CDPSE Practice Test 22 — 15 Questions

Question 1

In the context of Privacy by Design, what is the primary role of an 'Access Control Matrix' in a microservices architecture?

Accepted Answer

Principle of least privilege implementation. In a microservices architecture, an Access Control Matrix defines which service (or role) can invoke which API or access which resource, directly implementing the principle of least privilege by granting only the minimum permissions needed. It is a Privacy by Design control because it limits data exposure and enforces authorization at service boundaries, reducing the blast radius of a compromised service.

Answer

Log aggregation

Answer

Threat modeling

Answer

Data classification

Question 2

Which TWO of the following should be considered when aligning privacy strategy with the business?

Accepted Answer

Primary business objectives and growth plans.. Option D is correct because a privacy strategy must be driven by the organization's primary business objectives and growth plans, ensuring that data protection controls enable rather than obstruct expansion into new markets, products, or data-intensive initiatives. Option E is correct because the organizational risk appetite defines how much privacy risk leadership is willing to accept, which directly shapes the stringency of privacy controls, investment levels, and prioritization of remediation efforts. Options A, B, and C are incorrect because a cafeteria menu, competitors' market share, and local weather forecasts have no bearing on how privacy strategy is aligned with business goals, risk tolerance, or regulatory obligations.

Answer

The local cafeteria menu.

Answer

The current market share of competitors.

Answer

The weather forecast in the corporate headquarters.

Question 3

A privacy engineer is designing a system that stores user date-of-birth values in a database. The business requirement is to support age-band analytics (e.g., 18-24, 25-34) without ever exposing the exact birth date to the analytics team. Which privacy engineering technique should be implemented to meet this requirement?

Accepted Answer

Generalization. Generalization is the correct technique because it transforms exact birth dates into broader age ranges, allowing age-band analytics without exposing precise personal data. It directly supports data minimization and purpose limitation by ensuring the analytics team only sees the level of detail necessary for the stated business need. Other techniques either preserve the exact value or protect it without reducing granularity.

Answer

Pseudonymization

Answer

Encryption at rest

Answer

Tokenization

Question 4

A privacy engineer is reviewing a new mobile application that collects location data. The app currently requests access to the device's precise location every time it is opened, even when the user is not actively using the app. Which privacy engineering principle is being violated?

Accepted Answer

Data minimization. Data minimization is violated because the app collects precise location data more frequently and with greater precision than necessary for its functionality, especially when the user is not actively using the app. This principle dictates that collection should be limited to what is adequate, relevant, and necessary. The other principles address purpose, retention, and security, which are not the primary issues in this scenario.

Answer

Integrity and confidentiality

Answer

Storage limitation

Answer

Purpose limitation

Question 5

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

Accepted Answer

Execute a Data Processing Agreement (DPA) that mandates adherence to specific privacy instructions.. Under GDPR Article 28, when a controller engages a processor (such as a CSP), a Data Processing Agreement (DPA) is legally mandatory and must specify the subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects, and the obligations of the processor. Executing a DPA that mandates adherence to specific privacy instructions is the primary mechanism for managing third-party privacy risk because it creates enforceable contractual accountability. It also flows down GDPR obligations such as breach notification, sub-processor controls, and assistance with data subject rights.

Answer

Perform a penetration test on the CSP's multi-tenant environment.

Answer

Verify the CSP's physical data center location to ensure it is within the EU.

Answer

Review the CSP's SOC 2 Type II report for general system reliability.

Question 6

When implementing differential privacy in a data analytics pipeline, what is the primary technical trade-off the engineer must balance?

Accepted Answer

Privacy budget and accuracy. Differential privacy works by adding calibrated noise (e.g., Laplace or Gaussian) to query results, and the amount of noise is governed by the privacy budget (epsilon, ε). A smaller epsilon means stronger privacy but more noise, which reduces the accuracy and utility of analytical results. The engineer must therefore balance the privacy budget against analytical accuracy — spending too much budget weakens privacy guarantees, while spending too little renders the data useless.

Answer

Anonymization speed and data volume

Answer

Encryption speed and latency

Answer

Scalability and storage costs

Question 7

A privacy engineer is evaluating a new third-party API that will process personal data. The API requires sending data over the internet. To ensure privacy during transmission, which technical control should be implemented to protect the data in transit?

Accepted Answer

TLS 1.3 with mutual authentication. TLS 1.3 with mutual authentication is the most appropriate control because it encrypts data in transit and verifies both parties' identities, ensuring that personal data is not intercepted or sent to an impostor. It is widely supported for API communications and does not require special network configurations. Other options like IPsec, SSH tunneling, or VPN are either not feasible for third-party APIs or do not provide the same level of application-layer security.

Answer

SSH tunneling to the API endpoint

Answer

IPsec tunnel between the organization and the API provider

Answer

VPN connection to the API provider's network

Question 8

A healthcare organization experiences a data breach involving unauthorized access to patient records. The CDPSE must determine if notification to supervisory authorities is required under GDPR. Which factor is most critical in making this determination?

Accepted Answer

The likelihood and severity of risk to data subjects' rights and freedoms. The most critical factor is the likelihood and severity of risk to data subjects' rights and freedoms, as specified in GDPR Article 33. This assessment determines whether the breach must be reported to the supervisory authority. Other factors like number of records, encryption, and duration are elements to consider within that risk assessment, but they are not standalone determinants.

