CDPSE Practice Test 2 — 25 Questions

Question 1

A CDPSE practitioner is tasked with aligning the organization's privacy strategy with business goals. Which of the following activities should be prioritized to ensure that privacy governance is embedded within the Software Development Life Cycle (SDLC)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a Privacy Impact Assessment (PIA) during the initial requirements gathering phase.. Embedding privacy governance in the SDLC requires action at the earliest phase — requirements gathering — where a Privacy Impact Assessment (PIA) identifies privacy risks, legal obligations, and design constraints before any development begins. Conducting the PIA during requirements ensures privacy requirements are translated into functional and non-functional specifications, making privacy a built-in property rather than a post-hoc check. This aligns with privacy-by-design and GDPR Article 25 obligations.

Answer

Review the privacy policy after the product has been moved to general availability.

Answer

Perform a penetration test on the production environment after the release deployment.

Answer

Automate data deletion scripts after the data retention period has expired.

Question 2

A company wants to collect geolocation data from mobile users. Which privacy principle should be applied first?

Accepted Answer

Data minimization by requesting access to precise location only when necessary.. Data minimization is the foundational privacy principle that requires collecting only the personal data actually needed for a stated purpose. For geolocation, precise GPS coordinates are highly sensitive and intrusive, so the first question must be whether precise location is even necessary — coarse location or on-demand access may suffice. Applying minimization first reduces the scope of every downstream control (encryption, retention, disclosure), making it the correct starting point.

Answer

Automated archival of location history after one week.

Answer

Publicly disclosing the use of geolocation in the privacy policy.

Answer

Full encryption of geolocation data in transit.

Question 3

Which of the following is an example of a Privacy-Enhancing Technology (PET) that focuses on data minimization?

Accepted Answer

Synthetic data generation. Synthetic data generation is a Privacy-Enhancing Technology that focuses on data minimization because it creates artificial records that preserve statistical properties of the original dataset without containing any real personal data. This allows organizations to use, share, or analyze data without processing actual personal information, directly supporting the minimization principle. HSMs, AES-256, and vulnerability scanning are security controls, not data minimization PETs.

Answer

Hardware Security Modules (HSMs)

Answer

AES-256 Encryption

Answer

Vulnerability scanning

Question 4

A healthcare organization is establishing a privacy governance program. The board of directors wants to ensure that privacy risks are managed at the highest level. Which of the following is the PRIMARY responsibility of the board in privacy governance?

Accepted Answer

Reviewing and approving the privacy strategy and risk appetite.. The board's primary governance role is to provide strategic direction and oversight, which includes approving the privacy strategy and defining risk appetite. This sets the foundation for the entire privacy program and ensures that privacy is considered at the highest levels of decision-making.

Answer

Developing privacy training materials for employees.

Answer

Managing data subject access requests.

Answer

Conducting privacy impact assessments for new projects.

Question 5

A privacy engineer is implementing a data retention policy for a customer relationship management (CRM) system. The policy requires that customer records be retained for exactly 7 years and then automatically deleted. The CRM vendor offers a built-in retention feature that soft-deletes records after the period, but the records remain recoverable for 30 days. Which action should the engineer take to ensure compliance with the retention policy?

Accepted Answer

Use the built-in retention feature to soft-delete after 7 years, then schedule a separate process to permanently purge soft-deleted records after the 30-day recovery window.. The correct approach combines the vendor's retention feature for initial soft-deletion with a scheduled purge after the recovery window. This ensures permanent deletion at the required time while maintaining a controlled, auditable process. It respects the policy's exact retention period and avoids risky direct database operations or manual interventions.

Answer

Implement a custom script that hard-deletes records from the production database after 7 years, ignoring the vendor's soft-delete feature.

Answer

Extend the retention period to 7 years and 30 days to account for the soft-delete recovery window, then manually delete records via the CRM user interface.

Answer

Configure the built-in retention feature to soft-delete records after 7 years and rely on the vendor's backup expiration to permanently remove data.

Question 6

A financial services firm is deploying a new customer onboarding portal that collects income, employment, and identity documents. The privacy engineer must embed privacy controls into the software development lifecycle. Which engineering practice BEST ensures privacy requirements are validated before production release?

Accepted Answer

Integrate automated privacy test cases into the CI/CD pipeline.. Privacy engineering requires controls to be verified continuously and before release. Automated privacy test cases in the CI/CD pipeline enforce data minimization, consent, retention, and access rules on every build, producing repeatable evidence that the onboarding portal behaves as designed. This approach catches privacy regressions early and aligns with privacy by design and by default principles rather than relying on after-the-fact reviews or administrative attestations.

