CDPSE Practice Test 3 — 30 Questions

Question 1

A privacy engineer is designing a new mobile health application that will collect continuous heart rate data from wearable sensors. The application must comply with GDPR and the organization's privacy policy, which mandates data minimization and purpose limitation. The engineer proposes storing raw sensor data indefinitely to support future research. Which action should the engineer take to align with privacy engineering principles?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a data retention schedule that automatically deletes raw sensor data after a defined period, retaining only aggregated or anonymized data for research.. The correct action is to implement a retention schedule that deletes raw data after a defined period and retains only aggregated or anonymized data for research. This enforces data minimization and storage limitation, key privacy engineering principles. Encryption, consent, and access controls are important but do not replace the need to limit data retention to what is necessary for the specified purpose.

Answer

Encrypt the raw sensor data at rest and in transit, and store it indefinitely because encryption protects against unauthorized access.

Answer

Store raw sensor data in a separate database with strict access controls, and allow only the research team to access it for any purpose.

Answer

Obtain explicit consent from users to store their data indefinitely for future research, and rely on that consent as the legal basis.

Question 2

A hospital's privacy team discovers that backup tapes containing patient records are kept indefinitely because the backup software's retention policy was never configured. The tapes are stored offsite and are not indexed, making it impossible to locate individual records. Which action should the privacy team take FIRST to address this data life cycle risk?

Accepted Answer

Implement a documented retention schedule for backup media that aligns with the hospital's data retention policy and legal hold requirements, then apply it to the backup software.. The core failure is the lack of a defined retention period for backup media, which leads to indefinite storage of patient records. A documented retention schedule aligned with legal and operational requirements is the foundational control. Once established, it can be applied to the backup software to automate disposal, ensuring data is not kept longer than necessary and that legal holds are respected.

Answer

Immediately erase all offsite backup tapes to eliminate the risk of unauthorized access.

Answer

Encrypt the backup tapes and continue storing them indefinitely.

Answer

Create an index of the backup tapes so that individual records can be located for access requests.

Question 3

A multinational retailer is implementing a data life cycle management program. The privacy team must ensure that personal data collected in the EU is not retained longer than necessary and that disposal is verifiable. Which two controls are essential to meet these objectives? (Choose two.)

Accepted Answer

Define and enforce retention periods for each data category based on business, legal, and regulatory requirements.. To ensure data is not retained longer than necessary and that disposal is verifiable, the program must define and enforce retention periods and implement automated deletion with audit logs. Retention periods set the 'when' for disposal, while automated workflows with logging provide the 'how' and the evidence. Other controls like encryption or training are valuable but do not directly achieve these specific objectives.

Answer

Encrypt all personal data at rest using AES-256.

Answer

Conduct annual privacy training for all employees.

Answer

Store all personal data in a single centralized database to simplify management.

Question 4

A marketing team wants to use customer email addresses for a new promotional campaign. The privacy office determines that the original consent was limited to order fulfillment. What is the most appropriate action under data life cycle management principles?

Accepted Answer

Obtain fresh consent from customers for the marketing purpose before using their email addresses.. The original consent was limited to order fulfillment, so using the email addresses for marketing requires a new lawful basis. Obtaining fresh consent is the most appropriate action because it respects the data subject's choice and complies with purpose limitation. Other options either ignore consent requirements or fail to achieve the marketing objective, making them unsuitable.

Answer

Use the email addresses for the campaign because the data is already collected and stored.

Answer

Proceed with the campaign but include an opt-out link in every email.

Answer

Anonymize the email addresses and then use them for the campaign.

Question 5

A multinational e-commerce company is implementing a privacy-preserving data analytics pipeline. The pipeline ingests customer behavior events from web and mobile apps, and analysts need to query the data without accessing raw PII. The company wants to ensure that even if the analytics environment is compromised, raw PII remains protected. Which approach best achieves this?

Accepted Answer

Tokenize PII at ingestion and store tokens in a separate vault; analysts query only tokenized data.. Tokenization at ingestion with a separate vault ensures that raw PII never enters the analytics environment. Analysts query tokenized data, preserving analytical utility while protecting PII. Encryption with key access or row-level security still allows access to raw PII under certain conditions. Thus, tokenization with a vault is the most effective approach.

