CDPSE Practice Test 17 — 15 Questions

Question 1

What is the primary function of a 'Data Protection Impact Assessment' (DPIA) from an engineering perspective?

Accepted Answer

To identify privacy risks in system design. A DPIA is a structured engineering and privacy assessment performed during system design to identify, evaluate, and mitigate privacy risks arising from processing personal data. From an engineering perspective, it functions as a design-time control that maps data flows, identifies where PII is collected/processed/stored, and flags risks such as excessive collection or weak safeguards before code is written. It is mandated under GDPR Article 35 for high-risk processing and is fundamentally a risk-identification exercise, not a security test or legal filing.

Answer

To test software security

Answer

To document legal agreements

Answer

To manage budget

Question 2

A privacy program manager at a mid-sized healthcare technology company is drafting the organization's first privacy governance charter. The CEO wants the program to be structured so that a single executive has clear authority and accountability for privacy across all business units, but also wants input from department heads to ensure alignment. Which governance structure best meets these requirements?

Accepted Answer

A centralized model led by a Chief Privacy Officer (CPO) who reports to the CEO, supported by a privacy steering committee composed of department heads.. The CEO requires both a single accountable executive and cross-functional input. A centralized structure led by a CPO who reports to the CEO establishes clear authority and accountability, while a privacy steering committee of department heads provides the collaborative input needed for business alignment. This combination satisfies both governance requirements and reflects established privacy governance practice.

Answer

A federated model where privacy responsibilities are split between the legal department and IT, with no single executive owner.

Answer

A decentralized model where each business unit appoints its own privacy lead who reports to the unit's general manager.

Answer

An outsourced model where an external consulting firm manages the privacy program and reports directly to the board of directors.

Question 3

Which feature in Microsoft Purview Information Protection should be used to automatically identify and classify documents containing credit card numbers as they are created?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview Information Protection can automatically detect sensitive information types such as credit card numbers using built-in or custom sensitive information types (SITs) and apply classification labels at creation or modification. This directly fulfills the requirement to identify and classify documents containing credit card numbers automatically. It is the classification mechanism, not just a protective control.

Answer

eDiscovery search

Answer

Data Loss Prevention (DLP) policy

Answer

Information Rights Management (IRM)

Question 4

When pseudonymizing a database using SHA-256 hashing, what is the most critical requirement to prevent re-identification via brute-force or dictionary attacks?

Accepted Answer

Using a strong, unique salt. A strong, unique salt ensures that identical plaintext values produce different hashes and defeats precomputed rainbow tables and cross-record correlation. For low-entropy inputs like names, SSNs, or email addresses, an unsalted SHA-256 hash is trivially reversible by brute force or dictionary attack because the input space is small; a per-record random salt forces the attacker to attack each record independently, making mass re-identification computationally infeasible.

Answer

Encrypting the hashing algorithm

Answer

Reducing the input entropy

Answer

Truncating the output hash

Question 5

In Snowflake, what is the effect of using a 'Dynamic Data Masking' policy on a column containing PII when a non-authorized user runs a SELECT query?

Accepted Answer

The data is returned in a masked format. Dynamic Data Masking in Snowflake applies a masking policy to a column, so when a non-authorized user queries the column, they see masked data (e.g., asterisks or partial values) instead of the actual PII. The query still succeeds, but the returned data is obfuscated based on the policy.

Answer

The entire row is suppressed

Answer

The query fails due to lack of access

Answer

The data is decrypted before display

Question 6

Which TWO security measures are most effective in protecting against unauthorized access to PII?

Accepted Answer

Requiring multi-factor authentication (MFA) for access to databases containing PII.. Option A is correct because requiring multi-factor authentication (MFA) for access to databases containing PII adds a second verification factor (something you know plus something you have or are), which directly prevents unauthorized access even if a password is compromised through phishing or reuse. Option B is correct because encrypting personal data both in transit (e.g., TLS 1.2/1.3) and at rest (e.g., AES-256) ensures that intercepted network traffic or stolen storage media remain unreadable without the keys, protecting PII confidentiality. Option C is not a security measure at all—removing passwords eliminates authentication and makes unauthorized access trivial. Option D provides only weak physical obscurity and does nothing against remote or insider logical access to PII. Option E, adding help desk staff, has no direct technical effect on preventing unauthorized access to PII.

