Data Life Cycle Management

During a data mapping exercise in BigID, you need to identify data that has exceeded its retention period. Which attribute should be used to filter the data inventory?

You are managing Azure Information Protection (AIP) labels. Which action is necessary to ensure that documents classified as 'Highly Confidential' are automatically encrypted?

When establishing a data disposal policy in Informatica Enterprise Data Catalog, what must be configured to ensure the disposal process is auditable?

During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?

In the context of data classification, which metadata field is most critical for determining the disposal date?

When using IBM InfoSphere Information Governance Catalog to map sensitive data, what is the primary purpose of a 'Data Class'?

In the privacy lifecycle, what does the term 'Data Collection' primarily involve?

When using Talend Data Fabric for data life cycle management, what is the function of the 'Data Stewardship' component?

In Snowflake, what is the effect of using a 'Dynamic Data Masking' policy on a column containing PII when a non-authorized user runs a SELECT query?

When using Varonis to identify 'stale' data for minimization, what criteria must be defined to avoid false positives?

You are using AWS Macie to perform a classification scan. Which feature should be configured to notify the privacy team when sensitive data is found?

When managing data retention in Azure Data Lake Storage (ADLS) Gen2, how do you implement a policy that deletes files older than 7 years?

In the context of the data lifecycle, what is the primary benefit of using a 'Data Catalog' tool like Alation?

When conducting a Privacy Impact Assessment (PIA) for a new application, what is the role of 'Data Mapping'?

Which of the following is a key objective of a data retention policy?

When configuring a 'Data Disposal' process, why is it critical to verify the 'Chain of Custody'?

In MongoDB, what is the most effective way to ensure data minimization regarding personally identifiable information?

You are managing data in a Kubernetes environment. What strategy should be used to support data minimization for ephemeral pods?

What is the primary function of a 'Data Inventory' in a privacy program?

In a data warehouse, which technique is most effective for protecting PII during the ETL (Extract, Transform, Load) process while still allowing analytics?

When classifying data for privacy, what does a 'Restricted' label usually signify?

Which TWO methods are commonly used to achieve data minimization in a legacy database?

Which TWO outcomes result from effective data classification?

Which THREE factors should be considered when defining a data retention schedule?

Which TWO metrics are used to measure the effectiveness of data minimization?

Which THREE actions are part of a secure data disposal process?

Which TWO attributes are essential to include in a data mapping register for privacy compliance?

Which TWO activities are involved in the 'data mapping' life cycle phase?

Which TWO technical methods ensure data integrity during the life cycle?

Which THREE types of data are typically targeted for aggressive minimization?

Which THREE components should be included in a data inventory to ensure it is actionable for DSR (Data Subject Request) fulfillment?

Which THREE tasks are associated with 'Data Classification' during the life cycle?

Which TWO options represent common risks when data life cycle management is not implemented?

A hospital's privacy team discovers that backup tapes containing patient records are kept indefinitely because the backup software's retention policy was never configured. The tapes are stored offsite and are not indexed, making it impossible to locate individual records. Which action should the privacy team take FIRST to address this data life cycle risk?

A multinational retailer is implementing a data life cycle management program. The privacy team must ensure that personal data collected in the EU is not retained longer than necessary and that disposal is verifiable. Which two controls are essential to meet these objectives? (Choose two.)

A marketing team wants to use customer email addresses for a new promotional campaign. The privacy office determines that the original consent was limited to order fulfillment. What is the most appropriate action under data life cycle management principles?

A data privacy team is designing a new customer analytics platform. They need to ensure that raw personal data collected for marketing purposes cannot be repurposed for a different incompatible purpose without explicit consent. Which data life cycle management control best enforces this requirement at the point of collection?

A privacy engineer is configuring a data retention schedule for a new cloud-based CRM that stores customer contact details and purchase history. The organization operates in multiple jurisdictions and must ensure that records are kept only for the period necessary for the stated business purpose, after which they are securely deleted. Which of the following should the engineer implement FIRST to align retention with the data life cycle management principle of storage limitation?

