ISACA · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?
Azure Policy definition
SQL Dynamic Data Masking policies
SQL Dynamic Data Masking policies mask sensitive columns at query time for non-privileged users, so PII is obfuscated on SQL targets during integration. Configuring this in Azure Data Factory's sink satisfies the masking requirement, unlike static masking or column-level encryption.
Data Factory Mapping Data Flows
Azure Key Vault access policies
A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?
IAM conditions
Storage Transfer Service
Bucket lock
Cloud DLP de-identification template
A de-identification template defines the transformation rules Cloud DLP applies, such as redaction or tokenisation, so PII is irreversibly altered before external access. This satisfies the stem's requirement for automatic redaction at the bucket, rather than merely detecting or classifying sensitive data.
In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?
Cloud Storage buckets lifecycle policy
Cloud Identity and Access Management
Cloud Logging
Cloud Data Loss Prevention (DLP) API
The Cloud Data Loss Prevention API inspects content and applies infoType detectors to redact or mask PII automatically. Integrating it with Cloud Storage lets uploads be scanned and sensitive fields removed before storage, satisfying the policy requirement.
When implementing Privacy by Design (PbD) in a new mobile application, which TWO of the following are considered proactive technical controls?
Periodic external audits
End-user training
Comprehensive incident response plan
Default privacy settings
Default privacy settings configure the application so the most privacy-protective state applies automatically without user action. This proactive technical control satisfies PbD by embedding protection into system defaults, rather than relying on users to opt out after collection begins.
Data minimization
Data minimisation limits collection to only what the specified purpose requires, embedding privacy into the design before processing begins. This proactive technical control satisfies the PbD requirement by preventing unnecessary personal data from entering the mobile application at all.
A privacy engineer is configuring Azure SQL Database to ensure that sensitive columns containing PII are hidden from non-privileged users. Which feature should be implemented to achieve dynamic data masking?
Always Encrypted
Row-Level Security
Transparent Data Encryption
Dynamic Data Masking
Dynamic Data Masking applies masking rules at query time, returning obfuscated values to non-privileged users while privileged roles see unmasked data. It satisfies the stem's constraint of hiding sensitive PII columns from non-privileged users without altering stored data.
A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?
bucket_acl
versioning_enabled
server_side_encryption_configuration
The `server_side_encryption_configuration` block accepts the `sse_algorithm` argument, which must be set to `aws:kms` to enforce SSE-KMS encryption at rest on an S3 bucket. This satisfies the stem's requirement for Terraform-managed encryption using a KMS key rather than the default AES256.
public_access_block
Want more Privacy Engineering practice?
Practice this domainWhich governance structure is most appropriate for a decentralized organization managing privacy risks?
Hub-and-spoke model with localized privacy champions.
A central privacy function sets policy and standards while embedded champions apply them within each business unit, giving the decentralized structure consistent governance without central bottlenecks, which a purely centralized or fully devolved model cannot deliver.
Ad-hoc committee based on project needs.
Outsourcing all privacy functions.
Centralized command-and-control structure.
Which document should a CDPSE practitioner review first when establishing a new privacy governance program?
The list of current vendors.
The software inventory.
The existing business strategy and risk appetite.
Privacy governance must align with and enable organisational objectives, so the business strategy and stated risk appetite define the boundaries, priorities and tolerance within which the programme is designed. Reviewing these first ensures controls are proportionate and endorsed, rather than drafted in isolation from business direction.
The technical architecture diagram.
A company is moving to a cloud-based SaaS environment. Who retains the primary responsibility for privacy governance?
The individual data subjects.
The Lead Supervisory Authority.
The Data Controller (the company).
Under GDPR-style regimes, the data controller determines purposes and means of processing, so accountability for privacy governance cannot be outsourced to a SaaS provider. The company remains the controller even though the vendor acts as processor, satisfying the stem's cloud-migration constraint.
The Network Infrastructure team.
The Cloud Service Provider (CSP).
When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?
Count of privacy training sessions completed.
Reduction in privacy-related regulatory non-compliance fines.
Privacy programmes are funded through business cases, so demonstrable avoidance of regulatory penalties directly quantifies financial value. Tracking reductions in fines, enforcement actions and remediation costs ties privacy spend to measurable risk reduction that executives and boards can compare against other investments.
Total spend on privacy software tools.
Number of privacy patches applied.
You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?
Conducting periodic penetration tests.
Maintaining a comprehensive Record of Processing Activities (ROPA).
A ROPA documents purposes, categories, recipients and retention for every processing activity, providing the demonstrable evidence GDPR Article 30 and the accountability principle demand. It satisfies the stem's mapping requirement by showing, rather than merely asserting, how personal data flows are governed across the enterprise.
Updating the external privacy policy annually.
Signing NDAs with all employees.
A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?
Incompatible local regulatory mandates.
Local regulatory mandates impose conflicting obligations — differing consent standards, transfer restrictions and retention rules — so a single global policy cannot satisfy every jurisdiction simultaneously. Reconciling these incompatible requirements is the greatest governance challenge for a multinational privacy policy.
Lack of translation services.
Difficulty in choosing a document management system.
Inability to find a privacy officer for every region.
Resistance from the Marketing department.
Want more Privacy Governance practice?
Practice this domainA company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?
Automated archival of location history after one week.
Publicly disclosing the use of geolocation in the privacy policy.
Data minimization by requesting access to precise location only when necessary.
Data minimisation requires collecting only location precision genuinely needed for the stated purpose, so coarse or on-demand access is preferred over continuous precise tracking. This satisfies the first principle to apply, limiting collection before consent, retention or security measures are addressed.
