CDPSE Practice Exam 4 — 20 Questions

Question 1

When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?

Accepted Answer

Reduction in privacy-related regulatory non-compliance fines.. Business value is best demonstrated through risk reduction and regulatory alignment.

Answer

Count of privacy training sessions completed.

Answer

Total spend on privacy software tools.

Answer

Number of privacy patches applied.

Question 2

Why is it important to have a defined data retention policy as part of privacy governance?

Accepted Answer

To comply with data minimization and reduce risk.. Data minimization is a key privacy principle; retaining data only as long as necessary reduces risk.

Answer

To satisfy customer requests for free gifts.

Answer

To save costs on hardware maintenance.

Answer

To increase storage space.

Question 3

Which THREE factors influence the maturity level of an organization's privacy governance?

Accepted Answer

The consistency of policy application across the enterprise.. Policy adoption, process automation, and monitoring depth define maturity.

Answer

The amount of office space rented.

Answer

The number of employees in the IT department.

Question 4

When evaluating a third-party vendor's privacy maturity, which document is most critical for the privacy practitioner to review during the due diligence process?

Accepted Answer

A SOC 2 Type II report or independent privacy audit report.. A SOC 2 Type II report or a dedicated privacy audit report provides independent verification of the vendor's privacy controls.

Answer

The vendor's public stock market performance.

Answer

The vendor's marketing brochure.

Answer

The vendor's internal organizational chart.

Question 5

Which of the following is an example of a physical privacy control?

Accepted Answer

Biometric server room entry. Securing the server room prevents unauthorized physical access to the hardware holding the data.

Answer

Disk encryption

Answer

Access logs

Answer

Data masking

Question 6

What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?

Accepted Answer

Minimizing or protecting personal data. PETs are tools that protect personal data by minimizing it, masking it, or providing mathematical privacy guarantees.

Answer

Increasing processing power

Answer

Improving network bandwidth

Answer

Reducing software bugs

Question 7

Which TWO technical controls are effective for limiting the scope of PII access in a cloud-based SQL environment?

Accepted Answer

Column-level security. Column-level security and Row-level security provide the most granular access control to prevent unauthorized PII visibility.

Answer

Public network access

Answer

Full database export

Answer

Verbose error logging

Question 8

Which THREE privacy engineering activities are performed during the 'Maintenance' phase of the system lifecycle?

Accepted Answer

Patching security vulnerabilities. Continuous monitoring, re-assessing impact, and updating security patches are critical during maintenance.

Answer

Initial design wireframing

Answer

Project budget estimation

Question 9

In the context of 'Privacy-Preserving Machine Learning', what is the purpose of the 'Membership Inference Attack' simulation during testing?

Accepted Answer

To identify if training data is leaked. This simulation tests if a model reveals whether a specific individual's data was used in the training set, exposing a potential privacy breach.

Answer

To optimize model accuracy

Answer

To improve training speed

Answer

To validate input quality

Question 10

A privacy engineer is implementing differential privacy in a data analytics pipeline. To ensure the privacy budget remains intact over multiple queries, which technique should be applied?

Accepted Answer

Utilizing composition theorems to track cumulative privacy loss. Composition theorems in differential privacy allow for the tracking of the cumulative privacy loss (epsilon) as multiple queries are performed on the same dataset.

Answer

Implementing k-anonymity on the original dataset

Answer

Increasing the sensitivity of the query function

Answer

Applying a fixed noise distribution regardless of query count

Question 11

How can an organization ensure privacy is considered during the vendor procurement phase?

Accepted Answer

Including privacy and data security requirements in the RFP.. Embedding privacy requirements into the Request for Proposal (RFP) sets expectations early.

Answer

Hiring the vendor based solely on price.

Answer

Waiting until the contract is signed before asking for privacy details.

Answer

Allowing the vendor to provide their own privacy policy.

Question 12

Which TWO techniques should be used to protect PII in non-production environments to ensure the data remains non-identifiable?

Accepted Answer

Pseudonymization. Anonymization and pseudonymization (if key access is restricted) are standard methods for protecting non-prod data.

Answer

Full database mirroring

Answer

Public internet exposure

Answer

Plaintext replication

Question 13

When implementing Privacy by Design (PbD) in a new mobile application, which TWO of the following are considered proactive technical controls?

Accepted Answer

Default privacy settings. Data minimization and privacy-default configurations are foundational proactive PbD controls.

Answer

Periodic external audits

Answer

End-user training

Answer

Comprehensive incident response plan

Question 14

An organization uses a 'Privacy-preserving Synthetic Data' generator. What is the primary purpose of this tool in a development environment?

Accepted Answer

To enable testing without using actual production PII. Synthetic data mimics the statistical properties of real data without containing actual PII, allowing devs to test without privacy risk.

Answer

To replace the need for database backups

Answer

To verify the identity of developers

Answer

To increase the accuracy of machine learning models

Question 15

When designing a privacy-preserving data pipeline, which TWO strategies help achieve 'Data Minimization'?

Accepted Answer

Truncating or hashing identifiers before ingestion. Data aggregation and truncation/hashing are effective ways to reduce the granularity of data and minimize the presence of identifiable information.

Answer

Disabling all audit logging

Answer

Increasing the retention period for backups

Answer

Storing all raw data in a data lake for future use

Question 16

What is the primary function of a privacy policy for external users?

Accepted Answer

To inform data subjects about the processing of their data.. Transparency is the main goal of external-facing privacy policies.

Answer

To prevent all data collection.

Answer

To list the names of all employees.

Answer

To act as a legal contract for system performance.

Question 17

In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?

Accepted Answer

Glue DataBrew. Glue DataBrew allows for data profiling and recipe-based transformations including PII redaction.

Answer

AWS Glue Schema Registry

Answer

AWS Lake Formation

Answer

Amazon Macie

Question 18

When implementing Secure Multi-Party Computation (SMPC), what is the primary benefit?

Accepted Answer

Computation on private inputs. SMPC allows multiple parties to compute a function over their inputs while keeping those inputs private from each other.

Answer

No data movement required

Answer

Full public data visibility

Answer

High speed performance

Question 19

Which THREE privacy-enhancing technologies are commonly used to facilitate data analysis on distributed datasets without centralizing the raw PII?

Accepted Answer

Federated Learning. SMPC, Federated Learning, and Differential Privacy all allow for privacy-preserving analysis of distributed data.

Answer

Full disk encryption

Answer

Network load balancing

Question 20

When configuring 'Dynamic Data Masking' in SQL Server, which permission is required for a user to see the unmasked data?

Accepted Answer

UNMASK permission. The 'UNMASK' permission is required for a user to view the original values hidden by dynamic data masking.

Answer

db_datareader

Answer

SELECT permission

Answer

sysadmin role