Answer

Whether the data was encrypted at rest

Answer

The duration of the unauthorized access

Answer

The number of records affected

Question 9

A financial services company is expanding into a new jurisdiction that has no comprehensive data protection law but has sector-specific privacy rules for financial data. The chief privacy officer must decide how to govern privacy for the new market. Which approach BEST aligns with the organization's existing global privacy framework?

Accepted Answer

Conduct a gap analysis between local sector rules and the global policy, then integrate necessary controls.. A gap analysis is the most effective way to reconcile local sector-specific privacy rules with a global framework. It identifies discrepancies and allows for the integration of additional controls without abandoning the overarching privacy principles. This approach ensures legal compliance while maintaining operational consistency and scalability.

Answer

Apply the organization's global privacy policy uniformly, ignoring local sector-specific rules.

Answer

Develop a localized privacy policy that meets the sector-specific rules but diverges from global standards.

Answer

Delay market entry until the jurisdiction enacts a comprehensive data protection law.

Question 10

In the privacy lifecycle, what does the term 'Data Collection' primarily involve?

Accepted Answer

Obtaining and recording personal data from the subject. Data Collection in the privacy lifecycle refers to the phase where personal data is obtained from data subjects and recorded — whether through forms, cookies, sensors, or third parties. It is the first stage of the data lifecycle and triggers privacy obligations like notice, consent, and purpose limitation.

Answer

Destroying records

Answer

Backing up data

Answer

Encrypting data in transit

Question 11

Which THREE technical approaches assist in 'Right to Portability' implementation?

Accepted Answer

Automated data lifecycle management. Option A, automated data lifecycle management, is correct because it provides the systematic tracking, retention, and controlled movement of personal data across its lifecycle, which is essential to locate and assemble all data belonging to a data subject for a portability request. Option B, secure data export APIs, is correct because portability requires a mechanism to transmit personal data to the data subject or another controller in a structured, commonly used format, and authenticated, encrypted APIs enable that transfer safely and reliably. Option E, machine-readable formats, is correct because GDPR-style portability mandates that data be provided in a structured, commonly used, and machine-readable format (e.g., JSON, XML, CSV) so it can be reused without manual intervention. Option C, manual data entry, is not appropriate because it is error-prone, unscalable, and does not satisfy the requirement for an automated, structured, machine-readable transfer. Option D, full database replication, is not appropriate because portability concerns only the specific personal data of the requesting data subject, not wholesale duplication of entire databases, which would expose unrelated data and violate data minimization.

Answer

Manual data entry

Answer

Full database replication

Question 12

A software company operates in multiple jurisdictions and is implementing a privacy governance program. The legal team has identified that some countries require data localization, while others allow cross-border transfers with safeguards. Which governance approach best addresses these divergent requirements?

Accepted Answer

Establish a baseline global privacy standard and supplement it with regional addenda to meet local legal requirements.. A baseline global privacy standard with regional addenda provides a structured way to manage divergent legal requirements. It ensures that core privacy protections are applied consistently while allowing for local customization to meet data localization or transfer safeguard mandates. This approach is both compliant and scalable, and it maintains central oversight. Other options either oversimplify, fragment, or unnecessarily restrict operations, making them less effective for a multinational software company.

Answer

Delegate all privacy decision-making to local offices to ensure they comply with their own laws.

Answer

Prohibit cross-border transfers of personal data entirely to avoid complex compliance obligations.

Answer

Adopt a single global privacy policy that applies uniformly to all locations to simplify compliance.

Question 13

When using 'k-anonymity' to protect a dataset, what does the parameter 'k' represent?

Accepted Answer

The minimum number of records sharing the same quasi-identifiers. In k-anonymity, k is the minimum group size such that every record is indistinguishable from at least k-1 other records with respect to the quasi-identifier set (age, ZIP, gender, etc.). A dataset satisfies k-anonymity if each combination of quasi-identifier values appears at least k times, preventing re-identification by linking to external data. Higher k means stronger anonymity but greater information loss.

Answer

The number of attributes removed

Answer

The level of noise added to the data

Answer

The total number of rows in the dataset

Question 14

A financial services firm is implementing a new mobile banking app. The privacy engineer must ensure that data collected from the app is minimized and that users can easily withdraw consent. Which design pattern best supports these requirements?

Accepted Answer

Implement just-in-time consent prompts for each data collection purpose, and provide a simple toggle to withdraw consent.. Just-in-time consent prompts align with data minimization by collecting only what is needed for each purpose, and a simple toggle for withdrawal ensures user control. Blanket consent or complex withdrawal processes fail to meet privacy principles. Immediate anonymization without consent does not address consent requirements. Thus, the just-in-time approach is best.

Answer

Use a single consent at app installation for all current and future data uses, and require users to contact support to withdraw consent.

Answer

Collect data without consent but anonymize it immediately, and provide no consent withdrawal mechanism.

Answer

Collect all possible device and usage data upfront to avoid future app updates, and provide a complex consent withdrawal process.

Question 15

Which governance artifact is best for documenting the accountability for privacy decisions?

Accepted Answer

A Privacy Decision Log.. A Privacy Decision Log is a governance artifact specifically designed to record privacy-related decisions, the rationale behind them, the accountable owner, and the date — providing traceability and accountability. It directly supports demonstrating who decided what and why, which is essential for regulatory defensibility and internal governance. This makes it the best fit for documenting accountability for privacy decisions.

Answer

An email thread.

Answer

A standard operating procedure (SOP).

Answer

The company's mission statement.