CDPSE Data Life Cycle Management Practice Test 2 — 15 Questions

Question 1

A privacy engineer is configuring a Microsoft 365 retention policy for a SharePoint Online site that stores customer contracts. The policy must ensure that after the retention period expires, the contracts are permanently deleted and cannot be recovered by site collection administrators. Which retention action should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the retention policy to 'Delete items automatically after the retention period' with no retention hold.. The requirement is for automatic, permanent deletion after the retention period, with no possibility of recovery by administrators. Configuring the retention policy to delete items automatically after the retention period, without a retention hold, achieves this. Other actions either retain items, require manual intervention, or use unrelated controls, and therefore do not ensure irreversible disposal.

Answer

Apply a retention label that marks items as records and then manually delete the contracts after the retention period.

Answer

Set the retention policy to 'Retain items even if they are deleted' and configure a disposition review at the end of the retention period.

Answer

Use a data loss prevention (DLP) policy to block deletion of the contracts and then remove the DLP policy after the retention period.

Question 2

A privacy team is designing a data retention schedule for a new customer relationship management (CRM) system. The legal team has specified that customer contact information must be retained for seven years after the last transaction to comply with financial regulations. The CRM system uses a relational database. Which mechanism should the team implement to enforce this retention requirement?

Accepted Answer

Configure a database trigger that deletes records when the last transaction date is older than seven years.. A database trigger is the most effective mechanism because it enforces retention automatically at the database level, based on the last transaction date. It is reliable, auditable, and integrated into the CRM system. Other options are either manual, error-prone, or overly broad, failing to meet the specific retention requirement.

Answer

Rely on users to manually delete customer records after seven years as part of their regular duties.

Answer

Use a backup and restore strategy that overwrites the database every seven years.

Answer

Implement a nightly batch script that scans the CRM database and removes records older than seven years.

Question 3

A privacy engineer is designing a data life cycle for a new IoT device that collects sensor data and transmits it to a cloud backend. The engineer must ensure that data is properly disposed of at the end of its life cycle, including data on the device itself when it is decommissioned. Which method is MOST effective for securely disposing of data on the IoT device?

Accepted Answer

Using cryptographic erasure by deleting the encryption key used to encrypt the data at rest.. Cryptographic erasure is the most effective method for securely disposing of data on IoT devices because it renders data unrecoverable by destroying the encryption key. It overcomes the limitations of overwriting on flash memory and is practical for remote decommissioning, unlike physical destruction which may not be feasible at scale.

Answer

Overwriting the entire storage with random data multiple times using a software tool.

Answer

Performing a factory reset that deletes all user data and settings.

Answer

Physically destroying the device by shredding or incineration.

Question 4

A privacy engineer is implementing a data retention policy for an Amazon S3 bucket that contains personal data. The policy requires that objects older than 365 days are automatically deleted, but some objects are subject to a legal hold and must be retained indefinitely. Which combination of S3 features should be used to meet these requirements?

Accepted Answer

S3 Lifecycle policy to expire objects after 365 days and S3 Object Lock in governance mode to prevent deletion of objects under legal hold.. The requirement is to automatically delete objects after 365 days while retaining those under legal hold indefinitely. S3 Lifecycle policies can expire objects, and S3 Object Lock with legal holds can prevent deletion. Legal holds are best managed in governance mode, which allows authorized users to bypass the lock when the hold is lifted, providing flexibility. Compliance mode is more rigid and suited for regulatory retention, not legal holds that may be temporary.

Answer

S3 Lifecycle policy to transition objects to S3 Glacier after 365 days and S3 Object Lock in compliance mode to prevent deletion of objects under legal hold.

Answer

S3 Lifecycle policy to expire objects after 365 days and S3 Object Lock in compliance mode to prevent deletion of objects under legal hold.

Answer

S3 Lifecycle policy to expire objects after 365 days and S3 bucket policies to deny deletion of objects with a specific tag indicating legal hold.

Question 5

During a data mapping exercise in BigID, you need to identify data that has exceeded its retention period. Which attribute should be used to filter the data inventory?

Accepted Answer

Retention Expiration Date. In BigID's data inventory, the Retention Expiration Date attribute records when a data asset's retention period ends, so filtering on it directly surfaces data that has exceeded its retention period. This is the purpose-built field for retention compliance workflows and is what privacy teams use to drive deletion or archival actions. Other attributes describe the data's identity, sensitivity, or storage, not its lifecycle timing.

Answer

Data Subject ID

Answer

Classification Level

Answer

Encryption Status

Answer

Data Source Type

Question 6

You are managing Azure Information Protection (AIP) labels. Which action is necessary to ensure that documents classified as 'Highly Confidential' are automatically encrypted?

Accepted Answer

Configure Protection settings in the Label. To ensure that documents classified as 'Highly Confidential' are automatically encrypted, the necessary action is to configure Protection settings in the Label. In Azure Information Protection, labels can be configured with protection settings that apply encryption and rights management when the label is applied. This ensures that any document with that label is automatically protected.

