CDPSE Practice Test 18 — 15 Questions

Question 1

A global financial services firm is aligning its privacy governance with the ISACA CDPSE framework. The Chief Privacy Officer is reviewing the roles and responsibilities of key governance bodies. Which two of the following are essential for effective privacy governance oversight? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A dedicated privacy office led by a Chief Privacy Officer who reports to the CEO and has independent authority.. Effective privacy governance requires both strategic oversight and independent leadership. A cross-functional steering committee with senior executives ensures privacy is integrated into business strategy and has the authority to make decisions. An independent privacy office led by a CPO reporting to the CEO provides dedicated leadership, accountability, and the ability to challenge business practices. Together, these bodies establish a robust governance structure. Training, complaint reporting, and audit reviews are important but do not constitute governance oversight on their own.

Answer

An annual privacy training session for all employees conducted by the IT department.

Answer

A process for employees to submit privacy complaints directly to their immediate supervisors.

Answer

A quarterly review of privacy metrics by the internal audit department without involvement from business units.

Question 2

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

Accepted Answer

Appointing a privacy champion in each agile squad.. In agile environments, privacy risks are best managed by embedding a privacy champion within each squad so that privacy considerations are addressed continuously during refinement, design, and development. This decentralized model fits agile's iterative cadence and ensures privacy expertise is available at the point of decision rather than as a late-stage gate. It balances speed with accountability.

Answer

Requiring a full DPIA before every sprint.

Answer

Waiting for the security sign-off at the end of the project.

Answer

Hard-coding privacy requirements in the source code.

Question 3

What is the main purpose of a Privacy Impact Assessment (PIA) in the governance framework?

Accepted Answer

To identify and mitigate privacy risks early in the process.. A Privacy Impact Assessment (PIA) is a structured process to identify, evaluate, and mitigate privacy risks associated with a project, system, or process before it goes live. Its main purpose in a governance framework is to ensure that privacy risks are addressed early in the design phase, when changes are cheapest and most effective. This supports accountability and privacy by design requirements.

Answer

To calculate the financial costs of IT staff.

Answer

To increase the speed of product deployment.

Answer

To fulfill a mandatory public relations requirement.

Question 4

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Accepted Answer

Activate the incident response plan to assess the scope and notify affected individuals if required.. When a third-party vendor reports a data breach, the first step is to activate the incident response plan. This ensures a structured approach to assess the scope, contain the breach, and determine notification requirements. It is the immediate action that triggers all necessary procedures.

Answer

Review the vendor's insurance policy coverage.

Answer

Demand the vendor perform an independent audit of their systems.

Answer

Suspend all services provided by the vendor immediately.

Question 5

A data privacy team is designing a new customer analytics platform. They need to ensure that raw personal data collected for marketing purposes cannot be repurposed for a different incompatible purpose without explicit consent. Which data life cycle management control best enforces this requirement at the point of collection?

Accepted Answer

Purpose limitation tagging applied to data assets at ingestion.. Purpose limitation requires that data collected for one purpose not be used for another incompatible purpose without a lawful basis. Tagging assets with purpose metadata at ingestion embeds that restriction into the data life cycle, enabling automated policy enforcement downstream. Masking, encryption, and retention schedules address different privacy principles and do not prevent repurposing by authorized users.

Answer

Data masking applied to all personal data before storage.

Answer

Retention schedule applied to the marketing database.

Answer

Encryption at rest for the analytics data store.

Question 6

A multinational retailer must comply with a data subject's erasure request that spans its on-premises Oracle database, a SaaS CRM, and backups. The privacy team wants to ensure the erasure is technically enforced and auditable across all environments. Which approach best meets this requirement?

Accepted Answer

Implement a centralized erasure orchestration tool that propagates deletion requests to all systems and logs each action.. Erasure across diverse systems demands a coordinated approach that can enforce deletion in each environment and produce auditable evidence. A centralized orchestration tool provides the necessary reach and logging, while manual deletion and passive backup expiration leave gaps. Anonymization and cryptographic erasure are alternatives but require strict conditions that are hard to meet across on-premises, SaaS, and backups.

Answer

Encrypt the customer record with a key that is deleted upon request, rendering the data unreadable.

Answer

Anonymize the customer record in all systems so it can no longer be linked to the individual.

Answer

Delete the customer record from the production Oracle database and the SaaS CRM, and rely on backup expiration.

Question 7

A CDPSE is reviewing the organization's data retention schedule. The legal team has determined that customer records must be kept for seven years to comply with tax regulations. However, the marketing department wants to keep the data indefinitely for future analytics. Which principle should guide the CDPSE's recommendation?

Accepted Answer

Storage limitation. Storage limitation mandates that personal data be kept only as long as necessary for the specified purposes. The tax regulation sets a seven-year retention requirement; beyond that, retaining data for marketing analytics lacks a lawful basis and violates storage limitation. The CDPSE should recommend deletion after the legal period unless a new justified purpose exists.

Answer

Integrity and confidentiality

Answer

Purpose limitation

Answer

Data minimization

Question 8

A CDPSE is advising a healthcare organization on complying with the HIPAA Privacy Rule. Which TWO actions are required to properly manage patient authorizations for use and disclosure of protected health information (PHI)? (Choose two.)

