Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

1. A. The applicable privacy legislation
2. B. The quantity of information within the scope of the assessment
3. C. The systems in which privacy-related data is stored
4. D. The organizational security risk profile

Correct Answer: C

Which of the following should be established FIRST before authorizing remote access to a data store containing personal data?

1. A. Privacy policy
2. B. Network security standard
3. C. Multi-factor authentication
4. D. Virtual private network (VPN)

Correct Answer: A