CDPSE Practice Test 9 — 10 Questions

Question 1

A privacy team is designing a new customer loyalty program. They want to ensure that personal data is not kept longer than necessary and that it is securely destroyed when no longer needed. Which data life cycle management phase directly addresses the secure destruction of personal data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data disposal. The data life cycle includes phases such as collection, storage, use, sharing, and disposal. Secure destruction of personal data when it is no longer needed is the core objective of the data disposal phase. This phase ensures that data is irreversibly destroyed or anonymized, reducing the risk of unauthorized access and helping organizations comply with data protection regulations.

Answer

Data collection

Answer

Data storage

Answer

Data use

Question 2

A multinational retailer processes customer loyalty data across the EU, UK and Brazil. The CDPSE is asked to establish a privacy compliance monitoring program that provides assurance to the board. Which control objective is MOST important for demonstrating ongoing compliance with diverse regulatory requirements?

Accepted Answer

Timely identification and remediation of gaps between actual processing activities and documented privacy requirements.. For board-level assurance across multiple jurisdictions, the most important control objective is the ability to detect and remediate gaps between actual processing and documented privacy requirements. This demonstrates that compliance is actively monitored and corrected, rather than relying on indirect metrics such as training or complaint handling. It directly addresses the risk of regulatory breaches in a complex, multi-jurisdictional environment.

Answer

Percentage of customer complaints resolved within the service-level agreement.

Answer

Number of privacy impact assessments completed per quarter.

Answer

Annual privacy training completion rate for all employees who handle personal data.

Question 3

A multinational corporation uses a data lake to store customer data from various sources. The privacy team wants to implement a data minimization strategy that reduces the attack surface and ensures compliance with global privacy regulations. Which approach best aligns with the principle of data minimization in this context?

Accepted Answer

Aggregate and anonymize data at the point of ingestion, retaining only the aggregated results for analytics and discarding raw PII.. Data minimization requires collecting and retaining only the personal data that is necessary for the specified purpose. In a data lake, aggregating and anonymizing data at ingestion ensures that raw PII is not stored, reducing the risk of exposure and helping comply with privacy regulations. Other options focus on security controls or obfuscation but do not reduce the amount of PII retained.

Answer

Implement field-level encryption for all personally identifiable information (PII) and store the encryption keys in a hardware security module (HSM).

Answer

Use data masking to obfuscate PII in non-production environments while keeping full data in production for business use.

Answer

Store all raw data in a centralized repository and apply access controls based on role-based access control (RBAC) to restrict who can view PII.

Question 4

A privacy manager at a rapidly growing healthcare technology company is designing the organization's privacy governance structure. The company has a small privacy team and wants to ensure that privacy decisions are made quickly and consistently across all business units. Which of the following governance models would BEST achieve this goal?

Accepted Answer

A centralized model where a single privacy office, led by a Chief Privacy Officer, has authority over privacy decisions across all units. A centralized privacy governance model is most effective for a growing organization with a small privacy team because it enables quick, consistent decisions and efficient use of limited resources. By vesting authority in a single privacy office, the organization ensures that privacy requirements are applied uniformly across all business units, reducing the risk of conflicting practices and compliance gaps.

Answer

A federated model where each business unit manages privacy independently but shares best practices through a voluntary community of practice

Answer

A decentralized model where each business unit has its own privacy lead who reports to the unit head

Answer

An outsourced model where an external law firm provides all privacy guidance and decision-making

Question 5

A company needs to share customer demographics with a third party. Which technique allows for statistical analysis without revealing individual identities?

Accepted Answer

Differential privacy. Differential privacy adds calibrated statistical noise to query results so that aggregate analysis is possible while individual records cannot be distinguished or re-identified. It provides a mathematical privacy guarantee, making it suitable for sharing demographics for statistical analysis without revealing identities.

Answer

Encryption

Answer

Data deletion

Answer

Pseudonymization

Question 6

A financial services company is revising its privacy governance framework to better integrate privacy risk management with its enterprise risk management (ERM) program. The Chief Privacy Officer wants to ensure that privacy risks are consistently identified, assessed, and treated in alignment with other organizational risks. Which of the following is the MOST critical action to achieve this integration?

