CDPSE Practice Exam 3 — 20 Questions

Question 1

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Accepted Answer

The lack of human intervention in automated decision-making processes.. The main privacy concern regarding the Right to Explanation in automated credit decisions is the lack of human intervention in automated decision-making processes. When a system makes credit decisions without meaningful human involvement, the data subject cannot obtain an explanation of the logic involved or contest the outcome, which undermines the right to explanation and the broader right not to be subject to solely automated decisions. This is the core tension that GDPR Article 22 and related transparency provisions address.

Answer

The system is too slow for real-time credit processing.

Answer

The cost of maintaining the automated system infrastructure.

Answer

The inability of the system to process non-numeric data types.

Question 2

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

Accepted Answer

Adopt a 'hub and spoke' privacy governance model.. A 'hub and spoke' privacy governance model centralizes policy-setting, standards, and oversight at the corporate hub while allowing local spokes to adapt implementation to jurisdictional legal variations. This balances global consistency with local compliance, ensuring that regional requirements (e.g., GDPR, CCPA, PIPL) are met without fragmenting the overall governance framework. It is the recommended approach for multinationals facing divergent privacy laws.

Answer

Standardize all data processing to occur only in the home country.

Answer

Allow each region to define its own privacy framework independently.

Answer

Enforce a single, global privacy policy that overrides all local laws.

Question 3

A privacy analyst is reviewing the organization's privacy governance documentation and notices that the roles and responsibilities for privacy are not clearly defined. According to generally accepted privacy governance principles, what is the most appropriate first step to address this gap?

Accepted Answer

Draft a privacy charter that assigns accountability to specific roles and obtains executive approval.. The analyst identified a lack of clearly defined privacy roles and responsibilities. The foundational step is to create a privacy charter that assigns accountability to specific roles and secures executive approval. This establishes the governance structure necessary for other activities like assessments, technology implementation, and training to be effective and properly directed.

Answer

Conduct a privacy impact assessment for all business processes.

Answer

Implement a new privacy technology solution to automate compliance monitoring.

Answer

Schedule privacy awareness training for all employees.

Question 4

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO's primary role is to monitor compliance with data protection laws and internal policies, and to advise the organization and its employees on data protection obligations. This is an advisory and monitoring function, not an operational or executive decision-making role. It is defined explicitly under GDPR Articles 37-39.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 5

A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?

Accepted Answer

server_side_encryption_configuration. In Terraform, the `server_side_encryption_configuration` block within an `aws_s3_bucket` resource is used to configure default encryption for the bucket. Setting its `sse_algorithm` to `aws:kms` enables SSE-KMS encryption at rest. This is the correct attribute to enforce encryption.

Answer

bucket_acl

Answer

versioning_enabled

Answer

public_access_block

Question 6

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Accepted Answer

Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal.. An Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal is the correct feature to automate the CCPA Right to Opt-Out for web visitors. CCPA/CPRA requires businesses to honor opt-out signals (including Global Privacy Control) and provide a clear mechanism for consumers to stop the sale or sharing of their personal information. A CMP captures the signal, records consent state, and propagates it to downstream ad tech and data partners automatically.

Answer

A manual email ticketing system for data subject access requests.

Answer

An automated script that permanently deletes user accounts after 30 days of inactivity.

Answer

An internal dashboard for employees to view customer purchase histories.

Question 7

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Accepted Answer

Categorize the vendor based on the sensitivity and volume of PII they will process.. The first step in any third-party privacy risk management lifecycle is to understand what you are exposing: classify the vendor based on the sensitivity and volume of PII they will process. This tiering determines the depth of due diligence, the contractual terms required, and the ongoing monitoring cadence. Without this categorization, you cannot right-size the DPA, the SOC 2 review, or any technical testing.

Answer

Draft a Data Processing Agreement (DPA).

Answer

Request the vendor's SOC 2 Type II report.

Answer

Conduct a penetration test on the vendor's API endpoints.

Question 8

Which of the following is an example of an 'operational' technical control for privacy?

