CDPSE Practice Test 23 — 15 Questions

Question 1

A global financial services firm is subject to GDPR and is establishing a privacy governance structure. The board wants to ensure that privacy risks are reported at the highest level. Which reporting structure best achieves this while maintaining operational independence for the privacy office?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Chief Privacy Officer reports directly to the board of directors or a board-level risk committee.. For a global financial services firm subject to GDPR, the privacy office must have independence and direct access to the board. Reporting to a board-level committee ensures that privacy risks are considered at the highest level and that the privacy office can operate without conflicts of interest. This structure supports compliance and effective governance.

Answer

The Chief Privacy Officer reports to the Chief Marketing Officer (CMO).

Answer

The Chief Privacy Officer reports to the Chief Financial Officer (CFO).

Answer

The Chief Privacy Officer reports to the Chief Information Security Officer (CISO).

Question 2

In MongoDB, what is the most effective way to ensure data minimization regarding personally identifiable information?

Accepted Answer

Dropping unused fields from the document schema. Dropping unused fields from the MongoDB document schema is the most effective data-minimization technique because it eliminates PII that is not needed for the application's purpose, directly satisfying GDPR/CCPA minimization principles. MongoDB's flexible schema makes it easy to accumulate legacy fields over time, so schema hygiene — removing fields no longer used — is the primary lever for reducing the PII footprint. This reduces both storage and breach exposure.

Answer

Increasing the backup frequency

Answer

Adding more nodes to the cluster

Answer

Indexing all fields

Question 3

Which THREE of the following are benefits of a centralized privacy governance model?

Accepted Answer

Simplified communication of privacy standards to all regions.. Option B is correct because a centralized privacy governance model establishes a single authoritative source for privacy standards, which makes it far simpler to communicate those standards uniformly to every region rather than reconciling multiple decentralized messages. Option C is correct because centralization consolidates privacy data, metrics, and accountability into one function, enabling senior management to perform oversight and generate reports more easily and reliably. Option E is correct because a single governing body creates and enforces one set of policies, yielding consistent application of privacy requirements across the entire entity. Option A is incorrect because centralization typically reduces, not increases, costs by eliminating duplicate efforts. Option D is incorrect because no governance model permits ignoring local laws; a centralized model must still accommodate regional legal requirements.

Answer

Higher costs due to duplicate efforts.

Answer

The ability to ignore local laws.

Question 4

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

Accepted Answer

Notification to the relevant Supervisory Authority.. Option D is correct because under GDPR Article 33, the controller must notify the relevant Supervisory Authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. Option E is correct because under GDPR Article 34, when a breach is likely to result in a high risk to the rights and freedoms of data subjects, the controller must also communicate the breach to the affected data subjects without undue delay, using clear and plain language. Option A is incorrect because destroying all backup tapes is not a notification obligation and could actually impede breach investigation, remediation, and legal compliance. Option B is incorrect because paying a fine is a potential consequence of non-compliance, not a required notification action following a breach. Option C is incorrect because a public social media announcement is not a prescribed notification channel; notifications must go to the Supervisory Authority and, when required, directly to affected data subjects.

Answer

Destruction of all backup tapes to prevent further access.

Answer

Payment of a fine to the local government.

Answer

Immediate public announcement on social media.

Question 5

A privacy engineer is implementing a data anonymization pipeline for a dataset containing user records. The goal is to prevent re-identification while maintaining data utility for analytics. Which two techniques should be applied to achieve this? (Choose two.)

Accepted Answer

Adding random noise to numerical values. Generalization and adding random noise are effective anonymization techniques that balance privacy and utility. Generalization reduces data precision to make records less unique, while noise addition (e.g., differential privacy) protects individual data points without destroying aggregate patterns. Suppression of all quasi-identifiers harms utility, encryption is reversible, and hashing alone is insufficient for anonymization.

Answer

Suppression of all quasi-identifiers

Answer

Encrypting the dataset with AES-256

Answer

Hashing all direct identifiers with SHA-256

Question 6

Which principle is represented by ensuring a user's data is only available to the specific application service that needs it?

