated. The results were presented to the DPO, who then decided to analyze only the risks that have a greater impact on the company. The DPO concluded that the cost required for treating most of the identified risks was higher than simply accepting them. Based on this analysis, the DPO decided to accept the actual level of the identifiedrisks. After reviewing policies and procedures of the company. Recpond established a new data protection policy. As proposed by the DPO, the information security policy was also updated. These changes were then communicated to all employees of Recpond.Based on this scenario, answer the following question:
Question:
According to scenario 5, what should Recpond have considered whenassessing the risksrelated toprocessing operations?

A. Risks should be analyzedusing a quantitative approach, sincerisk scenariosmake the evaluation process difficult.
B. Risks should be assessedonly when a supervisory authority requires it.
C. Risks should be identifiedbased on threats and vulnerabilitiesthat the company faces.
D. Risks should beassessed based on the risk-based approachadopted by the DPO.

Frage #3

Scenario:2
Soyled is a retail company that sells a wide range of electronic products from top European brands. It primarily sells its products in its online platforms (which include customer reviews and ratings), despite using physical stores since 2015. Soyled's website and mobile app are used by millions of customers. Soyled has employed various solutions to create a customer-focused ecosystem and facilitate growth. Soyled uses customer relationship management (CRM) software to analyze user data and administer the interaction with customers. The software allows the company to store customer information, identify sales opportunities, and manage marketing campaigns. It automatically obtains information about each user's IP address and web browser cookies. Soyled also uses the software to collect behavioral data, such as users' repeated actions and mouse movement information. Customers must create an account to buy from Soyled's online platforms. To do so, they fill out a standard sign-up form of three mandatory boxes (name, surname, email address) and a non-mandatory one (phone number). When the user clicks the email address box, a pop-up message appears as follows: "Soyled needs your email address to grant you access to your account and contact you about any changes related to your account and our website. For further information, please read our privacy policy.' When the user clicks the phone number box, the following message appears: "Soyled may use your phone number to provide text updates on the order status. The phone number may also be used by the shipping courier." Once the personal data is provided, customers create a username and password, which are used to access Soyled's website or app. When customers want to make a purchase, they are also required to provide their bank account details. When the user finally creates the account, the following message appears: "Soyled collects only the personal data it needs for the following purposes: processing orders, managing accounts, and personalizing customers' experience. The collected data is shared with our network and used for marketing purposes." Soyled uses personal data to promote sales and its brand. If a user decides to close the account, the personal data is still used for marketing purposes only. Last month, the company received an email from John, a customer, claiming that his personal data was being used for purposes other than those specified by the company. According to the email, Soyled was using the data for direct marketing purposes. John requested details on how his personal data was collected, stored, and processed. Based on this scenario, answer the following question:
Question:
Based on scenario2, is John's request eligible under GDPR?

A. No, data subjects can request access to how their data is being collected but not details about its processing or storage.
B. Yes, data subjects have theright to request detailson how their personal data is collected, stored, and processed.
C. No, because John's data was collected based on legitimate interest.
D. No, data subjects are not eligible to request details on the collection, storage, or processing of their personal data.

Frage #4

Scenario:
Pinky, a retail company,received a requestfrom adata subjectto identify which purchasesthey had madeat differentphysical store locations. However,Pinky does not link purchase records to customer identities, since purchasesdo not require account creation.
Question:
Should Pinkyprocess additional informationfrom customers in order toidentify the data subjectas requested?

A. No, Pinky isnot requiredto process additional information, since the processing of personal data in this case does not require Pinky toidentify the data subject.
B. Yes, Pinky is required to process additional information for the purpose ofexercising the data subject' s rightscovered inArticles 15-21 of GDPR.
C. No, but Pinky must ask the data subject to provide further evidence proving their identity.
D. Yes, Pinky is required tomaintain, acquire, or process additional informationin order to identify the data subject.

Frage #5

Scenario3:
COR Bank is an international banking group that operates in 31 countries. It was formed as the merger of two well-known investment banks in Germany. Their two main fields of business are retail and investment banking. COR Bank provides innovative solutions for services such as payments, cash management, savings, protection insurance, and real-estate services. COR Bank has a large number of clients and transactions.
Therefore, they process large information, including clients' personal data. Some of the data from the application processes of COR Bank, including archived data, is operated by Tibko, an IT services company located in Canada. To ensure compliance with the GDPR, COR Bank and Tibko have reached a data processing agreement Based on the agreement, the purpose and conditions of data processing are determined by COR Bank. However, Tibko is allowed to make technical decisions for storing the data based on its own expertise. COR Bank aims to remain a trustworthy bank and a long-term partner for its clients. Therefore, they devote special attention to legal compliance. They started the implementation process of a GDPR compliance program in 2018. The first step was to analyze the existing resources and procedures. Lisa was appointed as the data protection officer (DPO). Being the information security manager of COR Bank for many years, Lisa had knowledge of the organization's core activities. She was previously involved in most of the processes related to information systems management and data protection. Lisa played a key role in achieving compliance to the GDPR by advising the company regarding data protection obligations and creating a data protection strategy. After obtaining evidence of the existing data protection policy, Lisa proposed to adapt the policy to specific requirements of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of GDPR. Then, Lisa implemented the updates of the policy within COR Bank. To ensure consistency between processes of different departments within the organization, Lisa has constantly communicated with all heads of departments. As the DPO, she had access to several departments,including HR and Accounting Department. This assured the organization that there was a continuous cooperation between them. The activities of some departments within COR Bank are closely related to data protection. Therefore, considering their expertise, Lisa was advised from the top management to take orders from the heads of those departments when taking decisions related to their field. Based on this scenario, answer the following question:
Question:
According to scenario 3,Lisa was appointed as the Data Protection Officer (DPO)of COR Bank. Is this action in compliance with GDPR?

A. No, an external DPO must be contracted when personal data is collected or processed by an organization that is not established in the European Union.
B. Yes, the DPO may be a staff member of the controller or processor or fulfill the tasks based on a service contract.
C. No, Lisa cannot be appointed as a DPO because she was already an information security officer.
D. Yes, the DPO must be a staff member of the controller or processor in all cases when processing includes special categories of data.

Fragen und Antworten: