CDPSE Practice Test 2 — 25 Questions

Question 1

A privacy analyst is conducting a data map in ServiceNow. Which feature allows them to link a database table directly to a 'Processing Activity' record?

Accepted Answer

Data Asset Mapping. ServiceNow's Privacy Management module uses 'Data Source Mapping' to link IT assets to business processes.

Answer

Workflow Designer

Answer

Configuration Item (CI) Relation

Answer

Business Service Mapping

Question 2

You are configuring a data retention policy in AWS S3 Lifecycle rules. Which action should be selected to minimize data storage costs while remaining compliant with privacy laws?

Accepted Answer

Transition to Glacier. Transitioning objects to 'Glacier Instant Retrieval' minimizes cost while keeping data available for audits.

Answer

Enable Versioning

Answer

Delete incomplete multipart uploads

Answer

Expire objects

Question 3

You are managing Azure Information Protection (AIP) labels. Which action is necessary to ensure that documents classified as 'Highly Confidential' are automatically encrypted?

Accepted Answer

Configure Protection settings in the Label. In AIP, label configuration requires selecting 'Encrypt' under the 'Protection' settings to enforce technical controls.

Answer

Modify the Information Rights Management (IRM) template

Answer

Apply Azure Policy

Answer

Enable Auto-Labeling on the Data Source

Question 4

In the context of data classification, which metadata field is most critical for determining the disposal date?

Accepted Answer

Retention Start Date. The 'Created Date' or 'Last Modified' field is the baseline for calculating the disposal date based on a fixed retention period.

Answer

Data Owner

Answer

Encryption Key ID

Answer

Classification Label

Question 5

Which TWO methods are commonly used to achieve data minimization in a legacy database?

Accepted Answer

Anonymization of records. Anonymization and data purging are direct methods to reduce the footprint of sensitive data.

Answer

Mirroring the database

Answer

Implementing multi-factor authentication

Answer

Increasing database indexing

Question 6

When using IBM InfoSphere Information Governance Catalog to map sensitive data, what is the primary purpose of a 'Data Class'?

Accepted Answer

To identify and classify sensitive data patterns. Data classes define the structure of data (e.g., Credit Card Number) to allow automated identification in the catalog.

Answer

To store physical data

Answer

To manage retention policies

Answer

To define user access

Question 7

Which THREE tasks are associated with 'Data Classification' during the life cycle?

Accepted Answer

Identifying sensitive data elements. Identifying data, assigning a label, and applying specific policy rules are the steps in classification.

Answer

Refreshing the server hardware

Answer

Backing up the database

Question 8

When designing a system with k-anonymity, which metric measures the impact of generalization on the utility of the data?

Accepted Answer

Discernibility penalty. Discernibility penalty measures how much the data has been degraded to achieve the k-anonymity requirement.

Answer

Epsilon value

Answer

Entropy loss

Answer

F-score

Question 9

Which TWO outcomes result from effective data classification?

Accepted Answer

Improved application of security controls. Classification enables targeted security controls and informs retention requirements.

Answer

Increased server processing speed

Answer

Reduction in data volume

Answer

Improved user interface design

Question 10

Which THREE components should be included in a data inventory to ensure it is actionable for DSR (Data Subject Request) fulfillment?

Accepted Answer

Storage location. To fulfill a DSR, you must know what the data is, who owns it, and where it resides.

Answer

Server uptime percentage

Answer

Network bandwidth usage

Question 11

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

Accepted Answer

The vendor lacks a documented process for handling data subject erasure requests.. Failure to provide a data subject right to erasure is a critical violation of privacy regulations.

Answer

The vendor uses a different database encryption algorithm than the organization.

Answer

The vendor's privacy policy is not written in the user's native language.

Answer

The vendor only updates their privacy policy once every two years.

Question 12

Which THREE documents are typically required for compliance with global privacy regulations?

Accepted Answer

Data Processing Agreements (DPAs) with third-party vendors.. A privacy notice, ROPA, and data processing agreements are standard compliance artifacts.

Answer

A daily log of all staff internet activity.

Answer

A list of all company-issued laptops.

Question 13

A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?

Accepted Answer

Cloud DLP de-identification template. Cloud DLP (Data Loss Prevention) triggers can be integrated to inspect and redact content in Cloud Storage.

Answer

IAM conditions

Answer

Storage Transfer Service

Answer

Bucket lock

Question 14

When using Homomorphic Encryption, what is the primary limitation for a privacy engineer to consider?

Accepted Answer

Computational overhead. Homomorphic encryption is extremely computationally intensive, often causing significant performance degradation.

Answer

Data loss during processing

Answer

Inability to perform search

Answer

Lack of vendor support

Question 15

You are integrating a homomorphic encryption library into a cloud-based financial system. What is the primary trade-off you must communicate to stakeholders regarding the implementation of Fully Homomorphic Encryption (FHE)?

Accepted Answer

Significant latency during computation. FHE is computationally expensive, leading to significant latency increases for complex analytical operations on encrypted data.

Answer

Incompatibility with cloud storage

Answer

Increased storage requirements

Answer

Loss of data integrity

Question 16

When managing data retention in Azure Data Lake Storage (ADLS) Gen2, how do you implement a policy that deletes files older than 7 years?

Accepted Answer

Configure a Lifecycle Management policy rule. Lifecycle management policies in ADLS allow you to define rules to delete blobs based on the number of days since last modification.

Answer

Apply a Data Loss Prevention policy

Answer

Create a Power Automate flow to scan the lake

Answer

Use Azure Data Factory to trigger a DELETE SQL query

Answer

Set the 'Delete' flag on the container

Question 17

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

Accepted Answer

The Record of Processing Activities (ROPA).. The Privacy Notice or the internal Record of Processing Activities (ROPA) outlines the legal basis for processing.

Answer

The vendor management list.

Answer

The firewall configuration log.

Answer

The employee handbook.

Question 18

When establishing a privacy steering committee, who should be included to ensure organizational support?

Accepted Answer

Senior representatives from Legal, IT, HR, and Marketing.. Executive sponsorship from cross-functional leadership is vital for authority.

Answer

Only the Human Resources team.

Answer

External consultants only.

Answer

Only the IT staff.

Question 19

In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API allows for the inspection, de-identification, and redaction of PII within unstructured data.

Answer

Cloud Storage buckets lifecycle policy

Answer

Cloud Identity and Access Management

Answer

Cloud Logging

Question 20

You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?

Accepted Answer

Apply suppression to direct identifiers. Quasi-identifiers must be identified, and direct identifiers must be suppressed or removed, as k-anonymity does not protect against direct identification.

Answer

Add synthetic noise

Answer

Normalize the dataset

Answer

Increase the k-value