CDPSE Practice Test 1 — 30 Questions

Question 1

A healthcare organization is implementing a data retention policy for electronic health records (EHRs) in a hybrid cloud environment. The policy must ensure that records are retained for the legally required period, then securely disposed of. Which approach best ensures compliance and secure disposal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a policy-driven retention system that automatically enforces retention periods and triggers cryptographic erasure of expired records across all storage tiers, with audit logs.. A policy-driven retention system with cryptographic erasure automates enforcement and ensures irreversible disposal across all copies. It addresses the complexity of hybrid cloud environments by removing reliance on manual processes. Audit logs provide accountability. This approach aligns with legal retention requirements and data minimization principles.

Answer

Store EHRs in an encrypted database and, upon retention expiry, delete the records and their backups manually, documenting each deletion in a log.

Answer

Use a third-party archival service to store EHRs indefinitely, and rely on the service provider's security certifications to ensure compliance.

Answer

Encrypt EHRs with a single organization-wide key and, at retention expiry, delete the key to render all records inaccessible, while keeping backups for disaster recovery.

Question 2

In the context of 'Privacy-Preserving Machine Learning', what is the purpose of the 'Membership Inference Attack' simulation during testing?

Accepted Answer

To identify if training data is leaked. A Membership Inference Attack (MIA) attempts to determine whether a specific individual's data was part of a model's training set. Simulating MIA during testing helps identify if the model leaks information about its training data, which is a privacy risk. The goal is not to improve model performance but to assess and mitigate privacy leakage.

Answer

To optimize model accuracy

Answer

To improve training speed

Answer

To validate input quality

Question 3

A CDPSE is advising a startup that has developed a mobile app for tracking fitness activities. The app collects users' heart rate, sleep patterns, and GPS location. The startup plans to use this data to provide personalized health insights and also to share aggregated data with research partners. Before launching, the CDPSE must ensure that the privacy policy reflects the appropriate legal basis for processing. Which of the following is the MOST appropriate legal basis for processing this health and location data under the GDPR?

Accepted Answer

Explicit consent, obtained from users after providing clear information about the processing purposes.. Processing health data (heart rate, sleep) and precise location data falls under special categories of personal data under the GDPR, requiring a higher legal basis. Explicit consent is the most appropriate and commonly used basis for such processing, as it ensures individuals are fully informed and agree to the specific uses. Other legal bases like legitimate interests, contract performance, or vital interests are either insufficient or inapplicable for sensitive data in this context.

Answer

Vital interests, because the health insights could potentially save lives in emergency situations.

Answer

Performance of a contract, because users agree to the app's terms of service upon download.

Answer

Legitimate interests, because the app provides benefits to users and research partners.

Question 4

A privacy engineer is configuring a database that stores personal data. To support the principle of access control, the engineer needs to ensure that users can only access data necessary for their role. Which database feature should be used to restrict access at the row level based on user attributes?

Accepted Answer

Row-level security (RLS) policies. Row-level security (RLS) policies are designed to restrict access to rows based on user attributes, such as role or department. This enables fine-grained access control, ensuring users only see data relevant to their role. Column-level encryption, views, and table-level RBAC do not provide dynamic row-level filtering per user, making them unsuitable for this requirement.

Answer

Role-based access control (RBAC) at the table level

Answer

Database views with WHERE clauses

Answer

Column-level encryption

Question 5

A privacy engineer is configuring a data retention policy for a system that processes customer personal data. The policy must automatically delete data after its retention period expires. Which technical control best ensures that personal data is not retained beyond its defined lifecycle?

Accepted Answer

Automated deletion jobs triggered by data age. Automated deletion jobs are the correct control because they systematically remove personal data once the retention period expires, directly enforcing the storage limitation principle. Other controls may protect or restrict access to data but do not ensure its deletion. This makes automated deletion the best technical fit for the stated policy requirement.

Answer

Data loss prevention (DLP) monitoring outbound traffic

Answer

Role-based access control restricting who can view the data

Answer

Database backup encryption

Question 6

A CDPSE is assessing a new automated decision-making system that profiles customers for credit approvals. The system uses machine learning and operates in the EU. Which GDPR requirement must be addressed before deployment?

Accepted Answer

A Data Protection Impact Assessment (DPIA) must be conducted because the processing involves systematic and extensive evaluation of personal aspects.. Automated profiling for credit decisions is high-risk processing under GDPR. Article 35(3)(a) specifically identifies systematic and extensive evaluation of personal aspects based on automated processing as a trigger for a DPIA. The DPIA must be completed before processing begins to identify and mitigate risks.

Answer

The company must obtain consent from all customers before using the automated system.

Answer

The company must appoint a Data Protection Officer because the system uses artificial intelligence.

Answer

The company must transfer all profiling data to the European Data Protection Board for review.

Question 7

A privacy engineer is reviewing a 'consent management platform' (CMP). Which configuration is necessary to ensure compliance with a user's choice to 'opt-out' of data sharing?

Accepted Answer

Programmatic propagation of the opt-out signal. For a CMP to honor an opt-out, the choice must be programmatically propagated to every downstream system, tag, SDK, or vendor that processes the user's data. A stored preference that never reaches ad tech, analytics, or CRM systems is functionally useless. Programmatic propagation (e.g., via consent strings, APIs, or tag managers) is what actually enforces the user's choice across the data ecosystem.

Answer

Sending an email confirmation to the user

Answer

Storing the choice in a local browser cookie only

Answer

Displaying the privacy policy on the landing page

Question 8

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.

Question 9

A privacy engineer is implementing a data minimization strategy for a microservices application deployed on Kubernetes. The application processes customer payment data in ephemeral pods. The engineer must ensure that sensitive data is not persisted beyond the processing window and that any residual data in the container filesystem is securely removed. Which approach BEST achieves this?

Accepted Answer

Configure the pods to use an emptyDir volume with medium: Memory and ensure the application writes sensitive data only to that volume.. The correct approach uses an emptyDir volume with medium: Memory, which stores data in RAM and automatically deletes it when the pod terminates. This ensures that sensitive payment data is not written to persistent storage and is securely removed upon pod deletion, satisfying data minimization and disposal requirements. Other options involve persistent storage or insecure mechanisms that leave residual data.

Answer

Mount a hostPath volume to a dedicated directory on the node and apply a cron job to delete files older than one hour.

Answer

Use a PersistentVolume with a StorageClass that supports encryption at rest and set the reclaim policy to Delete.

Answer

Store sensitive data in a ConfigMap and mount it as a volume, then delete the ConfigMap after processing.

Question 10

Which THREE types of data are typically targeted for aggressive minimization?

Accepted Answer

Redundant, Obsolete, and Trivial (ROT) data. Option B is correct because ROT data (Redundant, Obsolete, and Trivial) has no ongoing business or legal value, so it is a prime candidate for aggressive minimization to reduce storage costs and breach exposure. Option D is correct because financial and payment information (e.g., cardholder data under PCI DSS) is highly sensitive and subject to strict retention limits, making it a frequent target for minimization. Option E is correct because PII is protected by privacy regulations such as GDPR and CCPA, which mandate data minimization and storage limitation, so organizations aggressively purge unneeded PII. Option A is not typically minimized aggressively because system logs for performance analysis are often retained for troubleshooting, capacity planning, and security monitoring. Option C is not a minimization target because publicly available documentation contains no sensitive or regulated data and poses little risk if retained.

Answer

System logs for performance analysis

Answer

Publicly available documentation

Question 11

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

Accepted Answer

Maintaining a comprehensive Record of Processing Activities (ROPA).. A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

Answer

Conducting periodic penetration tests.

Answer

Updating the external privacy policy annually.

Answer

Signing NDAs with all employees.

Question 12

You are using AWS Macie to perform a classification scan. Which feature should be configured to notify the privacy team when sensitive data is found?

Accepted Answer

EventBridge Rule. Amazon Macie publishes findings to Amazon EventBridge, so configuring an EventBridge rule to match Macie finding events and route them to an SNS topic, Lambda, or ticketing system is the correct way to notify the privacy team. EventBridge is the native event-routing service that receives Macie's classification findings and can trigger downstream notifications. The other options are access-control, audit-logging, or storage-policy constructs, not notification mechanisms.

Answer

IAM User Permission

Answer

CloudTrail Log

Answer

S3 Policy

Question 13

Which THREE attributes are typically included in a 'Privacy Metadata' schema to support automated data governance?

Accepted Answer

Data owner identifier. Option A (Data owner identifier) is correct because privacy metadata schemas must record the accountable party (person or role) responsible for the data, enabling automated governance workflows such as access approvals, policy enforcement, and incident routing. Option C (Data retention policy) is correct because retention rules define how long data may be kept and when it must be deleted or archived, which automated governance tools use to trigger lifecycle actions and enforce compliance (e.g., GDPR storage limitation). Option E (Data classification label) is correct because classification (e.g., Public, Internal, Confidential, PII) drives automated handling rules such as encryption, masking, access control, and DLP policies. Option B (Database server IP) is not a privacy metadata attribute; it is infrastructure/asset metadata used for network or inventory purposes, not for describing privacy characteristics of the data. Option D (System uptime monitor) is unrelated operational telemetry about availability, not privacy governance metadata.

Answer

Database server IP

Answer

System uptime monitor

Question 14

Which technique should be used to protect personal data during software testing?