Accepted Answer

Data discovery scanning tools. Data discovery scanning tools are an operational technical control because they are automated technologies that continuously or periodically scan systems to locate, classify, and inventory personal data. They operate at the technical layer (agents, API connectors, pattern matching, ML classifiers) and are 'operational' in that they run as part of ongoing privacy operations rather than as one-time assessments or documentation. This makes them the only option that is simultaneously technical and operational.

Answer

Privacy policy document

Answer

Standard Operating Procedure

Answer

Privacy impact assessment

Question 9

Which tool is best suited for establishing the scope of a privacy governance program by identifying where personal data resides across the organization?

Accepted Answer

Data Inventory / Data Map. A data inventory or data map identifies what personal data exists, where it resides, how it flows, and who owns it across systems and jurisdictions—this is the foundational artifact for scoping a privacy governance program. Without knowing where personal data lives, an organization cannot define program boundaries, apply controls, or meet regulatory requirements like records of processing. It directly answers the scoping question.

Answer

Access Control Matrix

Answer

Privacy Impact Assessment (PIA)

Answer

Incident Response Plan

Question 10

A privacy engineer is designing a data processing pipeline that ingests customer records from multiple source systems into a centralized analytics environment. The design must enforce data minimization and purpose limitation. Which TWO engineering controls should be implemented? (Choose two.)

Accepted Answer

Tag each record with its source purpose and enforce purpose-based access policies.. Data minimization and purpose limitation in a centralized pipeline require both a restrictive schema that admits only approved fields and purpose tags that drive access decisions. Together they prevent unapproved attributes from entering the environment and stop records from being reused for incompatible purposes. Broad raw access and indefinite retention work against both principles and should be avoided in the design.

Answer

Retain all source records indefinitely to preserve historical accuracy.

Answer

Grant all analytics engineers read access to the raw ingestion zone.

Answer

Store all ingested records in a single unpartitioned table for maximum flexibility.

Question 11

You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?

Accepted Answer

Apply suppression to direct identifiers. Before generalization can produce meaningful equivalence classes, direct identifiers (names, SSNs, email addresses) that uniquely identify each row must be removed or suppressed. If a unique direct identifier remains, every row stays distinguishable regardless of how much you generalize quasi-identifiers, defeating k-anonymity. Suppression of direct identifiers is therefore the mandatory first step in the standard k-anonymity pipeline (remove direct identifiers, then generalize/suppress quasi-identifiers).

Answer

Add synthetic noise

Answer

Normalize the dataset

Answer

Increase the k-value

Question 12

What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?

Accepted Answer

Minimizing or protecting personal data. Privacy-Enhancing Technologies (PETs) are a class of technical measures designed to protect personal data throughout its lifecycle by minimizing collection, limiting linkability, and reducing identifiability. Their core objective is to enable data processing while safeguarding individual privacy, not to improve infrastructure performance. Options like processing power, bandwidth, and software quality are unrelated to the privacy purpose of PETs.

Answer

Increasing processing power

Answer

Improving network bandwidth

Answer

Reducing software bugs

Question 13

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Accepted Answer

The existing business strategy and risk appetite.. A privacy governance program must be aligned with the organization's strategic direction and risk tolerance, so the first document to review is the existing business strategy and risk appetite. This establishes why the program exists, what business outcomes it must support, and how much privacy risk leadership is willing to accept. Without that context, a practitioner cannot prioritize regulatory obligations, allocate resources, or define meaningful metrics.

Answer

The list of current vendors.

Answer

The software inventory.

Answer

The technical architecture diagram.

Question 14

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Accepted Answer

It identifies privacy risks at each stage from collection to deletion.. Data Lifecycle Management (DLM) is significant in privacy risk assessments because it provides a structured framework to identify privacy risks at every stage of data handling — from collection, use, storage, sharing, to deletion. By mapping risks to each lifecycle phase, organizations can ensure controls are applied where they are most needed, such as consent at collection or secure deletion at end-of-life.

Answer

It reduces the power consumption of the storage systems.

Answer

It determines the software development methodology.

