CDPSE Practice Test 11 — 15 Questions

Question 1

A multinational bank's privacy program is decentralized, with each business unit managing its own privacy risks. The board has expressed concern that this approach may lead to inconsistent risk management and potential regulatory penalties. Which of the following governance mechanisms would BEST address the board's concern while maintaining business unit agility?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Requiring each business unit to report privacy risks to a central privacy office that consolidates and escalates them to the board. A central privacy office that consolidates and escalates risks from business units provides the board with consistent oversight while preserving business unit agility. This governance mechanism ensures that risks are managed consistently, trends are identified, and significant issues are escalated. It balances the need for central accountability with decentralized execution, directly addressing the board's concern about inconsistent risk management and regulatory penalties.

Answer

Mandating that all business units adopt a single, centralized privacy risk management process with no exceptions

Answer

Allowing business units to continue independently but requiring them to certify compliance with privacy regulations annually

Answer

Outsourcing privacy risk management to an external consultancy that reports directly to the board

Question 2

A startup is drafting its first privacy policy. The founders want to ensure the policy reflects the company's commitment to protecting personal data and sets clear expectations for employees. Which element is most essential to include in the policy?

Accepted Answer

A statement of the company's principles for handling personal data, including purpose limitation and data minimization.. A privacy policy's primary role is to establish guiding principles and expectations for how personal data is handled. Including principles like purpose limitation and data minimization provides a clear framework for employees and demonstrates commitment to privacy. Operational details like vendor lists or legal contacts are not essential and can be maintained elsewhere. Guarantees against breaches are unrealistic and legally risky. Therefore, the statement of principles is the most essential element.

Answer

The contact information for the company's external legal counsel.

Answer

A detailed list of all third-party vendors that process personal data on behalf of the company.

Answer

A guarantee that the company will never experience a data breach.

Question 3

A financial services company has a privacy steering committee that meets quarterly. The committee has approved a new privacy policy, but implementation across business units is inconsistent. An internal audit reveals that some units have not adopted the policy, while others have modified it to suit their needs. Which action should the privacy governance team take first to address this issue?

Accepted Answer

Establish a policy implementation and compliance monitoring process with clear deadlines and accountability.. The inconsistency in policy adoption across business units indicates a lack of implementation oversight. The most effective first step is to establish a formal implementation and compliance monitoring process with clear deadlines and accountability. This ensures that all units adopt the approved policy and provides a mechanism to track and enforce compliance, addressing the root cause rather than treating symptoms.

Answer

Escalate the non-compliant units to the board of directors for disciplinary action.

Answer

Revise the policy to allow business units to customize it as needed.

Answer

Conduct a privacy awareness campaign to educate employees about the new policy.

Question 4

A multinational corporation is establishing a privacy governance framework. The Chief Privacy Officer wants to ensure that the framework includes mechanisms for ongoing oversight and accountability. Which TWO of the following are essential governance components for achieving this objective? (Choose two.)

Accepted Answer

A privacy steering committee that meets regularly to review privacy performance and make strategic decisions.. Ongoing oversight and accountability require structural mechanisms. A privacy steering committee provides regular review and strategic direction, while clearly defined roles and responsibilities designate who is accountable for privacy outcomes. Together, these components ensure continuous governance. Training, one-time assessments, and published policies are supportive but do not by themselves establish sustained oversight and accountability.

Answer

An annual privacy training session for all employees.

Answer

A one-time privacy risk assessment conducted at the start of the program.

Answer

A privacy policy that is published on the company website.

Question 5

A global retailer is expanding into new markets and must align its privacy program with multiple regulatory regimes, including the GDPR and the CCPA. The Chief Privacy Officer wants to ensure the program can adapt to future regulatory changes without requiring a complete redesign each time. Which approach best supports this goal?

Accepted Answer

Implement a principles-based privacy framework that maps controls to multiple regulatory requirements and is reviewed periodically.. A principles-based framework provides a stable foundation of privacy principles and maps controls to multiple regulations. When new laws emerge, the organization can update mappings and controls rather than rebuild the program. This scalability and adaptability are essential for a global retailer facing evolving regulatory landscapes, making it the most effective approach for the CPO's goal.

