Which of the following entity in Singapore is not subjected to Singapore’s personal data protection act?

• Central Provident Fund Board

• Singapore Airlines Limited

• Aviva Ltd

• NTUC Income Insurance Co-Operative Limited

Under Singapore’s Personal Data Protection Act, which of the following is not the responsibility of the Data Protection Officer?

• Alert potential risk with regards to the personal data handled internally

• Foster personal data protection culture

• Disclose all sensitive personal data in the company to PDPC

• Ensure PDPA compliance through policies and processes

What is the maximum financial penalty in breaching Singapore’s Personal Data Protection Act for a company with a S$10million annual turnover?

• S$1 million

• S$10,000

• S$500

• There is no financial penalty

What is not personal data in the context of Singapore’s Personal Data Protection Act?

• Business phone number

• NRIC number

• Date of birth

• Gender

Which of the following is true?

• We should collect personal data just in case we need it

• We don’t have to train the users on data protection as long as we have set the policies

• Outsourcing the DPO role is permitted under PDPA

• A company operating in Singapore with personal sensitive data of EU citizens is not subjected to GDPR

What is not an important factor to consider in any cybersecurity protection framework?

• Threats

• Vulnerabilities

• Mitigation of the cybersecurity risk

• Spending whatever it takes to protect the business

In cybersecurity risk assessment, what is not a standard action to take after the identification of the risk?

• Mitigate the risk

• Avoid the risk

• Transfer the risk

• Publicize the risk

All default configurations of a freshly installed operating system will be sufficiently good enough to protect the user data that the server will be holding. True or false?

• True

• False

Which of the following is true?

• We should not consider encryption of emails as an option in data protection as this will increase the latency

• End-point security is not necessary as this takes up storage space on the user device

• Anti-virus signature list need not be updated for up to 2 years

• Security awareness training is one of the most effective way to equip employees with knowledge in data assets protection

Vendor is always trying to sell cybersecurity solutions claiming that their product can prevent all forms of zero-day attack from happening to my organization. Should I believe that?

• Yes, this is the most basic feature

• Yes, these attacks are always minor and consequences negligible

• No, these are newly discovered flaws and protection might not be available

• No, I should see their price first