When configuring AWS Macie to perform data minimization, which configuration is required to prevent the service from scanning internal metadata fields that do not contain customer PII?
In Collibra, you are mapping a data element to a business term to support data minimization. What is the effect of changing the 'Data Stewardship' workflow status to 'Deprecated'?
While using the Salesforce Data Masking tool, which option should be selected to ensure that production data copied to a sandbox is rendered unusable for unauthorized parties?
In Google Cloud Data Loss Prevention (DLP), which transformation method should be applied to a column containing email addresses to maintain format while ensuring privacy?
A CDPSE practitioner is configuring a data discovery job in OneTrust to identify PII in a structured database. Which setting must be enabled to ensure the tool automatically masks the data upon discovery based on a predefined classification tag?
When performing a data minimization assessment, which feature in Oracle Data Safe helps identify excessive data collection by flagging columns that contain sensitive data but are rarely queried?
A privacy analyst is conducting a data map in ServiceNow. Which feature allows them to link a database table directly to a 'Processing Activity' record?
You are configuring a data retention policy in AWS S3 Lifecycle rules. Which action should be selected to minimize data storage costs while remaining compliant with privacy laws?
A practitioner is setting up data minimization. Which feature in Google Cloud Spanner helps ensure that data is stored in specific regions for local compliance?
A multinational bank is implementing a data minimization program for its customer analytics platform. The platform ingests transaction data, including customer names, account numbers, and transaction amounts. The privacy team wants to reduce privacy risk while preserving the ability to perform trend analysis. Which technique best achieves data minimization while maintaining analytical utility?
A multinational bank uses Microsoft SQL Server to store customer records across multiple regions. The privacy team must implement a data retention policy that automatically deletes records after seven years, but some records are subject to a legal hold that overrides deletion. Which SQL Server feature should be used to enforce this policy while ensuring legal holds are respected?
A privacy engineer is configuring a Microsoft 365 retention policy for a SharePoint Online site that stores customer contracts. The policy must ensure that after the retention period expires, the contracts are permanently deleted and cannot be recovered by site collection administrators. Which retention action should be configured?
A privacy team is designing a data retention schedule for a new customer relationship management (CRM) system. The legal team has specified that customer contact information must be retained for seven years after the last transaction to comply with financial regulations. The CRM system uses a relational database. Which mechanism should the team implement to enforce this retention requirement?
A privacy engineer is designing a data life cycle for a new IoT device that collects sensor data and transmits it to a cloud backend. The engineer must ensure that data is properly disposed of at the end of its life cycle, including data on the device itself when it is decommissioned. Which method is MOST effective for securely disposing of data on the IoT device?
A privacy engineer is implementing a data retention policy for an Amazon S3 bucket that contains personal data. The policy requires that objects older than 365 days are automatically deleted, but some objects are subject to a legal hold and must be retained indefinitely. Which combination of S3 features should be used to meet these requirements?
During a data mapping exercise in BigID, you need to identify data that has exceeded its retention period. Which attribute should be used to filter the data inventory?
You are managing Azure Information Protection (AIP) labels. Which action is necessary to ensure that documents classified as 'Highly Confidential' are automatically encrypted?
During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?
In a data warehouse, which technique is most effective for protecting PII during the ETL (Extract, Transform, Load) process while still allowing analytics?
A hospital's privacy team discovers that backup tapes containing patient records are kept indefinitely because the backup software's retention policy was never configured. The tapes are stored offsite and are not indexed, making it impossible to locate individual records. Which action should the privacy team take FIRST to address this data life cycle risk?
A multinational retailer is implementing a data life cycle management program. The privacy team must ensure that personal data collected in the EU is not retained longer than necessary and that disposal is verifiable. Which two controls are essential to meet these objectives? (Choose two.)
A marketing team wants to use customer email addresses for a new promotional campaign. The privacy office determines that the original consent was limited to order fulfillment. What is the most appropriate action under data life cycle management principles?
A data privacy team is designing a new customer analytics platform. They need to ensure that raw personal data collected for marketing purposes cannot be repurposed for a different incompatible purpose without explicit consent. Which data life cycle management control best enforces this requirement at the point of collection?