Answer

Delegate privacy compliance to regional legal teams, allowing each to interpret and implement requirements independently.

Answer

Rely on the strictest regulation among all operating jurisdictions and apply its requirements uniformly worldwide.

Answer

Adopt a jurisdiction-specific compliance playbook that is updated whenever a new regulation is enacted.

Question 6

A company is considering the use of a data broker. Which privacy risk is most significant?

Accepted Answer

The lack of visibility into the data broker's consent collection methods.. The most significant privacy risk when using a data broker is the lack of visibility into the broker's consent collection methods. Data brokers often aggregate personal data from various sources without direct interaction with the individuals, making it difficult to ensure that valid consent was obtained for the specific purposes of the broker's activities. This opacity can lead to unlawful processing and privacy violations.

Answer

The broker's physical office location.

Answer

The technical compatibility of the data format.

Answer

The cost of purchasing the data.

Question 7

Which TWO of the following are primary benefits of establishing a mature privacy governance program?

Accepted Answer

Enhanced consumer trust and brand reputation.. Option A is correct because a mature privacy governance program demonstrates accountability and transparency in handling personal data, which directly strengthens consumer trust and enhances brand reputation. Option D is correct because such a program aligns organizational practices with privacy laws and regulations (e.g., GDPR, CCPA), thereby reducing the likelihood and severity of regulatory fines and legal penalties. Option B is not correct because revenue increases are not an automatic or guaranteed outcome of privacy governance; they depend on many business factors. Option C is not correct because privacy governance complements, rather than replaces, the IT department's operational and security responsibilities. Option E is not correct because no governance program can guarantee that data breaches will never occur; it can only reduce risk and improve response readiness.

Answer

Automatic increase in quarterly revenue.

Answer

Elimination of the need for an IT department.

Answer

Guarantee that no data breaches will ever occur.

Question 8

A privacy program manager is updating the organization's privacy governance charter to reflect new regulatory requirements. The charter must define the authority and responsibilities of the privacy office. Which two of the following are essential to include in the charter to ensure the privacy office can effectively enforce compliance? (Choose two.)

Accepted Answer

The privacy office has the authority to approve or reject new data processing activities that pose unacceptable privacy risks.. A governance charter must grant the privacy office both preventive authority (approving or rejecting risky processing) and corrective authority (imposing sanctions). These powers enable the privacy office to enforce compliance effectively and ensure privacy is integrated into business processes. Without them, the privacy office cannot fulfill its oversight role.

Answer

The privacy office is responsible for negotiating all contracts with third-party data processors.

Answer

The privacy office reports directly to the Chief Financial Officer to ensure budget alignment.

Answer

The privacy office must obtain approval from the marketing department before updating privacy policies.

Question 9

A privacy engineer at a health-tech company is designing a new patient portal. The portal must allow patients to view their own records but must prevent them from inferring information about other patients through aggregate queries. Which technical control should be implemented to meet this requirement?

Accepted Answer

Differential privacy applied to aggregate query results.. Differential privacy is designed to protect individual privacy when aggregate statistics are released. By adding noise to query results, it ensures that no single patient's data can be inferred. Role-based access control and encryption do not prevent inference from aggregates, and rate limiting only reduces query volume. Thus, differential privacy is the correct technical control.

Answer

Query rate limiting to prevent excessive queries from a single user.

Answer

Role-based access control (RBAC) that restricts users to their own patient ID.

Answer

Encryption of patient records at rest using AES-256.

Question 10

Which TWO of the following are key components of a robust privacy governance framework?

Accepted Answer

Clear assignment of roles and responsibilities.. Option A is correct because a robust privacy governance framework requires clearly defined roles and responsibilities—such as a Data Protection Officer, privacy stewards, and data owners—so accountability for handling personal data is unambiguous and enforceable. Option E is correct because documented privacy policies and procedures translate legal and regulatory requirements (e.g., GDPR, CCPA) into repeatable operational controls, covering data classification, retention, consent, breach response, and subject-access requests. The unmarked options do not belong: blocking all internet access (B) is an extreme, impractical network control rather than a governance component; the office floor plan (C) is a facilities artifact with no bearing on privacy accountability or process; and collecting employee social media passwords (D) is itself a privacy violation and a security risk, not a governance control.