Full encryption of geolocation data in transit.
A CDPSE is auditing a legacy application that stores passwords in plain text. What is the most effective immediate mitigation strategy?
Perform a Data Protection Impact Assessment (DPIA) to document the risk.
Conduct a data breach simulation to see if the vulnerability is exploitable.
Implement an access control list (ACL) to restrict who can see the plain text passwords.
Implement a salted hashing algorithm and re-hash all existing credentials.
Salted hashing converts stored plaintext into irreversible digests, so a breach no longer exposes usable passwords. Re-hashing existing credentials immediately removes the plaintext exposure, satisfying the stem's demand for the most effective immediate mitigation rather than a longer-term redesign.
An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?
Execute a Data Processing Agreement (DPA) that mandates adherence to specific privacy instructions.
Under GDPR Article 28, a controller must have a binding Data Processing Agreement with any processor, imposing documented instructions, confidentiality, security and sub-processor terms. This satisfies the stem's third-party risk constraint by creating enforceable contractual accountability over the CSP's processing.
Perform a penetration test on the CSP's multi-tenant environment.
Verify the CSP's physical data center location to ensure it is within the EU.
Review the CSP's SOC 2 Type II report for general system reliability.
When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?
Request the third party to delete the data until a contract is signed.
Disable the API endpoint connecting to the third party to prevent further data exposure.
Validate that the transfer is supported by an appropriate legal basis and documented in the Records of Processing Activities (ROPA).
Transfers to non-affiliated third parties require a documented lawful basis, such as consent, contract or legitimate interest, plus recording in the ROPA. Validating both satisfies the accountability obligation triggered by the discovery, before any further processing or contractual remediation proceeds.
Immediately notify the supervisory authority of the data transfer.
A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?
A manual email ticketing system for data subject access requests.
Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal.
A consent management platform publishing a 'Do Not Sell' signal captures opt-out choices and transmits them automatically to downstream systems, satisfying CCPA's opt-out requirement without manual processing. This automates the request lifecycle for web visitors.
An automated script that permanently deletes user accounts after 30 days of inactivity.
An internal dashboard for employees to view customer purchase histories.
A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?
Restricting all data transfers to only encrypted tunnels.
Relying on the internal 'Group Privacy Policy' as an adequacy decision.
Implementing Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment (TIA).
SCCs provide enforceable contractual safeguards between exporter and importer, while a TIA assesses whether local surveillance laws undermine those protections. Together they satisfy the post-Schrems II requirement that transfers be governed by supplementary measures, not mere contractual clauses alone.
Self-certification under the U.S. Commerce Department's privacy program.
Want more Privacy Risk Management And Compliance practice?
Practice this domainDuring a data mapping exercise in BigID, you need to identify data that has exceeded its retention period. Which attribute should be used to filter the data inventory?
Data Subject ID
Classification Level
Encryption Status
Retention Expiration Date
Retention Expiration Date directly records when each data asset's mandated retention period lapses, letting BigID filter precisely for records past that threshold. This satisfies the stem's requirement to identify data exceeding its retention period, rather than relying on creation, modification or classification attributes that cannot indicate expiry.
Data Source Type
You are managing Azure Information Protection (AIP) labels. Which action is necessary to ensure that documents classified as 'Highly Confidential' are automatically encrypted?
Modify the Information Rights Management (IRM) template
Configure Protection settings in the Label
Encryption in Microsoft Purview Information Protection is applied through the label's Protection settings, which invoke Azure Rights Management. Without configuring protection on the 'Highly Confidential' label, classification alone applies no encryption, so this setting satisfies the automatic-encryption requirement.
Apply Azure Policy
Enable Auto-Labeling on the Data Source
When establishing a data disposal policy in Informatica Enterprise Data Catalog, what must be configured to ensure the disposal process is auditable?
Retention Period Policy
Delete Flag in Schema
Data Lineage Refresh
Audit Log Configuration
Audit log configuration records who disposed of what, when and under which policy, which is precisely the traceability the auditable disposal process demands. Without it, deletion actions leave no verifiable evidence for reviewers or regulators.
During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?
Ranger Policy Engine
Privacera enforces column-level filtering in Hive through Apache Ranger's policy engine, which intercepts queries and rewrites them to mask or exclude restricted columns. This satisfies the data minimisation constraint by restricting access at query time, rather than duplicating or physically removing the sensitive columns from the underlying Hive table.
SQL Grant Statements
Column Encryption
View-Based Restriction
In the context of data classification, which metadata field is most critical for determining the disposal date?
Data Owner
Retention Start Date
Retention Start Date anchors the retention clock, so the disposal date is calculated by adding the mandated retention period to it. Without this trigger, no defensible deletion date exists; classification alone or creation metadata cannot determine when the retention obligation actually begins.
Encryption Key ID
Classification Label
When using IBM InfoSphere Information Governance Catalog to map sensitive data, what is the primary purpose of a 'Data Class'?
To store physical data
To manage retention policies
To identify and classify sensitive data patterns
A Data Class defines a reusable pattern or rule set that recognises sensitive values, such as national insurance numbers, during automated profiling. It supplies the detection logic that lets InfoSphere classify and tag matching columns, enabling sensitive data to be mapped across sources.
To define user access
Want more Data Life Cycle Management practice?
Practice this domainThe CDPSE exam has 120 questions and must be completed in 210 minutes. The passing score is 450 (scaled 200–800). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Privacy Engineering, Privacy Governance, Privacy Risk Management And Compliance, Data Life Cycle Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official ISACA CDPSE exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.