A multinational retailer must comply with a data subject's erasure request that spans its on-premises Oracle database, a SaaS CRM, and backups. The privacy team wants to ensure the erasure is technically enforced and auditable across all environments. Which approach best meets this requirement?

A privacy engineer is implementing a data minimization strategy for a microservices application deployed on Kubernetes. The application processes customer payment data in ephemeral pods. The engineer must ensure that sensitive data is not persisted beyond the processing window and that any residual data in the container filesystem is securely removed. Which approach BEST achieves this?

A privacy engineer is configuring an automated data disposal process for a cloud-based CRM. The organization must ensure that when a customer account is deleted, all associated personal data is irreversibly destroyed across all replicas and backups within 30 days, while maintaining an audit trail. Which approach best satisfies these requirements?

A privacy engineer is configuring a new Amazon S3 bucket that will store customer transaction logs containing personal data. The organization's privacy policy requires that data be automatically deleted 90 days after creation to comply with data minimization principles. The engineer needs to implement this requirement with minimal operational overhead. Which solution should the engineer use?

A multinational retailer is implementing a data minimization program for its customer loyalty database. The database contains fields such as full name, email, phone number, date of birth, and purchase history. The privacy team wants to reduce the amount of personal data stored while still enabling targeted marketing campaigns. Which of the following techniques BEST achieves data minimization while preserving analytical utility?

A privacy analyst is reviewing the data life cycle for a new mobile app that collects location data. The analyst needs to ensure that location data is not retained longer than necessary for the app's core functionality. Which data life cycle stage directly addresses this requirement?

A data privacy officer is reviewing the data life cycle for a new mobile application that collects precise geolocation data. The privacy policy states that geolocation data must be retained only for 30 days and then irreversibly anonymized for analytics. The engineering team proposes using a PostgreSQL database and asks for the most technically sound method to achieve irreversible anonymization of the geolocation data after 30 days while preserving its utility for aggregate analysis. Which approach should the privacy officer recommend?

A privacy analyst is reviewing the data life cycle for a mobile health application that collects user heart rate and location data. The company wants to ensure that data is properly disposed of when users delete their accounts. Which of the following is the MOST critical step to include in the disposal process to prevent residual data from remaining in backups and logs?

A healthcare provider is implementing a new patient portal. The privacy officer wants to ensure that when a patient requests correction of their data, the change is propagated to all downstream systems, including the billing and analytics platforms. Which data life cycle management practice is most critical to achieve this?

A multinational retailer stores customer purchase histories in Amazon S3 buckets across three AWS Regions. A new privacy policy mandates that personal data of EU residents must remain within the EU. The data engineering team wants a solution that automatically detects and prevents future cross-border storage of EU personal data without disrupting existing analytics workflows. Which AWS capability should be implemented to meet this requirement?

A financial services company is designing a new data life cycle management policy. The privacy team wants to ensure that data quality is maintained throughout the life cycle, from collection to disposal. Which of the following practices BEST supports data quality during the storage and use phases?

A privacy program manager is designing a data retention schedule for a new SaaS application that processes employee HR data. The schedule must comply with GDPR and other privacy regulations. Which TWO of the following are essential considerations when determining retention periods for different data categories? (Choose two.)

A financial institution is building a data life cycle management program. The privacy team must ensure that personal data is properly governed from creation to disposal. Which two practices are essential for maintaining data quality and compliance throughout the life cycle? (Choose two.)

A healthcare provider uses Microsoft 365 to manage patient records. A privacy officer requires that when a patient record reaches its retention period, it must be reviewed by a compliance officer before permanent deletion. Which Microsoft Purview feature should be configured to meet this requirement?

A privacy analyst is reviewing the data life cycle for a new mobile application that collects user location data. The analyst must ensure that location data is not retained longer than necessary for the app's core functionality, which is providing real-time navigation. Which data life cycle stage is MOST directly concerned with limiting the retention period?