Answer

Store raw events in an encrypted Amazon S3 bucket and provide analysts with decryption keys.

Answer

Use column-level encryption in the analytics database and grant analysts access to encrypted columns.

Answer

Implement row-level security (RLS) in the analytics database to filter PII based on user role.

Question 6

A healthcare analytics team wants to share a patient dataset with an external research partner for statistical modelling. The dataset contains direct identifiers such as full names, national ID numbers, and dates of birth. The privacy engineer must ensure that re-identification risk is minimized before sharing. Which technique should be applied FIRST to the dataset?

Accepted Answer

Suppress or generalize the direct identifiers and quasi-identifiers.. De-identification begins by removing or generalizing the attributes that make a record unique. Direct identifiers and quasi-identifiers must be transformed before any statistical disclosure control technique can be effective. Applying suppression or generalization first lowers the maximum re-identification risk and creates the conditions under which techniques such as k-anonymity, l-diversity, or differential privacy can be meaningfully applied to the shared dataset.

Answer

Add a random noise value to each numeric field in the dataset.

Answer

Hash the national ID numbers with a SHA-256 algorithm.

Answer

Apply format-preserving encryption to the direct identifiers.

Question 7

A privacy engineer is designing a data subject access request (DSAR) fulfillment pipeline that spans a primary PostgreSQL database, a data lake in Parquet format, and a search index. The engineer needs a technical mechanism that allows a single DSAR query to locate all records for a data subject across these heterogeneous stores without duplicating PII into a central repository. Which approach is MOST appropriate?

Accepted Answer

Implement a pseudonymous correlation identifier that is propagated to every store at ingestion time, and query each store by that identifier.. A pseudonymous correlation identifier propagated to each store at ingestion lets the DSAR pipeline query each system directly by a stable, non-PII key. This avoids creating a central PII copy, respects least privilege, and scales across heterogeneous stores. The mapping from the identifier back to the data subject remains in a controlled vault.

Answer

Consolidate all three stores into a single PostgreSQL instance so that a single SQL query can retrieve the data subject's records.

Answer

Build a central DSAR index that stores a copy of all PII from each store to enable fast lookups.

Answer

Require each store to expose a full-table scan API so the DSAR service can search for any PII pattern on demand.

Question 8

A privacy engineer is configuring a data retention schedule for a new cloud-based CRM that stores customer contact details and purchase history. The organization operates in multiple jurisdictions and must ensure that records are kept only for the period necessary for the stated business purpose, after which they are securely deleted. Which of the following should the engineer implement FIRST to align retention with the data life cycle management principle of storage limitation?

Accepted Answer

Define retention periods based on business purpose and legal requirements, then apply them via automated deletion rules in the CRM.. Storage limitation under data life cycle management requires that personal data be kept only as long as necessary for its purpose. The most effective first step is to define retention periods based on business and legal needs, then enforce them through automated deletion rules in the system of record. This ensures consistent, auditable disposal and directly operationalizes the principle across jurisdictions.

Answer

Implement field-level encryption for all PII fields and rotate encryption keys annually.

Answer

Create a manual process where data stewards review and delete records quarterly.

Answer

Enable automatic archiving of all CRM records to cold storage after 12 months.

Question 9

A multinational retailer is expanding its e-commerce operations into Brazil. The privacy team must determine whether the country's data protection authority can impose administrative fines directly on the company for privacy violations. Which legal framework should the CDPSE reference to assess this enforcement risk?

Accepted Answer

Lei Geral de Proteção de Dados (LGPD). The LGPD is Brazil's primary data protection law, and it grants the ANPD the power to investigate and sanction organizations for non-compliance. For a retailer expanding into Brazil, the LGPD is the correct framework to assess potential fines and enforcement actions. Other laws like GDPR or CCPA may have extraterritorial reach, but they do not govern Brazilian enforcement.

Answer

Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) System

Answer

General Data Protection Regulation (GDPR)

Answer

California Consumer Privacy Act (CCPA)

Question 10

A privacy engineer is configuring a new Amazon S3 bucket that will store customer transaction logs containing personal data. The organization's privacy policy requires that data be automatically deleted 90 days after creation to comply with data minimization principles. The engineer needs to implement this requirement with minimal operational overhead. Which solution should the engineer use?