Accepted Answer

Adopt the enterprise risk management framework's risk assessment methodology and scales for privacy risk assessments. Using the ERM framework's risk assessment methodology and scales for privacy risks is critical because it enables consistent evaluation, prioritization, and treatment of privacy risks alongside other organizational risks. This alignment supports integrated risk reporting and decision-making, ensuring that privacy risks receive appropriate attention and resources within the broader risk management context.

Answer

Assign all privacy risk management responsibilities to the internal audit department

Answer

Develop a separate privacy risk register that is maintained independently from the ERM risk register

Answer

Conduct annual privacy risk assessments separately from the ERM risk assessment cycle

Question 7

A global retailer is expanding into new markets and needs a holistic view of how personal data moves across its subsidiaries and third parties. The Chief Privacy Officer wants a single, visual representation that maps data flows, identifies cross-border transfers, and highlights potential risk points. Which privacy governance tool should be used to achieve this?

Accepted Answer

Data flow mapping. Data flow mapping is the only tool that provides a visual, end-to-end view of personal data movement, which is essential for understanding cross-border transfers and identifying risk points. The other options are important privacy governance instruments, but they do not deliver the holistic, visual representation required for this scenario.

Answer

Data protection impact assessment (DPIA)

Answer

Privacy maturity assessment

Answer

Record of processing activities (ROPA)

Question 8

A privacy analyst is reviewing the data life cycle management process for a healthcare organization. The organization wants to ensure that data is properly managed from creation to disposal. Which TWO of the following are key activities in the data disposal phase? (Choose two.)

Accepted Answer

Verifying that data has been irreversibly destroyed across all storage locations and backups.. The data disposal phase involves securely destroying data when it is no longer needed and ensuring that the destruction is complete and documented. Verifying irreversible destruction across all locations and maintaining documentation and audit trails are key activities. Other options pertain to earlier phases such as collection, storage, or use, and do not directly contribute to secure disposal.

Answer

Implementing access controls to restrict who can view the data during its active use.

Answer

Collecting consent from data subjects for processing their personal data.

Answer

Encrypting data at rest to protect it from unauthorized access.

Question 9

A CDPSE is advising a financial services firm that wants to outsource its customer call recording and analytics to a cloud provider. The recordings contain personal data and some payment card information. The firm must ensure the outsourcing arrangement meets privacy and compliance expectations. Which TWO actions should the CDPSE recommend as part of the vendor risk management process? (Choose two.)

Accepted Answer

Require the vendor to provide evidence of independent third-party certifications and audit reports relevant to privacy and security.. Effective vendor risk management for sensitive data includes independent assurance through certifications and audits, and enforceable contractual clauses that define data protection obligations, breach notification and audit rights. Together, these actions provide the firm with evidence of the vendor's controls and the legal means to enforce compliance, while preserving the firm's accountability.

Answer

Allow the vendor to use the data for its own product improvement purposes to reduce costs.

Answer

Rely on the vendor's standard terms of service without customization to expedite the contract.

Answer

Transfer all accountability for data protection compliance to the vendor through a liability waiver.

Question 10

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and communication preferences across its mobile app and in-store point-of-sale systems. The CDPSE is asked to ensure that the privacy notice provided to customers meets the transparency requirements of the GDPR and similar laws. Which of the following is the MOST critical element to include in the privacy notice to satisfy these requirements?

Accepted Answer

The specific purposes of processing, the legal basis for each purpose, and the categories of recipients of the personal data.. The GDPR and similar laws require privacy notices to be specific and meaningful, not merely generic statements. Data subjects must be informed of the purposes of processing, the legal basis relied upon for each purpose, and the categories of recipients to whom data will be disclosed. This enables individuals to understand how their data is used and to exercise their rights effectively. The other options either provide insufficient detail or focus on irrelevant information such as internal security measures.

Answer

A detailed description of the organization's internal data security measures, including encryption algorithms and access controls.

Answer

A statement that the organization complies with all applicable data protection laws.

Answer

A list of all third-party vendors that have access to personal data, including their contact details.