Answer

A mandate to block all internet access.

Answer

The office floor plan.

Answer

A list of employee social media passwords.

Question 11

A software company uses a CI/CD pipeline to deploy applications to Kubernetes clusters. Developers frequently create ephemeral pods that process customer data for testing. A privacy engineer needs to ensure that personal data is minimized in these ephemeral environments. Which strategy should be implemented?

Accepted Answer

Implement a policy that replaces production personal data with synthetic or anonymized data in test and development environments.. Ephemeral pods in CI/CD pipelines often process real data, creating privacy risks. The most effective minimization is to avoid using production personal data in those environments altogether. Substituting synthetic or anonymized data ensures that even if pods are compromised or persist, no personal data is exposed. Access controls and logging are important but do not reduce the data footprint. Thus, data substitution is the correct strategy for minimization.

Answer

Use Kubernetes secrets to store personal data encrypted at rest within the cluster.

Answer

Enable Kubernetes audit logging to track access to personal data within ephemeral pods.

Answer

Configure pod security policies to restrict pod creation to authorized developers only.

Question 12

A multinational company is evaluating a SaaS solution. As a CDPSE, you must ensure that the vendor's data retention policy aligns with your organization's internal privacy standards. Where should this requirement be formally documented?

Accepted Answer

In the Data Processing Agreement (DPA).. The Data Processing Agreement (DPA) is the formal contract between a data controller and a data processor that specifies how personal data will be processed, including retention periods, deletion obligations, and security measures. Under GDPR Article 28 and similar privacy regulations, the DPA is the legally binding instrument where the vendor's data retention commitments must be documented to align with the organization's privacy standards.

Answer

In the software's 'About' page.

Answer

In the end-user licensing agreement (EULA).

Answer

In the marketing brochure provided by the vendor.

Question 13

Which THREE privacy-enhancing technologies are commonly used to facilitate data analysis on distributed datasets without centralizing the raw PII?

Accepted Answer

Federated Learning. Federated Learning (A) is correct because it trains models locally on each distributed data source and only shares model updates or gradients with a central aggregator, so raw PII never leaves its origin. Secure Multi-Party Computation (B) is correct because it lets multiple parties jointly compute a function over their private inputs while keeping those inputs secret, enabling distributed analysis without pooling raw data. Differential Privacy (C) is correct because it adds calibrated noise or enforces privacy budgets so aggregate statistics and query results can be released without revealing information about any individual record. Full disk encryption (D) is not correct here because it only protects data at rest on a device and does not enable distributed analysis without centralizing raw PII. Network load balancing (E) is not correct because it merely distributes traffic across servers for availability and performance and provides no privacy-preserving computation capability.

Answer

Full disk encryption

Answer

Network load balancing

Question 14

An organization is using 'Bring Your Own Key' (BYOK) in their cloud environment. What is the primary privacy benefit?

Accepted Answer

Control over key lifecycle. BYOK (Bring Your Own Key) lets the customer generate, store, and control the lifecycle of encryption keys used by a cloud provider, rather than letting the provider manage them. The primary privacy benefit is control over key lifecycle — rotation, revocation, and destruction — which directly supports data sovereignty, regulatory compliance, and the ability to render data cryptographically inaccessible (crypto-shredding) when required.

Answer

Faster encryption processing

Answer

Improved data availability

Answer

Reduced storage costs

Question 15

During an audit, it is discovered that privacy policies have not been updated for three years, despite significant changes in business data collection practices. Which governance failure is most evident?

Accepted Answer

Lack of a formal policy review and approval lifecycle.. Privacy policies that remain unchanged for three years while data collection practices evolve indicate that no one owns or triggers a periodic review and approval cycle. A formal policy review and approval lifecycle would have mandated scheduled reviews, version control, and sign-off when business practices changed. This is a governance failure in the policy management process itself, not a resourcing or training issue.

Answer

Insufficient budget for the privacy office.

Answer

Inadequate training for staff on data privacy.

Answer

Failure of the IT department to implement technical controls.