CDPSE Practice Test 13 — 15 Questions

Question 1

A multinational retailer's privacy program is governed by a central team, but regional marketing teams frequently launch campaigns using local tools that collect personal data. These campaigns often bypass privacy review. The Chief Privacy Officer wants to embed accountability without creating a bottleneck. Which action best addresses this governance gap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a privacy-by-design checklist and automated approval workflow that regional teams must complete before launching campaigns.. Embedding privacy accountability requires distributing responsibility to business units while maintaining central oversight. A privacy-by-design checklist and automated approval workflow enable regional teams to self-assess and document compliance, reducing reliance on central review. This approach scales, provides auditability, and fosters a culture of privacy without creating bottlenecks. It directly addresses the gap where campaigns bypass privacy review by making the process a mandatory step in campaign launch.

Answer

Prohibit regional marketing teams from using any tools not approved by the central privacy team.

Answer

Require all marketing campaigns to be submitted to the central privacy team for manual review before launch.

Answer

Assign a dedicated privacy liaison to each regional marketing team who reports only to the regional marketing director.

Question 2

Which THREE documents are typically required for compliance with global privacy regulations?

Accepted Answer

Data Processing Agreements (DPAs) with third-party vendors.. Option A is correct because Data Processing Agreements (DPAs) are contractually required under regulations such as GDPR Article 28 whenever a controller engages a third-party processor, ensuring the vendor handles personal data lawfully and with appropriate safeguards. Option D is correct because a public-facing privacy notice satisfies transparency obligations under GDPR Articles 13-14 and similar laws (e.g., CCPA/CPRA), informing data subjects about what data is collected, why, and their rights. Option E is correct because a Record of Processing Activities (ROPA) is mandated by GDPR Article 30, documenting purposes, categories of data, recipients, and retention periods to demonstrate accountability. Option B does not belong because a daily log of all staff internet activity is a monitoring practice, not a privacy compliance document, and could itself raise privacy concerns. Option C does not belong because an inventory of company-issued laptops is an asset-management record, not a document required by global privacy regulations.

Answer

A daily log of all staff internet activity.

Answer

A list of all company-issued laptops.

Question 3

A privacy program manager is reviewing the data life cycle for an organization that uses a hybrid cloud environment. The organization wants to ensure that data is properly managed from creation to deletion. Which TWO of the following activities are essential components of a data life cycle management program? (Choose two.)

Accepted Answer

Establishing data retention schedules that specify how long each data type must be kept.. Data life cycle management encompasses policies and procedures for managing data from creation to deletion. Retention schedules define how long data is kept and when it is disposed of, directly supporting storage limitation and disposal. Data classification categorizes data by sensitivity and value, enabling appropriate handling and protection at each phase. Together, these activities form the foundation of a structured life cycle program, while security tools and shared accounts are not core components.

Answer

Deploying a next-generation firewall to block unauthorized external access.

Answer

Using a single shared administrator account for all database management tasks.

Answer

Conducting annual penetration testing of all internet-facing applications.

Question 4

Which TWO metrics are used to measure the effectiveness of data minimization?

Accepted Answer

Reduction in overall data volume. Data minimization effectiveness is measured by how much data an organization stops collecting, storing, or retaining, so option B (Reduction in overall data volume) is correct because shrinking the total amount of stored data directly demonstrates that unnecessary data is being eliminated. Option D (Decrease in records containing PII) is also correct because the core goal of data minimization under privacy frameworks such as GDPR Article 5(1)(c) is to limit personal data to what is strictly necessary, so fewer PII-bearing records is a direct indicator of success. Option A (Database query response time) is a performance metric, not a data-minimization metric, since query speed can improve or degrade independently of how much data is retained. Option C (Increase in storage capacity) is the opposite of minimization and reflects infrastructure growth rather than reduced data footprint. Option E (User satisfaction scores) measures user experience and is unrelated to the volume or sensitivity of data retained.

Answer

Database query response time

Answer

Increase in storage capacity

Answer

User satisfaction scores

Question 5

Which role is primarily responsible for the overall oversight of privacy governance within an organization to ensure that privacy policies are being followed?

Accepted Answer

Data Protection Officer (DPO). The Data Protection Officer (DPO) is the role charged with monitoring compliance with privacy laws and internal policies, advising on data protection obligations, and acting as the point of contact for regulators and data subjects. This oversight mandate — independent of operational IT or finance functions — makes the DPO primarily responsible for ensuring privacy policies are followed. Option C reflects that statutory and governance role.

