CDPSE Practice Test 4 — 10 Questions

Question 1

A financial services firm is deploying a new customer onboarding portal that collects income, employment, and identity documents. The privacy engineer must embed privacy controls into the software development lifecycle. Which engineering practice BEST ensures privacy requirements are validated before production release?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate automated privacy test cases into the CI/CD pipeline.. Privacy engineering requires controls to be verified continuously and before release. Automated privacy test cases in the CI/CD pipeline enforce data minimization, consent, retention, and access rules on every build, producing repeatable evidence that the onboarding portal behaves as designed. This approach catches privacy regressions early and aligns with privacy by design and by default principles rather than relying on after-the-fact reviews or administrative attestations.

Answer

Conduct a privacy review only after the portal is deployed to production.

Answer

Perform a manual code review of the identity document upload module.

Answer

Require developers to sign an annual privacy awareness attestation.

Question 2

A CDPSE is reviewing a healthcare organization's data retention practices. The organization stores patient medical records, billing information, and appointment scheduling data in a cloud-based electronic health record (EHR) system. The CDPSE must ensure compliance with privacy regulations that require data to be kept only as long as necessary. Which TWO of the following actions are the MOST effective to establish and maintain a defensible data retention schedule? (Choose two.)

Accepted Answer

Implement automated deletion or anonymization processes that trigger at the end of each defined retention period.. Establishing a defensible retention schedule begins with knowing what data exists and what rules apply, which is achieved through a data inventory and classification. Then, the schedule must be enforced through automation to ensure timely deletion or anonymization. These two actions together provide the necessary foundation and operational mechanism. The other options either violate storage limitation principles or fail to ensure consistent compliance across the organization.

Answer

Store all patient data indefinitely to ensure it is available for future medical research or legal claims.

Answer

Document the retention schedule in a policy but allow individual departments to deviate as needed without central oversight.

Answer

Rely on the cloud provider's default retention settings for the EHR system to manage data lifecycle.

Question 3

When using Homomorphic Encryption, what is the primary limitation for a privacy engineer to consider?

Accepted Answer

Computational overhead. Homomorphic encryption allows computations on encrypted data without decryption, but the mathematical operations are extremely resource-intensive, leading to significant computational overhead. This overhead is the primary limitation because it can make real-time or large-scale processing impractical. Other options like data loss or inability to search are not inherent limitations of homomorphic encryption.

Answer

Data loss during processing

Answer

Inability to perform search

Answer

Lack of vendor support

Question 4

A privacy program manager is designing a data retention schedule for a new SaaS application that processes employee HR data. The schedule must comply with GDPR and other privacy regulations. Which TWO of the following are essential considerations when determining retention periods for different data categories? (Choose two.)

Accepted Answer

The legal and regulatory requirements that mandate minimum or maximum retention periods for specific data types, such as tax records or health information.. Retention periods must be based on legal requirements and the purpose of processing. Legal mandates set minimum or maximum periods, while data minimization requires that data not be kept longer than necessary for the specified purpose. Together, these ensure compliance and respect for privacy principles. Technical capabilities and cost are secondary implementation factors.

Answer

The technical capabilities of the SaaS application to automatically enforce retention and deletion, such as built-in retention labels or policies.

Answer

The storage cost associated with retaining data in the SaaS application's cloud infrastructure, to optimize the IT budget.

Answer

The preferences of the employees whose data is being processed, as expressed through consent forms or surveys.

Question 5

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Accepted Answer

A fully updated data inventory map showing data lineage.. The CCPA 'Right to Know' requires a business to disclose the specific categories and pieces of personal information it has collected, the sources of that information, the purposes of collection, and the third parties with whom it is shared. A fully updated data inventory map with data lineage is the only artifact that can trace each data element from collection point through processing and onward sharing, which is exactly what is needed to answer a consumer's or auditor's Right to Know request. Without this map, the organization cannot reliably produce the required disclosures.

Answer

Marketing brochures describing the product features.

Answer

The latest penetration test report for the customer portal.

Answer

A list of all employees with database access.

Question 6

Which of the following is a key objective of a data retention policy?

Accepted Answer

To minimize the amount of data stored and reduce risk. A data retention policy defines how long data is kept and when it should be securely disposed of. Its key objective is to minimize data storage to reduce risk, comply with legal requirements, and lower costs. By retaining only what is necessary, organizations limit exposure to breaches and regulatory penalties.

Answer

To maximize data availability

Answer

To increase storage capacity requirements

Answer

To keep all data forever for future AI training

Question 7

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?

Accepted Answer

Incorporate data minimization and purpose limitation settings during the architectural design phase.. Privacy-by-design requires that privacy controls be embedded at the earliest architectural stage, not bolted on later. Data minimization and purpose limitation are foundational GDPR principles (Article 5) that must be designed into the application's data flows before any code is written. Addressing them during architectural design prevents costly retrofits and ensures the behavioral tracking only collects what is necessary for the stated marketing purpose.

Answer

Enable automated data deletion scripts after the application deployment phase.

Answer

Configure the database to encrypt all fields regardless of sensitivity to ensure maximum protection.

Answer

Conduct a post-implementation audit to identify potential data leakage points.

Question 8

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Accepted Answer

To identify and mitigate privacy risks associated with a new data processing activity.. A DPIA is a structured risk assessment required by GDPR Article 35 for processing activities likely to result in high risk to data subjects' rights and freedoms. Its core purpose is to identify privacy risks arising from a new or changed processing operation and to define mitigations before processing begins. It is a proactive, accountability-focused instrument, not a budgeting, training, or availability exercise.

Answer

To calculate the budget required for security hardware.

Answer

To train employees on the company's privacy policies.

Answer

To verify the system uptime requirements of the application.

Question 9

Which governance structure is most appropriate for a decentralized organization managing privacy risks?

Accepted Answer

Hub-and-spoke model with localized privacy champions.. A hub-and-spoke model with localized privacy champions is most appropriate for a decentralized organization because it balances central oversight (hub) with local implementation (spokes). This structure ensures consistent privacy policies while allowing flexibility for regional differences and fostering accountability at the local level.

Answer

Ad-hoc committee based on project needs.

Answer

Outsourcing all privacy functions.

Answer

Centralized command-and-control structure.

Question 10

Which THREE components should be included in a data inventory to ensure it is actionable for DSR (Data Subject Request) fulfillment?

Accepted Answer

Storage location. A is correct because knowing the storage location (the specific system, database, application, or repository where personal data resides) is essential for locating and retrieving or deleting data when fulfilling a DSR such as access or erasure. B is correct because identifying the data owner/steward provides the accountable contact who can validate the request, authorize actions, and coordinate retrieval or deletion across systems. E is correct because recording the data category/type (for example identifiers, financial data, health data, or special categories under GDPR) lets teams determine what is in scope, apply the right exemptions, and respond accurately to access, portability, or erasure requests. C is not relevant because server uptime percentage is an availability/operations metric that does not help locate or classify personal data for DSR fulfillment. D is also not relevant because network bandwidth usage is a performance/capacity metric unrelated to identifying, classifying, or acting on personal data in response to a DSR.

Answer

Server uptime percentage

Answer

Network bandwidth usage