CDPSE Practice Test 21 — 15 Questions

Question 1

A healthcare provider is implementing a new patient portal. The privacy officer wants to ensure that when a patient requests correction of their data, the change is propagated to all downstream systems, including the billing and analytics platforms. Which data life cycle management practice is most critical to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data lineage tracking. Data lineage tracking is essential for propagating corrections because it documents the movement and transformation of data across systems. By understanding lineage, the healthcare provider can locate every copy of a patient's data and apply the correction consistently. Encryption, masking, and retention scheduling serve different purposes and do not provide the visibility needed to update all downstream instances.

Answer

Data encryption

Answer

Data masking

Answer

Data retention scheduling

Question 2

A multinational corporation is subject to multiple privacy regulations across different jurisdictions. The privacy team wants to ensure that the organization's privacy governance framework can adapt to new and changing legal requirements without constant restructuring. Which principle should guide the design of the framework?

Accepted Answer

Scalability. Scalability is the key principle because it enables the privacy governance framework to expand and adjust to new regulations and business changes without major restructuring. Centralization, standardization, and decentralization are all design considerations, but scalability directly addresses the need for adaptability and growth in a dynamic regulatory environment.

Answer

Decentralization

Answer

Centralization

Answer

Standardization

Question 3

A data privacy officer is reviewing the data life cycle for a new mobile application that collects precise geolocation data. The privacy policy states that geolocation data must be retained only for 30 days and then irreversibly anonymized for analytics. The engineering team proposes using a PostgreSQL database and asks for the most technically sound method to achieve irreversible anonymization of the geolocation data after 30 days while preserving its utility for aggregate analysis. Which approach should the privacy officer recommend?

Accepted Answer

Generalize the geolocation coordinates to a coarser grid (e.g., city-level) after 30 days and delete the original precise values.. Generalizing geolocation coordinates to a coarser grid and deleting the original precise values achieves irreversible anonymization while retaining utility for aggregate analysis. This method reduces data precision to a level where individuals cannot be re-identified, satisfying the privacy policy. Other options either leave data reversible or destroy its analytical value.

Answer

Apply a salted SHA-256 hash to the latitude and longitude values after 30 days.

Answer

Use PostgreSQL's built-in pgcrypto extension to encrypt the geolocation data with a symmetric key after 30 days.

Answer

Move the geolocation data to a separate table and restrict access to it after 30 days.

Question 4

A CDPSE is conducting a privacy risk assessment for a cloud-based HR system that processes employee data across multiple jurisdictions. The system uses a third-party subprocessor for payroll analytics. The CDPSE must ensure compliance with data transfer restrictions. Which mechanism is most appropriate for ensuring lawful transfers from the EU to the subprocessor in a country without an adequacy decision?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses are the most appropriate mechanism because they are pre-approved by the European Commission and can be used with external subprocessors in countries lacking an adequacy decision. They impose data protection obligations on the importer and are legally binding. Other mechanisms like BCRs are for intra-group transfers, Privacy Shield is invalid, and derogations are for occasional transfers.

Answer

Privacy Shield certification

Answer

Binding Corporate Rules (BCRs)

Answer

Derogation for contractual necessity

Question 5

A privacy engineer is auditing log data. Which action best aligns with data minimization requirements for logs?

Accepted Answer

Configuring log masking rules. Data minimization for logs means ensuring that log data does not contain more personal information than necessary for the stated purpose (e.g., security monitoring, troubleshooting). Configuring log masking rules removes or obfuscates sensitive fields such as passwords, tokens, and personal identifiers before they are written. This directly reduces privacy risk while preserving the operational value of logs.

Answer

Centralizing logs in a SIEM

Answer

Enabling full verbose logging

Answer

Setting a long retention policy

Question 6

A CDPSE is reviewing a new marketing initiative that will use email addresses and purchase history to create lookalike audiences on a social media platform. The legal team has confirmed that the organization has a legitimate interest basis for the original collection. Which action should the CDPSE recommend FIRST to manage privacy risk?