Answer

Chief Financial Officer (CFO)

Answer

Chief Information Officer (CIO)

Answer

External Legal Counsel

Question 6

Which THREE techniques are commonly used to achieve 'Pseudonymization' for PII in data sets?

Accepted Answer

Partial masking. Partial masking (A) is correct because it replaces part of a PII value with a placeholder (e.g., showing only the last four digits of an account number), which preserves some utility while preventing direct identification and can be reversed only with additional reference data, fitting the pseudonymization goal of replacing direct identifiers with artificial ones. Hashing with a secure salt (C) is correct because a salted cryptographic hash maps an identifier to a consistent pseudonym that supports matching or joins without revealing the original value, and the salt defends against rainbow-table and precomputation attacks. Tokenization (D) is correct because it substitutes a sensitive value with a non-sensitive surrogate token whose mapping to the original data is held in a separate, protected token vault, which is a canonical pseudonymization technique. Data deletion (B) is not pseudonymization because it irreversibly removes the data rather than replacing identifiers, and encryption without key management (E) is not a valid pseudonymization technique since pseudonymization requires controlled re-identification via separately kept keying material, which is absent here.

Answer

Data deletion

Answer

Encryption without key management

Question 7

To ensure that data access logs cannot be tampered with by an administrator with high privileges, which technical control should be implemented?

Accepted Answer

Immutable log storage. Immutable log storage, such as WORM (Write Once Read Many) storage or blockchain-backed logs, ensures that even a privileged administrator cannot alter or delete access logs after they are written. This provides tamper-evidence and tamper-resistance, which is essential for audit integrity. RBAC, encryption at rest, and MFA do not prevent a high-privileged administrator from modifying logs.

Answer

Role-Based Access Control (RBAC)

Answer

Database encryption at rest

Answer

Multi-factor authentication (MFA)

Question 8

A CDPSE practitioner is integrating privacy controls into the SDLC. Which action best ensures privacy by design during the requirements gathering phase?

Accepted Answer

Conducting a privacy impact assessment on functional requirements.. Conducting a privacy impact assessment (PIA) or data protection impact assessment (DPIA) on functional requirements during requirements gathering embeds privacy by design at the earliest point, when changes are cheapest and most effective. It identifies how personal data will be collected, used, shared, and retained before any code is written, allowing privacy requirements to be specified alongside functional ones. This satisfies GDPR Article 25 (data protection by design and by default) and the CDPSE principle of integrating privacy into the SDLC from the start.

Answer

Installing a firewall after code completion.

Answer

Reviewing audit logs after the system launch.

Answer

Performing a DPIA after production deployment.

Question 9

Which THREE items should be included in a Privacy Impact Assessment (PIA) report?

Accepted Answer

Assessment of privacy risks to individuals.. A Privacy Impact Assessment (PIA) report must document the privacy risks that a system or process poses to individuals, so option C (Assessment of privacy risks to individuals) is correct because identifying and evaluating those risks is the core purpose of a PIA. Option D (Description of the personal data being processed) is correct because a PIA must specify what personal data is collected, how it is used, stored, shared, and retained, which is essential for assessing privacy impact. Option E (Proposed mitigation measures for identified risks) is correct because a PIA must recommend controls, such as data minimization, access restrictions, or encryption, to reduce the identified privacy risks. Option A (The cafeteria's weekly menu) is irrelevant to privacy risk analysis and has no bearing on personal data processing. Option B (The names of all employees in the marketing department) is not appropriate because a PIA describes categories of data subjects and data types rather than listing specific employees' names, which would itself create an unnecessary privacy exposure.

Answer

The cafeteria's weekly menu.

Answer

The names of all employees in the marketing department.

Question 10

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

Accepted Answer

An assessment of the necessity and proportionality of the processing.. Option B is correct because a DPIA must include an assessment of the necessity and proportionality of the processing operations in relation to their purpose, as required by GDPR Article 35(7)(b). Option C is correct because Article 35(7)(c) mandates an assessment of the risks to the rights and freedoms of data subjects arising from the processing. Option E is correct because Article 35(7)(a) requires a systematic description of the envisaged processing operations and the purposes of the processing. Option A is not part of a DPIA, as developer salaries are irrelevant to privacy risk analysis and would themselves constitute unnecessary personal data. Option D is not required, since a business continuity plan addresses operational resilience rather than the privacy-specific necessity, proportionality, and risk assessments a DPIA demands.

Answer

A detailed list of the developer team's salaries.

Answer

A copy of the organization's business continuity plan.

Question 11

Which THREE types of data are considered 'sensitive' and require heightened privacy controls?

