CDPSE Practice Test 5 — 10 Questions

Question 1

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Accepted Answer

The lack of human intervention in automated decision-making processes.. The main privacy concern regarding the Right to Explanation in automated credit decisions is the lack of human intervention in automated decision-making processes. When a system makes credit decisions without meaningful human involvement, the data subject cannot obtain an explanation of the logic involved or contest the outcome, which undermines the right to explanation and the broader right not to be subject to solely automated decisions. This is the core tension that GDPR Article 22 and related transparency provisions address.

Answer

The system is too slow for real-time credit processing.

Answer

The cost of maintaining the automated system infrastructure.

Answer

The inability of the system to process non-numeric data types.

Question 2

A multinational organization is struggling to maintain consistent privacy practices across different jurisdictions. Which approach is most effective for centralizing privacy governance while allowing for local legal variations?

Accepted Answer

Adopt a 'hub and spoke' privacy governance model.. A 'hub and spoke' privacy governance model centralizes policy-setting, standards, and oversight at the corporate hub while allowing local spokes to adapt implementation to jurisdictional legal variations. This balances global consistency with local compliance, ensuring that regional requirements (e.g., GDPR, CCPA, PIPL) are met without fragmenting the overall governance framework. It is the recommended approach for multinationals facing divergent privacy laws.

Answer

Standardize all data processing to occur only in the home country.

Answer

Allow each region to define its own privacy framework independently.

Answer

Enforce a single, global privacy policy that overrides all local laws.

Question 3

A privacy analyst is reviewing the organization's privacy governance documentation and notices that the roles and responsibilities for privacy are not clearly defined. According to generally accepted privacy governance principles, what is the most appropriate first step to address this gap?

Accepted Answer

Draft a privacy charter that assigns accountability to specific roles and obtains executive approval.. The analyst identified a lack of clearly defined privacy roles and responsibilities. The foundational step is to create a privacy charter that assigns accountability to specific roles and secures executive approval. This establishes the governance structure necessary for other activities like assessments, technology implementation, and training to be effective and properly directed.

Answer

Conduct a privacy impact assessment for all business processes.

Answer

Implement a new privacy technology solution to automate compliance monitoring.

Answer

Schedule privacy awareness training for all employees.

Question 4

What is the primary role of a Data Privacy Officer (DPO)?

Accepted Answer

Monitoring compliance and providing advice on data protection.. The DPO's primary role is to monitor compliance with data protection laws and internal policies, and to advise the organization and its employees on data protection obligations. This is an advisory and monitoring function, not an operational or executive decision-making role. It is defined explicitly under GDPR Articles 37-39.

Answer

Approving all business marketing budgets.

Answer

Managing the IT server infrastructure.

Answer

Developing all corporate software applications.

Question 5

A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?

Accepted Answer

server_side_encryption_configuration. In Terraform, the `server_side_encryption_configuration` block within an `aws_s3_bucket` resource is used to configure default encryption for the bucket. Setting its `sse_algorithm` to `aws:kms` enables SSE-KMS encryption at rest. This is the correct attribute to enforce encryption.

Answer

bucket_acl

Answer

versioning_enabled

Answer

public_access_block

Question 6

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

Accepted Answer

Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal.. An Automated Consent Management Platform (CMP) configured with a 'Do Not Sell' signal is the correct feature to automate the CCPA Right to Opt-Out for web visitors. CCPA/CPRA requires businesses to honor opt-out signals (including Global Privacy Control) and provide a clear mechanism for consumers to stop the sale or sharing of their personal information. A CMP captures the signal, records consent state, and propagates it to downstream ad tech and data partners automatically.

Answer

A manual email ticketing system for data subject access requests.

Answer

An automated script that permanently deletes user accounts after 30 days of inactivity.

Answer

An internal dashboard for employees to view customer purchase histories.

Question 7

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Accepted Answer

Categorize the vendor based on the sensitivity and volume of PII they will process.. The first step in any third-party privacy risk management lifecycle is to understand what you are exposing: classify the vendor based on the sensitivity and volume of PII they will process. This tiering determines the depth of due diligence, the contractual terms required, and the ongoing monitoring cadence. Without this categorization, you cannot right-size the DPA, the SOC 2 review, or any technical testing.

Answer

Draft a Data Processing Agreement (DPA).

Answer

Request the vendor's SOC 2 Type II report.

Answer

Conduct a penetration test on the vendor's API endpoints.

Question 8

Which of the following is an example of an 'operational' technical control for privacy?

Accepted Answer

Data discovery scanning tools. Data discovery scanning tools are an operational technical control because they are automated technologies that continuously or periodically scan systems to locate, classify, and inventory personal data. They operate at the technical layer (agents, API connectors, pattern matching, ML classifiers) and are 'operational' in that they run as part of ongoing privacy operations rather than as one-time assessments or documentation. This makes them the only option that is simultaneously technical and operational.

Answer

Privacy policy document

Answer

Standard Operating Procedure

Answer

Privacy impact assessment

Question 9

Which tool is best suited for establishing the scope of a privacy governance program by identifying where personal data resides across the organization?

Accepted Answer

Data Inventory / Data Map. A data inventory or data map identifies what personal data exists, where it resides, how it flows, and who owns it across systems and jurisdictions—this is the foundational artifact for scoping a privacy governance program. Without knowing where personal data lives, an organization cannot define program boundaries, apply controls, or meet regulatory requirements like records of processing. It directly answers the scoping question.

Answer

Access Control Matrix

Answer

Privacy Impact Assessment (PIA)

Answer

Incident Response Plan

Question 10

A privacy engineer is designing a data processing pipeline that ingests customer records from multiple source systems into a centralized analytics environment. The design must enforce data minimization and purpose limitation. Which TWO engineering controls should be implemented? (Choose two.)

Accepted Answer

Tag each record with its source purpose and enforce purpose-based access policies.. Data minimization and purpose limitation in a centralized pipeline require both a restrictive schema that admits only approved fields and purpose tags that drive access decisions. Together they prevent unapproved attributes from entering the environment and stop records from being reused for incompatible purposes. Broad raw access and indefinite retention work against both principles and should be avoided in the design.

Answer

Retain all source records indefinitely to preserve historical accuracy.

Answer

Grant all analytics engineers read access to the raw ingestion zone.

Answer

Store all ingested records in a single unpartitioned table for maximum flexibility.