Answer

Removing all passwords from the system to simplify access.

Answer

Hiding the database server in a locked physical room.

Answer

Increasing the number of help desk staff.

Question 7

When establishing a privacy steering committee, who should be included to ensure organizational support?

Accepted Answer

Senior representatives from Legal, IT, HR, and Marketing.. A privacy steering committee should include senior representatives from key stakeholder groups such as Legal, IT, HR, and Marketing to ensure diverse perspectives and organizational buy-in. This cross-functional representation ensures that privacy decisions consider legal requirements, technical feasibility, employee data, and customer-facing activities. Limiting to one department would miss critical input.

Answer

Only the Human Resources team.

Answer

External consultants only.

Answer

Only the IT staff.

Question 8

A company is moving to a cloud-based SaaS environment. Who retains the primary responsibility for privacy governance?

Accepted Answer

The Data Controller (the company).. In a cloud-based SaaS environment, the Data Controller (the company) retains primary responsibility for privacy governance. Under GDPR, the controller determines the purposes and means of processing personal data and is accountable for compliance, even when using a Cloud Service Provider (CSP) as a processor. The CSP acts on behalf of the controller and provides technical safeguards, but the ultimate responsibility remains with the controller.

Answer

The individual data subjects.

Answer

The Lead Supervisory Authority.

Answer

The Network Infrastructure team.

Answer

The Cloud Service Provider (CSP).

Question 9

Which TWO of the following are common responsibilities of the privacy office?

Accepted Answer

Developing and delivering privacy training.. Option C is correct because the privacy office is responsible for developing and delivering privacy training to employees, ensuring they understand data protection policies, regulations, and best practices. Option D is correct because monitoring privacy compliance—through audits, assessments, and ongoing oversight—is a core function of the privacy office to ensure the organization adheres to privacy laws and internal policies. Option A is incorrect because setting annual sales targets is a sales or executive management responsibility, not a privacy function. Option B is incorrect because writing website code is a software development task, unrelated to privacy office duties. Option E is incorrect because repairing printers is an IT support or facilities task, not a privacy responsibility.

Answer

Setting the company's annual sales targets.

Answer

Writing code for the company website.

Answer

Repairing broken printers.

Question 10

Which TWO of the following are key privacy controls in an AWS environment?

Accepted Answer

Amazon Macie. Amazon Macie (B) is a key privacy control because it uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3, directly supporting data privacy and compliance requirements. AWS Key Management Service (C) is also a key privacy control because it lets you create and manage cryptographic keys and control their use across AWS services, enabling encryption of data at rest and in transit so that sensitive information remains confidential and access is auditable. The other options do not serve as privacy controls: AWS CloudFront (A) is a content delivery network for caching and accelerating content, AWS Auto Scaling (D) dynamically adjusts compute capacity for availability and cost, and AWS Glue Schema Registry (E) manages and validates schemas for streaming data rather than protecting sensitive data privacy.

Answer

AWS CloudFront

Answer

AWS Auto Scaling

Answer

AWS Glue Schema Registry

Question 11

Which TWO features in a cloud IAM configuration help enforce 'Least Privilege' as a privacy control?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is correct because it grants or denies access dynamically based on attributes such as user department, resource tags, or environment, so permissions can be scoped narrowly to only what matches the required context rather than broad role assignments. Just-in-Time (JIT) privileged access is correct because it grants elevated permissions only for a limited time and only when needed, then automatically revokes them, minimizing standing privileges and reducing the attack surface. Together, ABAC and JIT directly support least privilege by limiting both the scope and duration of access. Hardcoding credentials in scripts is wrong because it exposes secrets and creates persistent, over-broad access. Setting all S3 buckets to public is wrong because it removes access controls entirely. Adding all users to the Admin group is wrong because it grants excessive, standing privileges to everyone.

Answer

Hardcoding credentials in scripts

Answer

Setting all S3 buckets to public

Answer

Adding all users to the 'Admin' group

Question 12

Which THREE considerations are critical when implementing 'Anonymization' to ensure it meets the standard of being 'irreversible'?