Accepted Answer

Health and medical records. Health and medical records (A) are sensitive because they contain protected health information (PHI) whose disclosure can cause discrimination or harm, and they are regulated under laws such as HIPAA and GDPR's special categories. Biometric identifiers (B) such as fingerprints, facial geometry, and iris scans are uniquely linked to an individual and are irrevocable if compromised, making them a high-risk category requiring heightened privacy controls. Financial account numbers (C) like bank account, credit card, and routing numbers enable fraud and identity theft, so they are classified as sensitive personal data under standards such as PCI DSS and GLBA. By contrast, an employee internal job title (D) is ordinary workforce metadata with low disclosure risk, and a publicly available business address (E) is already open information that by definition cannot be considered sensitive.

Answer

Employee internal job title

Answer

Publicly available business address

Question 12

What is the first step in creating a data inventory for a privacy program?

Accepted Answer

Identifying and locating the personal data held by the organization.. A data inventory must begin by identifying and locating the personal data the organisation actually holds — across databases, SaaS apps, endpoints, and paper records — because you cannot classify, map, or protect what you have not found. This discovery step produces the raw material for the record of processing activities (RoPA) and data flow maps. Retention schedules, DPO appointment, and policy drafting all depend on knowing what data exists.

Answer

Defining the organization's data retention schedule.

Answer

Appointing a Data Protection Officer.

Answer

Drafting a new privacy policy.

Question 13

Which THREE privacy engineering activities are performed during the 'Maintenance' phase of the system lifecycle?

Accepted Answer

Patching security vulnerabilities. In the Maintenance phase of the system lifecycle, privacy engineering focuses on keeping the deployed system compliant and secure over time. Option B (Patching security vulnerabilities) is correct because applying security patches during maintenance prevents newly discovered exploits from compromising personal data that the system already processes. Option C (Continuous privacy monitoring) is correct because ongoing monitoring detects drift, unauthorized data flows, and emerging privacy risks in a live system, which is a core maintenance activity. Option D (Periodic DPIA review) is correct because a Data Protection Impact Assessment must be revisited when processing changes or new risks arise, and this recurring review belongs to the maintenance phase. Option A (Initial design wireframing) is not correct because wireframing happens during the design phase, before the system is built. Option E (Project budget estimation) is not correct because budgeting is a project management activity typically performed during initiation or planning, not a privacy engineering task in maintenance.

Answer

Initial design wireframing

Answer

Project budget estimation

Question 14

Which TWO of the following should be considered when aligning privacy strategy with broader business objectives?

Accepted Answer

The organization's stated risk appetite.. Option B is correct because the organization's stated risk appetite defines how much privacy risk leadership is willing to accept, and the privacy strategy must be calibrated to that tolerance so that data-protection controls, investments, and residual-risk decisions stay consistent with broader business goals. Option C is correct because applicable legal and regulatory requirements (for example GDPR, CCPA/CPRA, HIPAA, or sector-specific rules) set mandatory privacy obligations that the strategy must satisfy, and aligning them with business objectives ensures compliance is built into operations rather than treated as an afterthought. The remaining options do not belong: A (email font) is a cosmetic branding detail with no bearing on privacy risk or compliance, D (number of employees using public transit) is an irrelevant commuting statistic, and E (breakroom location) is a facilities matter unrelated to privacy strategy or business objectives.

Answer

The specific font used in corporate emails.

Answer

The number of employees who take public transit.

Answer

The physical location of the office breakroom.

Question 15

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

Accepted Answer

Periodic privacy control self-assessments.. Option B (Periodic privacy control self-assessments) is correct because recurring self-assessments evaluate whether implemented privacy controls (e.g., access reviews, retention enforcement) still meet regulatory requirements such as GDPR or CCPA, surfacing gaps before an audit or breach. Option C (Automated data discovery to identify unauthorized PII storage) is correct because tools like data loss prevention (DLP), Microsoft Purview, or BigID scan repositories and endpoints for unclassified or shadow-IT PII, directly detecting non-compliant data handling and enabling remediation. Option D (Regular testing of privacy awareness training) is correct because testing employees via quizzes or phishing-style simulations verifies that training on handling personal data, consent, and breach reporting is effective, which many privacy regulations require as evidence of accountability. Option A is incorrect because blanket blocking of all inbound email is an availability/security measure, not a privacy compliance monitoring activity, and would disrupt legitimate business communications. Option E is incorrect because adjusting executive compensation has no bearing on identifying privacy regulatory non-compliance and is unrelated to monitoring controls or data handling.

Answer

Automated blocking of all inbound email traffic.

Answer

Increasing the executive leadership's salary.