Answer

Conduct a privacy review only after the portal is deployed to production.

Answer

Perform a manual code review of the identity document upload module.

Answer

Require developers to sign an annual privacy awareness attestation.

Question 7

A CDPSE is reviewing a healthcare organization's data retention practices. The organization stores patient medical records, billing information, and appointment scheduling data in a cloud-based electronic health record (EHR) system. The CDPSE must ensure compliance with privacy regulations that require data to be kept only as long as necessary. Which TWO of the following actions are the MOST effective to establish and maintain a defensible data retention schedule? (Choose two.)

Accepted Answer

Implement automated deletion or anonymization processes that trigger at the end of each defined retention period.. Establishing a defensible retention schedule begins with knowing what data exists and what rules apply, which is achieved through a data inventory and classification. Then, the schedule must be enforced through automation to ensure timely deletion or anonymization. These two actions together provide the necessary foundation and operational mechanism. The other options either violate storage limitation principles or fail to ensure consistent compliance across the organization.

Answer

Store all patient data indefinitely to ensure it is available for future medical research or legal claims.

Answer

Document the retention schedule in a policy but allow individual departments to deviate as needed without central oversight.

Answer

Rely on the cloud provider's default retention settings for the EHR system to manage data lifecycle.

Question 8

When using Homomorphic Encryption, what is the primary limitation for a privacy engineer to consider?

Accepted Answer

Computational overhead. Homomorphic encryption allows computations on encrypted data without decryption, but the mathematical operations are extremely resource-intensive, leading to significant computational overhead. This overhead is the primary limitation because it can make real-time or large-scale processing impractical. Other options like data loss or inability to search are not inherent limitations of homomorphic encryption.

Answer

Data loss during processing

Answer

Inability to perform search

Answer

Lack of vendor support

Question 9

A privacy program manager is designing a data retention schedule for a new SaaS application that processes employee HR data. The schedule must comply with GDPR and other privacy regulations. Which TWO of the following are essential considerations when determining retention periods for different data categories? (Choose two.)

Accepted Answer

The legal and regulatory requirements that mandate minimum or maximum retention periods for specific data types, such as tax records or health information.. Retention periods must be based on legal requirements and the purpose of processing. Legal mandates set minimum or maximum periods, while data minimization requires that data not be kept longer than necessary for the specified purpose. Together, these ensure compliance and respect for privacy principles. Technical capabilities and cost are secondary implementation factors.

Answer

The technical capabilities of the SaaS application to automatically enforce retention and deletion, such as built-in retention labels or policies.

Answer

The storage cost associated with retaining data in the SaaS application's cloud infrastructure, to optimize the IT budget.

Answer

The preferences of the employees whose data is being processed, as expressed through consent forms or surveys.

Question 10

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Accepted Answer

A fully updated data inventory map showing data lineage.. The CCPA 'Right to Know' requires a business to disclose the specific categories and pieces of personal information it has collected, the sources of that information, the purposes of collection, and the third parties with whom it is shared. A fully updated data inventory map with data lineage is the only artifact that can trace each data element from collection point through processing and onward sharing, which is exactly what is needed to answer a consumer's or auditor's Right to Know request. Without this map, the organization cannot reliably produce the required disclosures.

Answer

Marketing brochures describing the product features.

Answer

The latest penetration test report for the customer portal.

Answer

A list of all employees with database access.

Question 11

Which of the following is a key objective of a data retention policy?

Accepted Answer

To minimize the amount of data stored and reduce risk. A data retention policy defines how long data is kept and when it should be securely disposed of. Its key objective is to minimize data storage to reduce risk, comply with legal requirements, and lower costs. By retaining only what is necessary, organizations limit exposure to breaches and regulatory penalties.

Answer

To maximize data availability

Answer

To increase storage capacity requirements

Answer

To keep all data forever for future AI training

Question 12

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Accepted Answer

Incorporate data minimization and purpose limitation settings during the architectural design phase.. Privacy-by-design requires that privacy controls be embedded at the earliest architectural stage, not bolted on later. Data minimization and purpose limitation are foundational GDPR principles (Article 5) that must be designed into the application's data flows before any code is written. Addressing them during architectural design prevents costly retrofits and ensures the behavioral tracking only collects what is necessary for the stated marketing purpose.

Answer

Enable automated data deletion scripts after the application deployment phase.

Answer

Configure the database to encrypt all fields regardless of sensitivity to ensure maximum protection.

Answer

Conduct a post-implementation audit to identify potential data leakage points.