A privacy engineer is configuring a data retention schedule for a new cloud-based CRM that stores customer contact details and purchase history. The organization operates in multiple jurisdictions and must ensure that records are kept only for the period necessary for the stated business purpose, after which they are securely deleted. Which of the following should the engineer implement FIRST to align retention with the data life cycle management principle of storage limitation?
A multinational retailer must comply with a data subject's erasure request that spans its on-premises Oracle database, a SaaS CRM, and backups. The privacy team wants to ensure the erasure is technically enforced and auditable across all environments. Which approach best meets this requirement?
A privacy engineer is implementing a data minimization strategy for a microservices application deployed on Kubernetes. The application processes customer payment data in ephemeral pods. The engineer must ensure that sensitive data is not persisted beyond the processing window and that any residual data in the container filesystem is securely removed. Which approach BEST achieves this?
A privacy engineer is configuring an automated data disposal process for a cloud-based CRM. The organization must ensure that when a customer account is deleted, all associated personal data is irreversibly destroyed across all replicas and backups within 30 days, while maintaining an audit trail. Which approach best satisfies these requirements?
A privacy engineer is configuring a new Amazon S3 bucket that will store customer transaction logs containing personal data. The organization's privacy policy requires that data be automatically deleted 90 days after creation to comply with data minimization principles. The engineer needs to implement this requirement with minimal operational overhead. Which solution should the engineer use?
A multinational retailer is implementing a data minimization program for its customer loyalty database. The database contains fields such as full name, email, phone number, date of birth, and purchase history. The privacy team wants to reduce the amount of personal data stored while still enabling targeted marketing campaigns. Which of the following techniques BEST achieves data minimization while preserving analytical utility?
A privacy analyst is reviewing the data life cycle for a new mobile app that collects location data. The analyst needs to ensure that location data is not retained longer than necessary for the app's core functionality. Which data life cycle stage directly addresses this requirement?
A data privacy officer is reviewing the data life cycle for a new mobile application that collects precise geolocation data. The privacy policy states that geolocation data must be retained only for 30 days and then irreversibly anonymized for analytics. The engineering team proposes using a PostgreSQL database and asks for the most technically sound method to achieve irreversible anonymization of the geolocation data after 30 days while preserving its utility for aggregate analysis. Which approach should the privacy officer recommend?
A privacy analyst is reviewing the data life cycle for a mobile health application that collects user heart rate and location data. The company wants to ensure that data is properly disposed of when users delete their accounts. Which of the following is the MOST critical step to include in the disposal process to prevent residual data from remaining in backups and logs?
A healthcare provider is implementing a new patient portal. The privacy officer wants to ensure that when a patient requests correction of their data, the change is propagated to all downstream systems, including the billing and analytics platforms. Which data life cycle management practice is most critical to achieve this?
A multinational retailer stores customer purchase histories in Amazon S3 buckets across three AWS Regions. A new privacy policy mandates that personal data of EU residents must remain within the EU. The data engineering team wants a solution that automatically detects and prevents future cross-border storage of EU personal data without disrupting existing analytics workflows. Which AWS capability should be implemented to meet this requirement?
A financial services company is designing a new data life cycle management policy. The privacy team wants to ensure that data quality is maintained throughout the life cycle, from collection to disposal. Which of the following practices BEST supports data quality during the storage and use phases?
A privacy program manager is designing a data retention schedule for a new SaaS application that processes employee HR data. The schedule must comply with GDPR and other privacy regulations. Which TWO of the following are essential considerations when determining retention periods for different data categories? (Choose two.)
A financial institution is building a data life cycle management program. The privacy team must ensure that personal data is properly governed from creation to disposal. Which two practices are essential for maintaining data quality and compliance throughout the life cycle? (Choose two.)
A healthcare provider uses Microsoft 365 to manage patient records. A privacy officer requires that when a patient record reaches its retention period, it must be reviewed by a compliance officer before permanent deletion. Which Microsoft Purview feature should be configured to meet this requirement?