Accepted Answer

Data masking or using synthetic data sets.. Data masking and synthetic data sets protect personal data during testing by ensuring testers work with realistic but non-identifiable or fabricated records. Masking replaces sensitive fields (names, SSNs, card numbers) with fictitious values while preserving format and referential integrity, and synthetic data is generated from scratch so no real individual is represented. This satisfies privacy principles like data minimization and purpose limitation because production PII is never exposed in lower-trust test environments.

Answer

Implementing strict multi-factor authentication for developers.

Answer

Full encryption of the test database.

Answer

Restricting the test environment access to only senior engineers.

Question 15

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and device identifiers. The privacy team must determine the lawful basis for processing under the GDPR. The program requires customers to agree to share data with third-party marketing partners. Which lawful basis is most appropriate for this processing activity?

Accepted Answer

Consent. The correct basis is consent because the processing involves sharing personal data with third-party marketing partners, which is not necessary for contract performance or legal compliance, and legitimate interests would likely be overridden by data subject rights. Consent ensures individuals have control over their data and is explicitly required when data is used for marketing beyond the original purpose.

Answer

Legitimate interests

Answer

Contractual necessity

Answer

Legal obligation

Question 16

A financial institution is building a data life cycle management program. The privacy team must ensure that personal data is properly governed from creation to disposal. Which two practices are essential for maintaining data quality and compliance throughout the life cycle? (Choose two.)

Accepted Answer

Implementing automated data classification at ingestion.. Automated classification at ingestion and regular data quality audits are foundational for governing data throughout its life cycle. Classification ensures policies are applied consistently from the start, while audits verify ongoing accuracy and compliance. Encryption, centralization, and uniform retention are either too narrow or potentially harmful, and do not address the breadth of life cycle governance.

Answer

Storing all data in a single centralized repository.

Answer

Applying the same retention period to all data types.

Answer

Encrypting all data at rest and in transit.

Question 17

When configuring a 'Data Disposal' process, why is it critical to verify the 'Chain of Custody'?

Accepted Answer

To verify the data was deleted securely. Chain of Custody documentation proves that data was handled, transferred, and destroyed by authorized parties without tampering or gaps. During disposal, it provides auditable evidence that the correct data was securely deleted at the right time by the right people, which is essential for regulatory compliance (GDPR, HIPAA, PCI DSS) and for defending against claims of improper destruction. Without it, an organization cannot demonstrate that disposal actually occurred as required.

Answer

To ensure the database is faster

Answer

To identify who shared the data

Answer

To increase storage space

Question 18

When privacy governance is integrated into IT governance, what is the most significant benefit?

Accepted Answer

Improved visibility and efficiency of privacy controls.. Integrating privacy governance into IT governance yields improved visibility and efficiency of privacy controls because privacy requirements become part of standard IT processes, risk registers, and change management. This alignment ensures privacy controls are monitored, measured, and reported alongside other IT controls, reducing duplication and gaps. The result is more consistent enforcement and better evidence for audits and regulators.

Answer

Total replacement of the IT department.

Answer

Elimination of IT costs.

Answer

Simplification of external legal audits.

Question 19

When evaluating a third-party's security, what should the CDPSE focus on to ensure effective privacy risk management?

Accepted Answer

The right to audit the vendor's privacy and security controls.. The right to audit is the contractual mechanism that gives the CDPSE ongoing assurance that a third party's privacy and security controls actually operate as claimed. Without audit rights, the organization cannot independently verify vendor compliance, making it impossible to manage privacy risk effectively across the vendor lifecycle. This is a foundational third-party risk management control emphasized in privacy and security frameworks.

Answer

The visual design of the vendor's public-facing website.

Answer

The vendor's number of employees.

Answer

The vendor's annual marketing expenditure.

Question 20

When designing a privacy-preserving data pipeline, which TWO strategies help achieve 'Data Minimization'?

Accepted Answer

Truncating or hashing identifiers before ingestion. Data minimization means collecting and keeping only the personal data that is strictly necessary for the stated purpose, so option B is correct: truncating or hashing identifiers before ingestion removes or de-identifies direct identifiers so the pipeline never stores more identifying detail than needed. Option E is also correct because aggregating data points to a higher level of abstraction reduces granularity and prevents individual-level records from being retained, which directly limits the amount of personal data processed. Option A is wrong because disabling all audit logging does not minimize data; it removes accountability and security controls, and audit logs are typically required for compliance. Option C is wrong because increasing backup retention keeps personal data longer, which contradicts minimization and storage-limitation principles. Option D is wrong because storing all raw data in a data lake for future use is the opposite of minimization, as it retains maximal data beyond current necessity.

Answer

Disabling all audit logging

Answer

Increasing the retention period for backups

Answer

Storing all raw data in a data lake for future use