Accepted Answer

Permit patients to revoke their authorization at any time, in writing, except to the extent that the covered entity has already taken action in reliance on it.. The correct answers are obtaining valid written authorization for marketing and allowing patients to revoke authorizations at any time. HIPAA mandates patient authorization for marketing uses and grants revocation rights. These actions empower patients and ensure compliance. Other options are incorrect because they misstate authorization requirements for research, suggest invalid blanket authorizations, or permit unauthorized law enforcement disclosures.

Answer

Disclose PHI to law enforcement without authorization if the patient is a suspect in a criminal investigation.

Answer

Use a single authorization form to cover all future uses and disclosures of PHI to streamline operations.

Answer

Ensure that authorizations for research purposes are obtained only if the research involves direct contact with patients.

Question 9

A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?

Accepted Answer

Incompatible local regulatory mandates.. A Global Privacy Policy must satisfy every jurisdiction in which the company operates, and local privacy laws frequently impose conflicting requirements — for example, GDPR's data subject rights versus CCPA's opt-out model versus sectoral rules in healthcare or finance. These incompatible mandates create genuine legal conflicts that cannot be resolved by a single uniform policy without local addenda or derogations. This is the greatest governance challenge because it forces ongoing legal reconciliation rather than a one-time drafting exercise.

Answer

Lack of translation services.

Answer

Difficulty in choosing a document management system.

Answer

Inability to find a privacy officer for every region.

Answer

Resistance from the Marketing department.

Question 10

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

Accepted Answer

Implementing Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment (TIA).. Standard Contractual Clauses (SCCs) are the European Commission-approved contractual safeguards for transferring personal data to third countries, and pairing them with a Transfer Impact Assessment (TIA) addresses the post-Schrems II requirement to evaluate the destination country's laws and supplement protections where needed. Together they form the most defensible mechanism for lawful EU-US transfers after prior frameworks were invalidated. This combination is explicitly endorsed by the EDPB.

Answer

Restricting all data transfers to only encrypted tunnels.

Answer

Relying on the internal 'Group Privacy Policy' as an adequacy decision.

Answer

Self-certification under the U.S. Commerce Department's privacy program.

Question 11

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

Accepted Answer

Communicating the privacy policy update to the data subjects.. When a privacy policy is updated to reflect a new vendor, the most important follow-up action is to communicate the update to data subjects, because transparency obligations require that individuals are informed about how their personal data is processed and by whom. Adding a vendor typically means personal data will be shared with or processed by a new party, which materially changes the processing described in the notice, so data subjects must be informed before or at the time the change takes effect. This preserves the transparency principle central to privacy regulations such as GDPR Articles 13–14 and supports informed consent where applicable.

Answer

Archiving the previous version of the privacy policy for internal records.

Answer

Requesting a new SOC 2 report from the new vendor.

Answer

Updating the internal audit schedule to include the new vendor.

Question 12

What is the first step in conducting a privacy audit?

Accepted Answer

Defining the scope and objectives of the audit.. The first step in any audit — privacy, security, or financial — is to define the scope and objectives, because this determines what will be examined, which controls and regulations apply, who the stakeholders are, and what success looks like. Without a defined scope, the auditor cannot select criteria, allocate resources, or produce findings that map to a standard such as GDPR, ISO 27701, or NIST Privacy Framework.

Answer

Asking employees for their lunch preferences.

Answer

Buying new security software.

Answer

Writing the final audit report.

Question 13

In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is the Google Cloud service designed to discover, classify, and redact sensitive data like PII. Integrating the DLP API with Cloud Storage allows automatic scanning and redaction of uploaded documents based on configured infoType detectors and de-identification templates. This is the native, scalable solution for content-level redaction.

Answer

Cloud Storage buckets lifecycle policy

Answer

Cloud Identity and Access Management

Answer

Cloud Logging

Question 14

A CDPSE is advising a software company that develops a mobile fitness app. The app collects heart rate, sleep patterns, and location data. The company wants to use this data to provide personalized health insights and also share anonymized data with research partners. Which privacy risk is MOST critical to address before launching the app?

Accepted Answer

The potential for re-identification of anonymized data when combined with other datasets.. The most critical privacy risk is re-identification of anonymized data, especially given the sensitivity of health and location data. Anonymization is often reversible when combined with other datasets, leading to potential privacy breaches and legal non-compliance. While consent, encryption, and compatibility are relevant, they do not address the fundamental risk of re-identification that could invalidate the entire data sharing model.

Answer

The cost of implementing encryption for data at rest and in transit.

Answer

The need to obtain user consent for collecting heart rate and sleep data.

Answer

The app's ability to function across different mobile operating systems.

Question 15

A global retailer's privacy office discovers that its EU subsidiary is using a marketing analytics tool that transfers customer IP addresses to a cloud provider in a country without an adequacy decision. The subsidiary's local management insists the tool is essential for campaign performance. As the privacy lead, what should you do FIRST to address this governance gap?

Accepted Answer

Conduct a transfer impact assessment to evaluate the legal and privacy risks of the data transfer.. The correct first action is to assess the risk through a transfer impact assessment, which identifies the legal landscape of the destination country and evaluates the effectiveness of any safeguards. This assessment informs whether the transfer can continue with additional measures or must be restructured. It is a foundational governance step before remediation or escalation.

Answer

Allow the transfer to continue while updating the privacy notice to disclose the practice.

Answer

Report the subsidiary to the local data protection authority for non-compliance.

Answer

Instruct the subsidiary to immediately terminate the vendor contract and cease all data transfers.