Accepted Answer

Prevention of inference attacks where attributes can be predicted. Option E is correct because removing all direct identifiers (such as names, social security numbers, email addresses, and account numbers) is the foundational step of anonymization—without it, data remains personally identifiable and reversibility is trivial. Option D is correct because protection against linkage attacks using quasi-identifiers (e.g., ZIP code, birth date, gender) is essential; if quasi-identifiers remain unique or near-unique, an attacker can join the dataset with external data sources to re-identify individuals, making the anonymization reversible. Option A is correct because preventing inference attacks—where sensitive attributes can be predicted from other released attributes—is critical to irreversibility; techniques like k-anonymity, l-diversity, and t-closeness address this by ensuring that sensitive values cannot be inferred with confidence. Option B is not correct because user consent is a legal/privacy compliance requirement (e.g., GDPR) but does not by itself make anonymization irreversible. Option C is not correct because AES-256 encryption is a reversible cryptographic operation; encrypted data can be decrypted with the key, so it does not achieve irreversible anonymization.

Answer

Requirement for user consent

Answer

Encrypting the data with AES-256

Question 13

Which THREE of the following are considered standard 'Privacy-Enhancing Technologies' (PETs) used for data protection in analytics?

Accepted Answer

Differential Privacy. Differential Privacy (B) is a canonical PET because it adds calibrated noise (e.g., Laplace or Gaussian mechanisms) to query results so that individual records cannot be distinguished, while aggregate analytics remain statistically useful. Secure Multi-Party Computation (C) is a standard PET that lets multiple parties jointly compute a function over their combined private inputs without revealing those inputs to each other. Homomorphic Encryption (E) is also a recognized PET, allowing computations to be performed directly on ciphertext (e.g., via schemes like Paillier, BFV, or CKKS) so data stays encrypted during analytics. By contrast, a Network Intrusion Detection System (A) is a security monitoring control for detecting malicious traffic, not a data-privacy technique, and Full-Disk Encryption (D) protects data at rest against physical theft but does not enable privacy-preserving analytics on shared or outsourced data.

Answer

Network Intrusion Detection System

Answer

Full-Disk Encryption

Question 14

Which TWO of the following are effective ways to protect logs that contain PII?

Accepted Answer

Encryption at rest. Encryption at rest (A) is correct because it protects PII in logs by rendering the stored data unreadable without the appropriate decryption keys, so even if the underlying storage or backups are exposed, the PII cannot be accessed. Restricted IAM access policies (C) are correct because applying least-privilege permissions ensures only authorized identities can read, modify, or delete the log data, directly limiting exposure of PII to approved personnel and services. Disabling log rotations (B) is not a protection measure; it increases retention and exposure while risking storage exhaustion, and rotation is typically needed for security and compliance. Broad read access for all employees (D) is the opposite of least privilege and would expose PII to unnecessary parties. Sending logs to a public URL (E) makes the data openly accessible, which is a severe data leak rather than a protection.

Answer

Disabling log rotations

Answer

Broad read access for all employees

Answer

Sending logs to a public URL

Question 15

A CDPSE is reviewing the data retention practices of a healthcare provider that stores patient records in a cloud environment. The provider operates in multiple jurisdictions with varying retention requirements. Which approach best ensures compliance with privacy regulations while minimizing data storage risks?

Accepted Answer

Implement a records retention schedule that aligns with legal and regulatory requirements in each jurisdiction, and securely delete data once retention periods expire.. A jurisdiction-specific retention schedule ensures compliance with varying legal requirements and enforces secure deletion after retention periods expire. This approach adheres to storage limitation and data minimization principles, reducing legal and security risks. Other options either retain data indefinitely, ignore jurisdictional differences, or rely on patient action, all of which fail to meet regulatory obligations.

Answer

Encrypt all patient records and retain them until the patient requests deletion.

Answer

Store all patient records in a single, centralized database with strong access controls, regardless of jurisdiction.

Answer

Retain all patient records indefinitely to ensure availability for future legal or medical needs.