CDPSE Practice Test 5 — 25 Questions

Question 1

You are configuring AWS Macie to identify PII in an S3 bucket. Which setting must be enabled to ensure that specific sensitive data patterns are detected across all files regardless of their object tags?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom data identifiers. Custom data identifiers allow for the definition of regex patterns to scan the entire content of S3 objects, rather than relying on metadata tags.

Answer

IAM Role trust policy

Answer

S3 Bucket Policy modification

Answer

S3 Object Lock

Question 2

When using 'k-anonymity' to protect a dataset, what does the parameter 'k' represent?

Accepted Answer

The minimum number of records sharing the same quasi-identifiers. k-anonymity ensures that any individual in the dataset cannot be distinguished from at least k-1 other individuals.

Answer

The number of attributes removed

Answer

The level of noise added to the data

Answer

The total number of rows in the dataset

Question 3

Which THREE of the following are essential elements of a privacy governance framework?

Accepted Answer

Continuous monitoring and auditing of privacy controls.. Policies, roles, and monitoring are the classic pillars of a governance framework.

Answer

A collection of all company invoices.

Answer

A list of employee salaries.

Question 4

Which of the following is an effective way to implement 'Right to Erasure' in a distributed database system?

Accepted Answer

Asynchronous deletion across nodes. A centralized deletion service that triggers asynchronous deletion tasks across all nodes and backups ensures full removal.

Answer

Deleting the entire database

Answer

Marking records as deleted

Answer

Overwriting with new user data

Question 5

Which TWO methods are effective for preventing 'Inference Attacks' in a data analytics platform?

Accepted Answer

Query throttling/auditing. Differential privacy and query auditing/throttling help prevent attackers from inferring sensitive data from multiple queries.

Answer

Disabling all encryption

Answer

Full public data access

Answer

Raw data export

Question 6

Which THREE considerations are critical when implementing 'Anonymization' to ensure it meets the standard of being 'irreversible'?

Accepted Answer

Prevention of inference attacks where attributes can be predicted. Irreversibility requires removing all quasi-identifiers, ensuring no linkage is possible, and preventing inference attacks.

Answer

Requirement for user consent

Answer

Encrypting the data with AES-256

Question 7

A privacy engineer is implementing 'Tokenization' for credit card processing. Where should the 'vault' be situated to ensure the highest level of privacy?

Accepted Answer

In a physically or logically segregated environment. The vault containing the cleartext data must be isolated in a highly secure environment, often off-site or in a segregated network segment, to minimize the PCI-DSS scope.

Answer

In the same database as the application logs

Answer

On the end-user's local workstation

Answer

Integrated directly into the web server memory

Question 8

Which THREE techniques are commonly used to achieve 'Pseudonymization' for PII in data sets?

Accepted Answer

Partial masking. Tokenization, hashing (with salt), and masking (partial) are all accepted methods for pseudonymization.

Answer

Data deletion

Answer

Encryption without key management

Question 9

How can a CDPSE ensure that personal data is only kept for as long as necessary?

Accepted Answer

Implementing automated retention and disposal schedules in the data management system.. Implementing automated data retention and deletion policies ensures compliance with storage limitation principles.

Answer

Requiring employees to delete their own emails after one year.

Answer

Manually reviewing every file in the database each month.

Answer

Conducting annual security training for all staff.

Question 10

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

Accepted Answer

Information regarding health or medical records.. Biometrics, political opinions, and health data are classified as sensitive due to the high risk they pose to individuals.

Answer

Publicly available business contact email addresses.

Answer

The browser version used by the visitor.

Question 11

A web application stores user logs in a cleartext format. To implement 'Privacy by Design', which technical control is the most appropriate first step to minimize data exposure?

Accepted Answer

Apply data masking to the log fields. Data minimization ensures that only necessary data is collected and stored, reducing the attack surface immediately.

Answer

Rotate encryption keys weekly

Answer

Implement full-disk encryption

Answer

Enable verbose logging for debugging

Question 12

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO acts as an independent advisor and oversight function for privacy compliance.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 13

In a federated learning architecture, how is the model trained without exposing the underlying local datasets?

Accepted Answer

By sending locally computed gradients to a central server. Federated learning works by sending the global model to local nodes, training it locally, and sending only the parameter updates (gradients) back to the central server.

Answer

By using homomorphic encryption for every data point

Answer

By moving all datasets to a centralized data lake

Answer

By anonymizing the data using k-anonymity

Question 14

Which THREE of the following are considered standard 'Privacy-Enhancing Technologies' (PETs) used for data protection in analytics?

Accepted Answer

Differential Privacy. Differential privacy, secure multi-party computation, and homomorphic encryption are core PETs designed for privacy-preserving computation.

Answer

Network Intrusion Detection System

Answer

Full-Disk Encryption

Question 15

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A structured risk assessment is necessary to weigh the business need against privacy risk.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.

Question 16

When implementing a privacy management system, what is the best approach to gain executive support?

Accepted Answer

Aligning privacy objectives with business value and risk management.. Business leaders care about risk, brand, and cost; framing privacy in these terms is the most effective approach.

Answer

Asking for unlimited funding for software tools.

Answer

Sending a list of all regulatory articles.

Answer

Threatening the board with fines.

Question 17

Which THREE items should be included in a Privacy Impact Assessment (PIA) report?

Accepted Answer

Assessment of privacy risks to individuals.. A PIA must identify the data, the risks, and the mitigation plan.

Answer

The cafeteria's weekly menu.

Answer

The names of all employees in the marketing department.

Question 18

Which of the following is the most effective technical control for implementing the 'Right to be Forgotten' in a distributed microservices environment?

Accepted Answer

Implementing a centralized 'Identity Deletion' event bus. A centralized identity service allows for the systematic propagation of deletion requests across all downstream services.

Answer

Deleting individual database records in each service

Answer

Archiving logs for 7 years

Answer

Increasing database logging levels

Question 19

In the context of the NIST Privacy Framework, what is the primary role of the 'Govern' (GV) function?

Accepted Answer

Communicating privacy risks to stakeholders.. The GV function focuses on understanding organizational context and risk management strategy.

Answer

Creating data erasure requests.

Answer

Detecting privacy breaches.

Answer

Implementing technical access controls.

Answer

Archiving personal data.

Question 20

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

Accepted Answer

Appointing a privacy champion in each agile squad.. Privacy champions embedded in squads ensure privacy is addressed throughout the agile cycle.

Answer

Requiring a full DPIA before every sprint.

Answer

Waiting for the security sign-off at the end of the project.

Answer

Hard-coding privacy requirements in the source code.