Accepted Answer

Principle of least privilege. The principle of least privilege states that a user, process, or service should be granted only the minimum access rights necessary to perform its function. Restricting a user's data so that only the specific application service that needs it can access it is a direct application of least privilege — access is scoped to the narrowest set of consumers required. This limits exposure if other services or users are compromised.

Answer

Data segregation

Answer

Data portability

Answer

Data availability

Question 7

An organization is conducting a privacy maturity assessment. Which item represents the highest level of maturity in privacy policy development?

Accepted Answer

Policies that are embedded into automated workflows and continuously updated based on metrics.. The highest maturity level in privacy policy development is achieved when policies are embedded into automated workflows and continuously refined using metrics — this reflects an optimized, adaptive, and measurable governance process. This aligns with top levels of maturity models (e.g., CMMI Level 5 or the AICPA/CIPT maturity tiers) where processes are quantitatively managed and continuously improved. Automation ensures consistent enforcement, while metrics drive evidence-based updates.

Answer

An annual policy review conducted by the legal team.

Answer

A static document published on the corporate intranet.

Answer

A policy signed by all employees once every five years.

Question 8

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Accepted Answer

The existence of an adequacy decision by the European Commission for the destination country.. Option A is correct because under GDPR Chapter V, a transfer of personal data to a third country is lawful without further authorization when the European Commission has issued an adequacy decision under Article 45 recognizing that the destination country ensures an adequate level of data protection. Option C is correct because, in the absence of an adequacy decision, Article 46 permits the transfer if the controller or processor provides appropriate safeguards, such as Standard Contractual Clauses (SCCs) adopted by the Commission, binding corporate rules, or an approved certification mechanism. Option B is incorrect because merely having a local office in the destination country does not itself establish a lawful transfer mechanism under GDPR. Option D is incorrect because network speed is an operational performance consideration, not a legal basis for cross-border data transfer. Option E is incorrect because the CIO's personal preference regarding cloud providers is irrelevant to the GDPR legal analysis of whether a transfer is lawful.

Answer

The availability of a local office in the destination country.

Answer

The speed of the network connection between the two countries.

Answer

The preference of the chief information officer regarding cloud providers.

Question 9

A CDPSE is evaluating the effectiveness of a privacy program's risk treatment plan. The organization has implemented a new consent management platform that records and honors user preferences across web and mobile channels. Which metric BEST demonstrates that the treatment has reduced the risk of processing without valid consent?

Accepted Answer

The percentage of processing activities that are blocked or adjusted when consent is absent or withdrawn.. To demonstrate that a consent management platform reduces the risk of processing without valid consent, the organization must measure enforcement—whether processing is actually blocked or adjusted when consent is absent or withdrawn. This metric directly ties the control to the risk. Other metrics, such as acceptance rates or record counts, reflect activity or user behavior but not the effectiveness of the control in preventing invalid processing.

Answer

The percentage of users who accept all cookies on the first visit.

Answer

The average time taken to display the consent banner on page load.

Answer

The number of consent records stored in the platform.

Question 10

Which TWO attributes are essential to include in a data mapping register for privacy compliance?

Accepted Answer

Purpose of processing. Option C (Purpose of processing) is essential because privacy regulations such as GDPR Article 5(1)(b) require purpose limitation, meaning each data element must be tied to a documented, legitimate processing purpose in the mapping register. Option E (Location of the data) is essential because it identifies where personal data resides and is transferred, which is needed to satisfy cross-border transfer rules (e.g., GDPR Chapter V, Schrems II) and to enforce data residency and access controls. Options A (Hardware serial number) and D (Operating system version) are asset-management details that do not describe personal data flows or processing rationale, and Option B (Daily electricity consumption) is unrelated operational data, so none of these belong in a privacy-focused data mapping register.

Answer

Hardware serial number

Answer

Daily electricity consumption

Answer

Operating system version

Question 11

Which TWO of the following are privacy-by-design principles relevant to software development?