Accepted Answer

Configure an S3 Lifecycle rule with an expiration action to delete objects 90 days after creation.. The correct solution is to use an S3 Lifecycle rule with an expiration action, which automatically deletes objects after 90 days. This enforces the retention policy natively, with minimal administrative effort and no custom code. Other options either retain data (versioning, Glacier transition) or require unnecessary custom development.

Answer

Enable S3 Versioning and configure a lifecycle rule to expire noncurrent versions after 90 days.

Answer

Use AWS Lambda to scan the bucket daily and delete objects older than 90 days.

Answer

Create an S3 Lifecycle rule to transition objects to S3 Glacier after 90 days.

Question 11

A multinational retailer stores customer purchase histories in Amazon S3 buckets across three AWS Regions. A new privacy policy mandates that personal data of EU residents must remain within the EU. The data engineering team wants a solution that automatically detects and prevents future cross-border storage of EU personal data without disrupting existing analytics workflows. Which AWS capability should be implemented to meet this requirement?

Accepted Answer

Configure AWS Organizations service control policies (SCPs) to deny S3 PutObject actions outside approved EU regions, and use Macie to classify EU personal data.. The requirement is to enforce that EU personal data is stored only within the EU. Service control policies in AWS Organizations can deny S3 write actions outside approved EU regions, providing a preventive control. Amazon Macie supplies the classification needed to identify EU personal data. Together they address both detection and prevention, ensuring residency without disrupting analytics in allowed regions. Other options either only restrict access or protect integrity, not location.

Answer

Enable S3 Block Public Access at the account level and configure bucket policies to deny requests from non-EU IP ranges.

Answer

Use Amazon Macie to discover and classify EU personal data, then apply S3 Object Lock in compliance mode to prevent deletion.

Answer

Enable S3 Cross-Region Replication with a replication rule that copies all objects to an EU bucket and deletes the source object after replication.

Question 12

A CDPSE is reviewing a new employee monitoring system that tracks keystrokes and screenshots. The system will be deployed globally. Which privacy principle is most directly implicated by this monitoring?

Accepted Answer

Data minimization. Data minimization is most directly implicated because keystroke logging and screenshots collect extensive personal data that is likely disproportionate to the legitimate purpose of monitoring. GDPR requires that only necessary data be collected, making this principle central to assessing the system's compliance.

Answer

Storage limitation

Answer

Purpose limitation

Answer

Integrity and confidentiality

Question 13

A CDPSE is conducting a privacy risk assessment for a new mobile health app that collects sensitive health data. The app uses a third-party analytics SDK that transmits data to servers in a non-adequate country. The CDPSE must recommend controls to mitigate privacy risks. Which control is most effective in reducing the risk of unauthorized access during transmission?

Accepted Answer

Implementing end-to-end encryption for data in transit. End-to-end encryption is the most effective control to prevent unauthorized access to sensitive health data while in transit. It ensures confidentiality even if the data passes through third-party infrastructure or jurisdictions with weak privacy laws. Other options are important but do not directly secure the data transmission itself.

Answer

Obtaining user consent for data transfer

Answer

Conducting a vendor security assessment

Answer

Anonymizing the data before transmission

Question 14

A privacy engineer is reviewing a mobile application that transmits precise geolocation coordinates to a backend service every 30 seconds, even when the user is not actively using the app. The privacy notice states that location is collected only while the app is in use. Which engineering change BEST aligns the application's behaviour with the stated notice?

Accepted Answer

Gate location transmission on the app's foreground lifecycle state.. The privacy notice defines when and why location is collected. Gating transmission on the app's foreground lifecycle state enforces that boundary technically, so coordinates are sent only during active use. Reducing frequency, widening consent, or encrypting the payload leaves the unauthorized background collection in place, which is the core privacy defect the engineer must fix.

Answer

Encrypt the geolocation coordinates before transmission.

Answer

Obtain a broader consent that covers background location.

Answer

Increase the transmission interval to every 5 minutes.

Question 15

Which technique is most effective for minimizing PII in a non-production database environment while maintaining referential integrity?

Accepted Answer

Tokenization. Tokenization replaces PII with non-sensitive surrogate tokens while preserving the format and referential relationships via a secure token vault, so joins and foreign keys still work in non-production environments. It is the most effective technique for minimizing PII exposure while maintaining referential integrity because the same input value consistently maps to the same token, and the original data is not recoverable without vault access.