Answer

Modify the Information Rights Management (IRM) template

Answer

Apply Azure Policy

Answer

Enable Auto-Labeling on the Data Source

Question 7

When establishing a data disposal policy in Informatica Enterprise Data Catalog, what must be configured to ensure the disposal process is auditable?

Accepted Answer

Audit Log Configuration. To ensure the data disposal process is auditable in Informatica Enterprise Data Catalog, Audit Log Configuration must be enabled and properly set up. This captures detailed logs of user actions, including data disposal operations, providing a tamper-evident trail that can be reviewed for compliance. Without audit logging, there is no reliable record of who disposed of what data and when, making the process unverifiable.

Answer

Retention Period Policy

Answer

Delete Flag in Schema

Answer

Data Lineage Refresh

Question 8

During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?

Accepted Answer

Ranger Policy Engine. Privacera enforces column-level access policies on Hive tables through the Apache Ranger Policy Engine, which provides centralized authorization and fine-grained row/column filtering. Privacera integrates with Ranger to translate its data access policies into Ranger policies that HiveServer2 enforces at query time, enabling column masking and filtering without altering the underlying data.

Answer

SQL Grant Statements

Answer

Column Encryption

Answer

View-Based Restriction

Question 9

In the context of data classification, which metadata field is most critical for determining the disposal date?

Accepted Answer

Retention Start Date. The Retention Start Date is the most critical metadata field for determining the disposal date because it marks when the retention period begins. Retention policies typically specify a duration (e.g., 7 years) from a trigger event, and the Retention Start Date provides that trigger. Without it, the disposal date cannot be accurately calculated.

Answer

Data Owner

Answer

Encryption Key ID

Answer

Classification Label

Question 10

When using IBM InfoSphere Information Governance Catalog to map sensitive data, what is the primary purpose of a 'Data Class'?

Accepted Answer

To identify and classify sensitive data patterns. The primary purpose of a 'Data Class' in IBM InfoSphere Information Governance Catalog is to identify and classify sensitive data patterns. A Data Class defines a set of criteria (e.g., regular expressions, data patterns) that match sensitive data such as credit card numbers or social security numbers. This classification enables governance and protection of sensitive data.

Answer

To store physical data

Answer

To manage retention policies

Answer

To define user access

Question 11

In the privacy lifecycle, what does the term 'Data Collection' primarily involve?

Accepted Answer

Obtaining and recording personal data from the subject. Data Collection in the privacy lifecycle refers to the phase where personal data is obtained from data subjects and recorded — whether through forms, cookies, sensors, or third parties. It is the first stage of the data lifecycle and triggers privacy obligations like notice, consent, and purpose limitation.

Answer

Destroying records

Answer

Backing up data

Answer

Encrypting data in transit

Question 12

When using Talend Data Fabric for data life cycle management, what is the function of the 'Data Stewardship' component?

Accepted Answer

To allow manual intervention in data processing. In Talend Data Fabric, the Data Stewardship component is designed to bring human judgment into automated data pipelines — it provides workflows where data stewards can review, approve, correct, or reject records that automated rules flag as ambiguous or non-compliant. This manual intervention ensures data quality and policy compliance where automation alone is insufficient.

Answer

To create data maps

Answer

To automate deletion

Answer

To encrypt data

Question 13

In Snowflake, what is the effect of using a 'Dynamic Data Masking' policy on a column containing PII when a non-authorized user runs a SELECT query?

Accepted Answer

The data is returned in a masked format. Dynamic Data Masking in Snowflake applies a masking policy to a column, so when a non-authorized user queries the column, they see masked data (e.g., asterisks or partial values) instead of the actual PII. The query still succeeds, but the returned data is obfuscated based on the policy.

Answer

The entire row is suppressed

Answer

The query fails due to lack of access

Answer

The data is decrypted before display

Question 14

When using Varonis to identify 'stale' data for minimization, what criteria must be defined to avoid false positives?

Accepted Answer

Last Accessed Date. Varonis identifies stale data by tracking the Last Accessed Date (or last modified date, depending on configuration) of files and folders. To avoid false positives, the criteria must be defined around a meaningful inactivity threshold (e.g., no access in 90, 180, or 365 days) and must account for system accounts, backup processes, and antivirus scans that touch files without human interaction. Last Accessed Date is the core signal Varonis uses to flag data for minimization or archival.

Answer

File size threshold

Answer

File extension

Answer

User account status

Question 15

You are using AWS Macie to perform a classification scan. Which feature should be configured to notify the privacy team when sensitive data is found?

Accepted Answer

EventBridge Rule. Amazon Macie publishes findings to Amazon EventBridge, so configuring an EventBridge rule to match Macie finding events and route them to an SNS topic, Lambda, or ticketing system is the correct way to notify the privacy team. EventBridge is the native event-routing service that receives Macie's classification findings and can trigger downstream notifications. The other options are access-control, audit-logging, or storage-policy constructs, not notification mechanisms.

Answer

IAM User Permission

Answer

CloudTrail Log

Answer

S3 Policy