A privacy program manager is reviewing the data life cycle for an organization that uses a hybrid cloud environment. The organization wants to ensure that data is properly managed from creation to deletion. Which TWO of the following activities are essential components of a data life cycle management program? (Choose two.)

A privacy analyst is reviewing the data life cycle for a mobile fitness app that collects user location data. The analyst needs to identify the stage where data is initially collected from users. Which stage of the data life cycle does this represent?

A privacy team is implementing data minimization for a cloud-based CRM system that stores customer PII. The team must ensure that only necessary data is collected and that data is not retained beyond its purpose. Which TWO of the following are technical controls that directly support data minimization? (Choose two.)

A financial services firm is implementing a data life cycle management program. The privacy team wants to ensure that data minimization is applied not only to production databases but also to backup and archival copies. Which two practices should be implemented to achieve data minimization across the entire data life cycle? (Choose two.)

A privacy team is designing a new customer loyalty program. They want to ensure that personal data is not kept longer than necessary and that it is securely destroyed when no longer needed. Which data life cycle management phase directly addresses the secure destruction of personal data?

A privacy analyst is reviewing the data life cycle for a cloud-based HR system that processes employee personal data. The organization must ensure that data minimization is applied during the collection and storage phases. Which two practices should the analyst recommend to achieve data minimization in this scenario? (Choose two.)

A healthcare organization is implementing a data retention policy for electronic health records (EHRs) in a hybrid cloud environment. The policy must ensure that records are retained for the legally required period, then securely disposed of. Which approach best ensures compliance and secure disposal?

A software company uses a CI/CD pipeline to deploy applications to Kubernetes clusters. Developers frequently create ephemeral pods that process customer data for testing. A privacy engineer needs to ensure that personal data is minimized in these ephemeral environments. Which strategy should be implemented?

A multinational corporation uses a data lake to store customer data from various sources. The privacy team wants to implement a data minimization strategy that reduces the attack surface and ensures compliance with global privacy regulations. Which approach best aligns with the principle of data minimization in this context?

A privacy engineer is designing a data life cycle for a new IoT device that collects sensor data, including personal data, and transmits it to a cloud platform. The organization must ensure data integrity throughout the life cycle, from collection to disposal. The engineer is considering several technical controls. Which control best ensures data integrity during transmission and storage?

A privacy analyst is reviewing the data life cycle management process for a healthcare organization. The organization wants to ensure that data is properly managed from creation to disposal. Which TWO of the following are key activities in the data disposal phase? (Choose two.)

A small e-commerce company is creating a data retention schedule for its customer database. The privacy team wants to ensure that customer records are not kept longer than necessary. Which action should be taken first to establish an effective retention schedule?

A global retailer is deploying a new loyalty program that aggregates purchase history, geolocation, and device identifiers across 14 countries. The privacy office must embed privacy controls at the point of collection rather than retrofitting them after the data warehouse is built. Which data life cycle practice best satisfies this requirement?

A financial services firm stores customer transaction records in a primary operational database and replicates them to a disaster recovery site and an analytics sandbox. A customer exercises erasure rights. The privacy engineer must ensure the erasure propagates to all copies without breaking referential integrity in the operational system. Which approach is most appropriate?

A healthcare analytics company is designing a de-identification process for a research dataset derived from patient records. The privacy team must reduce re-identification risk while preserving analytical utility. Which two techniques should be applied to the dataset? (Choose two.)

A marketing team wants to use customer email addresses collected for order fulfillment to send promotional offers. The privacy analyst reviewing the request must apply the principle that governs whether this secondary use is permissible. Which data life cycle principle is most directly implicated?

A multinational manufacturer is retiring a legacy ERP system that contains employee and vendor personal data. The privacy team must dispose of the data in a way that satisfies regulatory obligations while preserving records subject to a legal hold. Which disposal approach is most appropriate?