Accepted Answer

Proactive and preventative. Option A, 'Proactive and preventative,' is correct because privacy-by-design, as articulated by Ann Cavoukian, requires anticipating and preventing privacy risks before they occur rather than remediating them after a breach or complaint. Option B, 'Privacy by Default,' is correct because it mandates that the most privacy-protective settings apply automatically without requiring user action, ensuring personal data is protected by default. In contrast, option C, 'Maximum data retention,' contradicts the data-minimization and storage-limitation principles, which require keeping personal data only as long as necessary. Option D, 'Maximize development speed,' is a business goal unrelated to privacy principles and can conflict with proper privacy safeguards. Option E, 'Focus on user interface color,' concerns visual design aesthetics and has no bearing on privacy-by-design principles.

Answer

Maximum data retention

Answer

Maximize development speed

Answer

Focus on user interface color

Question 12

A privacy engineer is configuring a data retention policy for a marketing analytics platform. The policy states that raw event data containing device identifiers must be deleted after 90 days, while aggregated campaign metrics may be retained indefinitely. Which mechanism should be implemented to enforce this policy automatically?

Accepted Answer

A scheduled job that deletes raw event records older than 90 days.. Time-based retention requires an automated deletion mechanism that removes or irreversibly anonymizes raw records once the retention period expires. A scheduled job targeting records older than 90 days enforces the policy deterministically and leaves aggregated metrics intact. Visibility controls, permission changes, and egress blocking do not eliminate the stored personal data, so they cannot satisfy the retention requirement.

Answer

An access control list that removes analyst permissions after 90 days.

Answer

A database view that hides records older than 90 days from analysts.

Answer

A data loss prevention rule that blocks export of old event data.

Question 13

During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?

Accepted Answer

Ranger Policy Engine. Privacera enforces column-level access policies on Hive tables through the Apache Ranger Policy Engine, which provides centralized authorization and fine-grained row/column filtering. Privacera integrates with Ranger to translate its data access policies into Ranger policies that HiveServer2 enforces at query time, enabling column masking and filtering without altering the underlying data.

Answer

SQL Grant Statements

Answer

Column Encryption

Answer

View-Based Restriction

Question 14

A privacy engineer is implementing a consent management system for a mobile application. The app collects location data for personalized recommendations. Users must be able to withdraw consent at any time, and the app must stop processing location data immediately upon withdrawal. Which technical design best meets these requirements?

Accepted Answer

Implement a centralized consent service that propagates consent changes to all app instances and backend services in real time.. A centralized consent service is the most effective design because it propagates consent changes in real time to all app instances and backend services, ensuring immediate cessation of processing upon withdrawal. It provides a single source of truth for consent status, enabling consistent enforcement and auditability.

Answer

Store consent status in a local database on the device and check it before each location data collection.

Answer

Use a third-party analytics SDK that respects the device's global privacy settings for ad tracking.

Answer

Collect location data only when the app is in the foreground and prompt for consent each time.

Question 15

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

Accepted Answer

Setting default retention periods to automatically delete data that is no longer needed.. Data minimization is a core privacy principle requiring that only data strictly necessary for a defined purpose be collected and that it not be kept longer than needed. Option B is correct because setting default retention periods that automatically delete data no longer needed enforces storage limitation, ensuring data is purged once its purpose expires rather than retained indefinitely. Option C is correct because limiting collection to only what is strictly necessary for the stated purpose directly implements the collection-side of data minimization, reducing the volume and scope of personal data processed. Option A is incorrect because collecting all possible data points is the opposite of minimization, expanding data collection beyond necessity. Option D is incorrect because increasing database storage capacity addresses infrastructure, not the amount or lifespan of personal data collected. Option E is incorrect because publicly exposing personal data on the intranet grossly violates confidentiality and minimization principles.

Answer

Collecting all possible user data points to prepare for future analysis.

Answer

Increasing the storage capacity of the database server.

Answer

Making all personal data publicly available on the company intranet.