Answer

Full deletion

Answer

Masking with random noise

Answer

Hashing with a static salt

Question 16

You are integrating a homomorphic encryption library into a cloud-based financial system. What is the primary trade-off you must communicate to stakeholders regarding the implementation of Fully Homomorphic Encryption (FHE)?

Accepted Answer

Significant latency during computation. Fully Homomorphic Encryption (FHE) enables arbitrary computations on encrypted data, but the cryptographic operations are orders of magnitude slower than plaintext computations, causing significant latency. This latency is the primary trade-off that must be communicated to stakeholders, as it impacts system responsiveness and throughput. Other options like storage or integrity are not the main concerns.

Answer

Incompatibility with cloud storage

Answer

Increased storage requirements

Answer

Loss of data integrity

Question 17

A privacy engineer is reviewing a new marketing analytics tool that will process customer email addresses and purchase histories. The tool vendor proposes to store all data in a multi-tenant cloud database. Which privacy engineering control is most critical to implement to prevent cross-tenant data leakage?

Accepted Answer

Implement tenant isolation through separate database schemas or row-level security with tenant ID filtering.. Tenant isolation through separate schemas or row-level security is the most critical control to prevent cross-tenant data leakage. It enforces logical separation at the data layer, ensuring queries are scoped to the correct tenant. Encryption with a shared key, WAF, and auditing do not prevent logical leakage. Thus, tenant isolation is essential.

Answer

Enable database auditing to log all queries for later review.

Answer

Encrypt the database with a single encryption key managed by the vendor.

Answer

Use a web application firewall (WAF) to block SQL injection attacks.

Question 18

A CDPSE is designing the privacy risk register for a new mobile health application that continuously transmits heart-rate and sleep data to a cloud analytics platform. The organization wants to demonstrate that privacy risks are managed consistently with enterprise risk appetite. Which approach BEST integrates privacy risk into the existing enterprise risk management framework?

Accepted Answer

Map privacy risk scenarios to the enterprise likelihood and impact scales and assign owners through the existing risk governance process.. Integrating privacy risk into enterprise risk management requires using the organization's existing likelihood and impact scales, governance structures and ownership model. This enables privacy risks to be evaluated alongside other risks, prioritized consistently and managed within the same treatment and reporting cycles. A separate or purely legal approach fragments risk oversight and weakens accountability.

Answer

Use a qualitative heat map without numeric scores so that privacy risks are not compared against financial or operational risks.

Answer

Maintain a separate privacy risk register scored on a 1–5 scale defined by the privacy team and report it only to the chief privacy officer.

Answer

Treat all privacy risks as compliance issues and track them in the legal department's obligation register until they are closed.

Question 19

A privacy analyst is reviewing the data life cycle for a new mobile application that collects user location data. The analyst must ensure that location data is not retained longer than necessary for the app's core functionality, which is providing real-time navigation. Which data life cycle stage is MOST directly concerned with limiting the retention period?

Accepted Answer

Data retention. The data retention stage is specifically about defining and enforcing how long data is kept. For location data in a navigation app, retention should be limited to the period needed for the service, after which disposal occurs. This stage directly implements the storage limitation principle by setting timeframes and triggers for deletion.

Answer

Data collection

Answer

Data storage

Answer

Data disposal

Question 20

A privacy engineer is designing a data retention and deletion capability for a cloud-native application that stores personal data in an object storage bucket with versioning enabled and in a relational database with point-in-time recovery. The engineer must ensure that deletion requests are fully honored across both stores. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Implement a deletion workflow that removes the data subject's rows and then expires the relevant database backups and snapshots according to a defined retention schedule.. Deletion in cloud-native stores must account for residual copies. Expiring non-current object versions with lifecycle rules removes the older copies that versioning retains, and a deletion workflow that also expires backups and snapshots removes the relational store's residual copies. Disabling recovery, enabling object lock, or relying on vacuum does not achieve complete deletion.

Answer

Disable point-in-time recovery on the relational database so that deleted rows cannot be restored.

Answer

Rely on the database's automatic vacuum process to remove deleted rows from all storage layers.

Answer

Enable object lock in governance mode on the bucket to prevent any deletion of personal data.