2 cissp ® Official Study Guide Eighth Edition

C.
Identifying appropriate use and protection of data
D.
Applying security controls to a system
15.
Within the context of the EU GDPR, what is a data processor?
A.
The entity that processes personal data on behalf of the data controller
B.
The entity that controls processing of data
C.
The computing system that processes data
D.
The network that processes data
16.
Your organization has a large database of customer data. To comply with the EU GDPR, 
administrators plan to use pseudonymization. Which of the following 
best
describes 
pseudonymization?
A.
The process of replacing some data with another identifier
B.
The process of removing all personal data
C.
The process of encrypting data
D.
The process of storing data
17.
An organization is implementing a preselected baseline of security controls, but finds that 
some of the controls aren’t relevant to their needs. What should they do?
A.
Implement all the controls anyway.
B.
Identify another baseline.
C.
Re-create a baseline.
D.
Tailor the baseline to their needs.
Refer the following scenario when answering questions 18 through 20.
An organization has a datacenter that processes highly sensitive information and is staffed 
24 hours a day. The datacenter includes email servers, and administrators purge email older 
than six months to comply with the organization’s security policy. Access to the datacenter 
is controlled, and all systems that process sensitive information are marked. Administrators 
routinely back up data processed in the datacenter. They keep a copy of the backups on 
site and send an unmarked copy to one of the company warehouses. Warehouse workers 

---

Review Questions 
193
organize the media by date, and they have backups from the last 20 years. Employees work 
at the warehouse during the day and lock it when they leave at night and over the weekends. 
Recently a theft at the warehouse resulted in the loss of all of the offsite backup tapes. Later, 
copies of their data, including sensitive emails from years ago, began appearing on internet 
sites, exposing the organization’s internal sensitive data.