A privacy analyst is reviewing the data life cycle for a new mobile application that collects user location data. The analyst must ensure that location data is not retained longer than necessary for the app's core functionality, which is providing real-time navigation. Which data life cycle stage is MOST directly concerned with limiting the retention period?
A privacy program manager is reviewing the data life cycle for an organization that uses a hybrid cloud environment. The organization wants to ensure that data is properly managed from creation to deletion. Which TWO of the following activities are essential components of a data life cycle management program? (Choose two.)
A privacy analyst is reviewing the data life cycle for a mobile fitness app that collects user location data. The analyst needs to identify the stage where data is initially collected from users. Which stage of the data life cycle does this represent?
A privacy team is implementing data minimization for a cloud-based CRM system that stores customer PII. The team must ensure that only necessary data is collected and that data is not retained beyond its purpose. Which TWO of the following are technical controls that directly support data minimization? (Choose two.)
A financial services firm is implementing a data life cycle management program. The privacy team wants to ensure that data minimization is applied not only to production databases but also to backup and archival copies. Which two practices should be implemented to achieve data minimization across the entire data life cycle? (Choose two.)
A privacy team is designing a new customer loyalty program. They want to ensure that personal data is not kept longer than necessary and that it is securely destroyed when no longer needed. Which data life cycle management phase directly addresses the secure destruction of personal data?
A privacy analyst is reviewing the data life cycle for a cloud-based HR system that processes employee personal data. The organization must ensure that data minimization is applied during the collection and storage phases. Which two practices should the analyst recommend to achieve data minimization in this scenario? (Choose two.)
A healthcare organization is implementing a data retention policy for electronic health records (EHRs) in a hybrid cloud environment. The policy must ensure that records are retained for the legally required period, then securely disposed of. Which approach best ensures compliance and secure disposal?
A software company uses a CI/CD pipeline to deploy applications to Kubernetes clusters. Developers frequently create ephemeral pods that process customer data for testing. A privacy engineer needs to ensure that personal data is minimized in these ephemeral environments. Which strategy should be implemented?
A multinational corporation uses a data lake to store customer data from various sources. The privacy team wants to implement a data minimization strategy that reduces the attack surface and ensures compliance with global privacy regulations. Which approach best aligns with the principle of data minimization in this context?
A privacy engineer is designing a data life cycle for a new IoT device that collects sensor data, including personal data, and transmits it to a cloud platform. The organization must ensure data integrity throughout the life cycle, from collection to disposal. The engineer is considering several technical controls. Which control best ensures data integrity during transmission and storage?
A privacy analyst is reviewing the data life cycle management process for a healthcare organization. The organization wants to ensure that data is properly managed from creation to disposal. Which TWO of the following are key activities in the data disposal phase? (Choose two.)
A small e-commerce company is creating a data retention schedule for its customer database. The privacy team wants to ensure that customer records are not kept longer than necessary. Which action should be taken first to establish an effective retention schedule?
A global retailer is deploying a new loyalty program that aggregates purchase history, geolocation, and device identifiers across 14 countries. The privacy office must embed privacy controls at the point of collection rather than retrofitting them after the data warehouse is built. Which data life cycle practice best satisfies this requirement?
A financial services firm stores customer transaction records in a primary operational database and replicates them to a disaster recovery site and an analytics sandbox. A customer exercises erasure rights. The privacy engineer must ensure the erasure propagates to all copies without breaking referential integrity in the operational system. Which approach is most appropriate?
A healthcare analytics company is designing a de-identification process for a research dataset derived from patient records. The privacy team must reduce re-identification risk while preserving analytical utility. Which two techniques should be applied to the dataset? (Choose two.)
A marketing team wants to use customer email addresses collected for order fulfillment to send promotional offers. The privacy analyst reviewing the request must apply the principle that governs whether this secondary use is permissible. Which data life cycle principle is most directly implicated?
A multinational manufacturer is retiring a legacy ERP system that contains employee and vendor personal data. The privacy team must dispose of the data in a way that satisfies regulatory obligations while preserving records subject to a legal hold. Which disposal approach is most appropriate?