Question 13

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Accepted Answer

To identify and mitigate privacy risks associated with a new data processing activity.. A DPIA is a structured risk assessment required by GDPR Article 35 for processing activities likely to result in high risk to data subjects' rights and freedoms. Its core purpose is to identify privacy risks arising from a new or changed processing operation and to define mitigations before processing begins. It is a proactive, accountability-focused instrument, not a budgeting, training, or availability exercise.

Answer

To calculate the budget required for security hardware.

Answer

To train employees on the company's privacy policies.

Answer

To verify the system uptime requirements of the application.

Question 14

Which governance structure is most appropriate for a decentralized organization managing privacy risks?

Accepted Answer

Hub-and-spoke model with localized privacy champions.. A hub-and-spoke model with localized privacy champions is most appropriate for a decentralized organization because it balances central oversight (hub) with local implementation (spokes). This structure ensures consistent privacy policies while allowing flexibility for regional differences and fostering accountability at the local level.

Answer

Ad-hoc committee based on project needs.

Answer

Outsourcing all privacy functions.

Answer

Centralized command-and-control structure.

Question 15

Which THREE components should be included in a data inventory to ensure it is actionable for DSR (Data Subject Request) fulfillment?

Accepted Answer

Storage location. A is correct because knowing the storage location (the specific system, database, application, or repository where personal data resides) is essential for locating and retrieving or deleting data when fulfilling a DSR such as access or erasure. B is correct because identifying the data owner/steward provides the accountable contact who can validate the request, authorize actions, and coordinate retrieval or deletion across systems. E is correct because recording the data category/type (for example identifiers, financial data, health data, or special categories under GDPR) lets teams determine what is in scope, apply the right exemptions, and respond accurately to access, portability, or erasure requests. C is not relevant because server uptime percentage is an availability/operations metric that does not help locate or classify personal data for DSR fulfillment. D is also not relevant because network bandwidth usage is a performance/capacity metric unrelated to identifying, classifying, or acting on personal data in response to a DSR.

Answer

Server uptime percentage

Answer

Network bandwidth usage

Question 16

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Accepted Answer

The lack of human intervention in automated decision-making processes.. The main privacy concern regarding the Right to Explanation in automated credit decisions is the lack of human intervention in automated decision-making processes. When a system makes credit decisions without meaningful human involvement, the data subject cannot obtain an explanation of the logic involved or contest the outcome, which undermines the right to explanation and the broader right not to be subject to solely automated decisions. This is the core tension that GDPR Article 22 and related transparency provisions address.

Answer

The system is too slow for real-time credit processing.

Answer

The cost of maintaining the automated system infrastructure.

Answer

The inability of the system to process non-numeric data types.

Question 17

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

Accepted Answer

Adopt a 'hub and spoke' privacy governance model.. A 'hub and spoke' privacy governance model centralizes policy-setting, standards, and oversight at the corporate hub while allowing local spokes to adapt implementation to jurisdictional legal variations. This balances global consistency with local compliance, ensuring that regional requirements (e.g., GDPR, CCPA, PIPL) are met without fragmenting the overall governance framework. It is the recommended approach for multinationals facing divergent privacy laws.

Answer

Standardize all data processing to occur only in the home country.

Answer

Allow each region to define its own privacy framework independently.

Answer

Enforce a single, global privacy policy that overrides all local laws.

Question 18

A privacy analyst is reviewing the organization's privacy governance documentation and notices that the roles and responsibilities for privacy are not clearly defined. According to generally accepted privacy governance principles, what is the most appropriate first step to address this gap?

Accepted Answer

Draft a privacy charter that assigns accountability to specific roles and obtains executive approval.. The analyst identified a lack of clearly defined privacy roles and responsibilities. The foundational step is to create a privacy charter that assigns accountability to specific roles and secures executive approval. This establishes the governance structure necessary for other activities like assessments, technology implementation, and training to be effective and properly directed.

Answer

Conduct a privacy impact assessment for all business processes.

Answer

Implement a new privacy technology solution to automate compliance monitoring.

Answer

Schedule privacy awareness training for all employees.

Question 19

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO's primary role is to monitor compliance with data protection laws and internal policies, and to advise the organization and its employees on data protection obligations. This is an advisory and monitoring function, not an operational or executive decision-making role. It is defined explicitly under GDPR Articles 37-39.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 20

A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?

Accepted Answer

server_side_encryption_configuration. In Terraform, the `server_side_encryption_configuration` block within an `aws_s3_bucket` resource is used to configure default encryption for the bucket. Setting its `sse_algorithm` to `aws:kms` enables SSE-KMS encryption at rest. This is the correct attribute to enforce encryption.

Answer

bucket_acl

Answer

versioning_enabled

Answer

public_access_block