Answer

It ensures that the database is always updated with the latest patches.

Question 15

Which of the following is the most effective technical control for implementing the 'Right to be Forgotten' in a distributed microservices environment?

Accepted Answer

Implementing a centralized 'Identity Deletion' event bus. In a distributed microservices environment, personal data is scattered across many services and data stores, so honoring erasure requires coordinated action. A centralized 'Identity Deletion' event bus publishes a deletion event that each subscribing service consumes to erase or anonymize its copy of the subject's data, providing a scalable, auditable, and consistent mechanism. This event-driven pattern ensures no service is missed and creates a traceable record of propagation.

Answer

Deleting individual database records in each service

Answer

Archiving logs for 7 years

Answer

Increasing database logging levels

Question 16

To prevent 're-identification' of an anonymized dataset, what process should be applied if the dataset is merged with external public data?

Accepted Answer

Linkage attack analysis. A linkage attack analysis specifically evaluates whether an anonymized dataset can be re-identified by joining it with external public data using shared quasi-identifiers such as ZIP code, birth date, or gender. It is the process designed to detect and mitigate re-identification risk before or after data merging. This directly addresses the scenario of combining anonymized data with external sources.

Answer

Data validation

Answer

Backup encryption

Answer

Database normalization

Question 17

In the context of data classification, which metadata field is most critical for determining the disposal date?

Accepted Answer

Retention Start Date. The Retention Start Date is the most critical metadata field for determining the disposal date because it marks when the retention period begins. Retention policies typically specify a duration (e.g., 7 years) from a trigger event, and the Retention Start Date provides that trigger. Without it, the disposal date cannot be accurately calculated.

Answer

Data Owner

Answer

Encryption Key ID

Answer

Classification Label

Question 18

Which role is primarily responsible for ensuring that privacy policies are communicated effectively across the organization?

Accepted Answer

The Privacy Office or DPO.. The Privacy Office or Data Protection Officer (DPO) owns the privacy program and is accountable for drafting, approving, and disseminating privacy policies to all workforce members and relevant stakeholders. This role translates regulatory requirements (GDPR, CCPA, HIPAA) into operational policy and ensures consistent communication through training, awareness campaigns, and acknowledgments. Communication effectiveness is a governance responsibility, not an IT or audit function.

Answer

The janitorial staff.

Answer

The external auditors.

Answer

The IT helpdesk.

Question 19

A multinational corporation's privacy team is struggling to keep pace with new privacy laws across 20 countries. The chief privacy officer wants to shift from a reactive to a proactive governance model. Which initiative would BEST enable this transformation?

Accepted Answer

Implement a privacy management platform that tracks regulatory changes and automates assessments.. Implementing a privacy management platform best enables a proactive governance model by automating regulatory tracking, assessments, and reporting across multiple jurisdictions. It provides scalability and real-time visibility, allowing the privacy team to anticipate and respond to changes efficiently, rather than reacting after the fact.

Answer

Conduct an annual global privacy audit to identify gaps after laws take effect.

Answer

Hire additional privacy lawyers in each country to monitor legislative changes.

Answer

Delegate privacy compliance to local business units without central oversight.

Question 20

A privacy engineer is implementing a consent management platform for a mobile application. The platform must capture, store, and enforce user consent preferences across multiple microservices. Which two actions should the engineer take to ensure consent is technically enforceable and auditable? (Choose two.)

Accepted Answer

Store consent records with a timestamp, version of the privacy notice, and the specific purposes consented to.. To make consent technically enforceable and auditable, the engineer must both record granular consent details (timestamp, notice version, purposes) and enforce those preferences at the point of processing within each microservice. Recording alone does not prevent processing, and enforcement without a reliable record lacks proof. Together, they create a robust consent management system that supports compliance and user rights.

Answer

Encrypt consent records using a symmetric key stored in the application code to prevent tampering.

Answer

Rely on the mobile operating system's permission prompts as the sole mechanism for capturing consent for all data processing purposes.

Answer

Allow users to change their consent preferences only through a customer support ticket to maintain a controlled audit trail.