Accepted Answer

Conduct a legitimate interest assessment to confirm that the new use is compatible with the original purpose and that data subject rights are not overridden.. When repurposing personal data, the first step is to assess compatibility with the original purpose and confirm that the legitimate interest basis remains valid. This assessment determines whether additional safeguards, transparency or a different legal basis are needed. Updating notices or anonymizing data may follow, but they do not replace the need to establish a lawful basis for the new processing.

Answer

Anonymize the email addresses and purchase history before sharing with the social media platform.

Answer

Obtain fresh consent from all customers whose data will be used for lookalike audiences.

Answer

Immediately update the privacy notice to include lookalike audience creation and proceed with the campaign.

Question 7

Which THREE factors influence the maturity level of an organization's privacy governance?

Accepted Answer

The consistency of policy application across the enterprise.. Option B is correct because privacy governance maturity depends on how uniformly privacy policies, standards, and controls are applied across all business units, geographies, and functions; inconsistent application signals a lower maturity level, while enterprise-wide consistency indicates repeatable, defined processes. Option D is correct because embedding privacy requirements into automated processes (for example, privacy-by-design in SDLC, automated data subject request workflows, consent management platforms, and data classification tools) demonstrates higher maturity than relying on manual, ad hoc privacy handling. Option E is correct because continuous monitoring and reporting — such as ongoing control testing, privacy KPIs/KRIs, audit logging, and regular reporting to management — reflect the measured and managed stages of a maturity model rather than an initial, reactive state. Option A is not relevant because the amount of rented office space has no bearing on privacy governance capability or process maturity. Option C is not relevant because the headcount of the IT department alone does not indicate how well privacy is governed, integrated, or monitored.

Answer

The amount of office space rented.

Answer

The number of employees in the IT department.

Question 8

A healthcare provider in the EU is migrating patient records to a cloud service provider based in the United States. The CDPSE must ensure the transfer complies with GDPR Chapter V. Which of the following is the MOST appropriate mechanism to legitimize the transfer?

Accepted Answer

Standard Contractual Clauses (SCCs) with a transfer impact assessment.. For transfers from the EU to the US, Standard Contractual Clauses (SCCs) are a primary mechanism, but they must be supplemented by a transfer impact assessment to ensure adequate protection. Binding Corporate Rules apply to intra-group transfers, derogations are for occasional transfers, and Privacy Shield is invalid. Thus, SCCs with a TIA are the most appropriate.

Answer

Binding Corporate Rules (BCRs).

Answer

Derogations under Article 49, such as explicit consent.

Answer

Privacy Shield certification.

Question 9

A privacy engineer is configuring Azure SQL Database to ensure that sensitive columns containing PII are hidden from non-privileged users. Which feature should be implemented to achieve dynamic data masking?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) in Azure SQL Database masks sensitive columns in query results for non-privileged users without altering the stored data. It is configured per-column with masking functions (default, email, random, partial) and applies at query time based on user permissions. This directly satisfies the requirement to hide PII from non-privileged users.

Answer

Always Encrypted

Answer

Row-Level Security

Answer

Transparent Data Encryption

Question 10

Which TWO actions help improve privacy in a containerized environment (e.g., Kubernetes)?

Accepted Answer

Kubernetes Secrets management. Kubernetes Secrets management (B) is correct because it stores sensitive data such as credentials, tokens, and keys in base64-encoded objects that can be mounted as volumes or exposed as environment variables, and when combined with encryption at rest and RBAC restrictions, it prevents credentials from being hard-coded in images or manifests where they could leak. Kubernetes Network Policies (E) are correct because they act as pod-level firewalls using label selectors to define ingress and egress rules, enforcing least-privilege microsegmentation so that a compromised container cannot freely reach other pods or exfiltrate data. Increasing container replica count (A) only affects availability and scaling, not privacy, since more identical instances do not reduce data exposure. Using public container registries (C) weakens privacy by exposing image metadata and potentially pulling untrusted or vulnerable images. Disabling logging (D) is not a privacy control; it removes audit trails and hinders detection of unauthorized access, which is the opposite of good security practice.

Answer

Increasing container replica count

Answer

Using public container registries

Answer

Disabling logging

Question 11

A privacy engineer is reviewing a mobile application that collects precise GPS coordinates every 30 seconds, even when the user is not actively using the app. The product team wants to reduce privacy risk while preserving the app's core feature of showing nearby points of interest. Which change BEST aligns with the principle of data minimization?

Accepted Answer

Collect location only while the app is in the foreground and generalize coordinates to the nearest city block before storage.. Data minimization requires collecting only what is necessary for the stated purpose. Tying collection to foreground use and generalizing coordinates to a coarse granularity limits both the amount and the precision of location data to what the nearby points-of-interest feature actually needs. Encryption and consent do not reduce collection, and merely lowering frequency still leaves unnecessary background collection.

Answer

Reduce the collection frequency from every 30 seconds to every 5 minutes and continue collecting in the background.

Answer

Continue background collection but encrypt the location data at rest and in transit.

Answer

Add a prominent consent screen that clearly describes the background collection and allows the user to opt out.

Question 12

A CDPSE is reviewing the privacy program of a small e-commerce company that sells to customers in California. The company has not updated its privacy policy in two years and does not have a process for handling consumer requests. Which requirement under the California Consumer Privacy Act (CCPA) as amended by the CPRA is the company MOST likely failing to meet?

Accepted Answer

The requirement to respond to consumer requests to know, delete, or correct personal information within 45 days.. The company is most likely failing to meet the CCPA/CPRA requirement to respond to consumer requests to know, delete, or correct personal information within 45 days. Without a process, the company cannot honor these rights, which is a core obligation. The other options either misstate the law or are conditional requirements not necessarily applicable here.

Answer

The requirement to appoint a Data Protection Officer (DPO) to oversee privacy compliance.

Answer

The requirement to provide a clear and conspicuous link titled 'Do Not Sell or Share My Personal Information' on the homepage.

Answer

The requirement to obtain opt-in consent from all consumers before collecting any personal information.

Question 13

Which of the following activities is essential for maintaining effective privacy governance over third-party processors?

Accepted Answer

Including mandatory privacy clauses in contracts and auditing compliance.. Effective privacy governance over third-party processors requires enforceable contractual obligations and ongoing verification that those obligations are met. Mandatory privacy clauses establish the legal basis for data protection requirements (purpose limitation, breach notification, sub-processor controls), while auditing compliance provides assurance that the processor actually adheres to them. Together they create accountability across the data processing lifecycle.

Answer

Only hiring large, well-known vendors.

Answer

Trusting the processor's own marketing brochures.

Answer

Giving the vendor full access to the corporate network.

Question 14

A multinational bank is implementing a new AI-driven credit scoring system that processes personal data of EU residents. The CDPSE must ensure the processing complies with GDPR. Which of the following is the MOST appropriate action to take FIRST?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) because the processing involves systematic and extensive evaluation of personal aspects based on automated processing.. The correct answer is to conduct a DPIA first because GDPR mandates it for high-risk processing like AI-driven credit scoring. A DPIA systematically evaluates risks and helps determine necessary safeguards. Other actions like obtaining consent or appointing a DPO may be required later but are not the initial compliance step for this scenario.

Answer

Obtain explicit consent from all data subjects, as automated decision-making always requires explicit consent under GDPR.

Answer

Implement pseudonymization of the data before processing to eliminate privacy risks.

Answer

Appoint a Data Protection Officer (DPO) because any organization using AI must have a DPO.

Question 15

A small healthcare startup is developing its first privacy program. The leadership team wants to ensure that privacy is embedded into the organization's culture from the beginning. Which of the following is the MOST effective initial step to achieve this goal?

Accepted Answer

Appointing a privacy officer and establishing a privacy governance framework. Appointing a privacy officer and establishing a governance framework creates the necessary structure, authority, and accountability to embed privacy into the organization's culture. This foundational step enables the development of policies, training, and risk management processes. Other activities like software, data mapping, and training are important but are more effective when guided by a clear governance structure and leadership commitment.

Answer

Conducting a comprehensive data mapping exercise to identify all personal data flows

Answer

Purchasing a privacy management software tool to automate compliance

Answer

Implementing a mandatory annual privacy training for all employees