CDPSE Data Life Cycle Management Practice Test 3 — 15 Questions

Question 1

When managing data retention in Azure Data Lake Storage (ADLS) Gen2, how do you implement a policy that deletes files older than 7 years?

Accepted Answer

Configure a Lifecycle Management policy rule. Lifecycle Management policies in Azure Data Lake Storage Gen2 allow you to define rules that automatically transition or delete blobs based on age or last access time. To delete files older than 7 years, you configure a rule with a condition like 'daysAfterModificationGreaterThan: 2555' and an action to delete. This is the native, cost-effective way to enforce retention policies at scale.

Answer

Apply a Data Loss Prevention policy

Answer

Create a Power Automate flow to scan the lake

Answer

Use Azure Data Factory to trigger a DELETE SQL query

Answer

Set the 'Delete' flag on the container

Question 2

In the context of the data lifecycle, what is the primary benefit of using a 'Data Catalog' tool like Alation?

Accepted Answer

To provide centralized visibility of data location and use. A Data Catalog such as Alation provides a centralized inventory and metadata repository that shows where data resides, how it flows, who owns it, and how it is used across the enterprise. This centralized visibility is foundational to data lifecycle management because you cannot govern, classify, or dispose of data you cannot locate. It supports privacy programs by enabling discovery, lineage tracking, and impact analysis for subject access requests.

Answer

To provide physical security

Answer

To perform automated data deletion

Answer

To encrypt sensitive files

Question 3

When conducting a Privacy Impact Assessment (PIA) for a new application, what is the role of 'Data Mapping'?

Accepted Answer

To define the flow of PII throughout the application. Data mapping in a PIA is the process of documenting how personally identifiable information (PII) flows through an application—from collection points, through processing, storage, sharing, and eventual deletion. This visibility is essential to identify privacy risks, ensure compliance with regulations (e.g., GDPR), and implement data minimization. Option D correctly captures this core purpose.

Answer

To provide encryption keys

Answer

To automate user consent

Answer

To purge old data records

Question 4

Which of the following is a key objective of a data retention policy?

Accepted Answer

To minimize the amount of data stored and reduce risk. A data retention policy defines how long data is kept and when it should be securely disposed of. Its key objective is to minimize data storage to reduce risk, comply with legal requirements, and lower costs. By retaining only what is necessary, organizations limit exposure to breaches and regulatory penalties.

Answer

To maximize data availability

Answer

To increase storage capacity requirements

Answer

To keep all data forever for future AI training

Question 5

When configuring a 'Data Disposal' process, why is it critical to verify the 'Chain of Custody'?

Accepted Answer

To verify the data was deleted securely. Chain of Custody documentation proves that data was handled, transferred, and destroyed by authorized parties without tampering or gaps. During disposal, it provides auditable evidence that the correct data was securely deleted at the right time by the right people, which is essential for regulatory compliance (GDPR, HIPAA, PCI DSS) and for defending against claims of improper destruction. Without it, an organization cannot demonstrate that disposal actually occurred as required.

Answer

To ensure the database is faster

Answer

To identify who shared the data

Answer

To increase storage space

Question 6

In MongoDB, what is the most effective way to ensure data minimization regarding personally identifiable information?

Accepted Answer

Dropping unused fields from the document schema. Dropping unused fields from the MongoDB document schema is the most effective data-minimization technique because it eliminates PII that is not needed for the application's purpose, directly satisfying GDPR/CCPA minimization principles. MongoDB's flexible schema makes it easy to accumulate legacy fields over time, so schema hygiene — removing fields no longer used — is the primary lever for reducing the PII footprint. This reduces both storage and breach exposure.

Answer

Increasing the backup frequency

Answer

Adding more nodes to the cluster

Answer

Indexing all fields

Question 7

You are managing data in a Kubernetes environment. What strategy should be used to support data minimization for ephemeral pods?

Accepted Answer

Use emptyDir for ephemeral storage. The emptyDir volume type in Kubernetes is created when a pod is assigned to a node and exists only for the lifetime of that pod. When the pod is deleted or evicted, the data in emptyDir is permanently destroyed, which directly supports data minimization by ensuring ephemeral data does not persist beyond its operational need. This aligns with privacy-by-design principles where temporary processing data is automatically purged without manual intervention.

Answer

Always use Persistent Volumes

Answer

Enable persistent logging

Answer

Configure snapshots for all pods

Question 8

What is the primary function of a 'Data Inventory' in a privacy program?

Accepted Answer

To record the location, purpose, and sensitivity of personal data. A Data Inventory is a foundational component of a privacy program. It catalogs personal data elements, recording where data is stored, why it is collected (purpose), and its sensitivity level. This enables organizations to understand data flows, comply with regulations, and respond to data subject requests.

Answer

To automatically encrypt files

Answer

To manage physical server hardware

Answer

To perform user authentication

Question 9

In a data warehouse, which technique is most effective for protecting PII during the ETL (Extract, Transform, Load) process while still allowing analytics?

Accepted Answer

Masking the data during the transformation phase. Masking PII during the transformation phase of ETL is the most effective technique because it protects sensitive data before it lands in the warehouse while preserving the data's analytical utility — formats, referential integrity, and statistical properties can be maintained. This allows analysts to query masked data without exposing raw PII.

Answer

Using access control lists at the reporting layer

Answer

Deleting the data during extraction

Answer

Encrypting the entire database

Question 10

When classifying data for privacy, what does a 'Restricted' label usually signify?

Accepted Answer

Data requiring limited access and enhanced protection. A 'Restricted' classification is the highest sensitivity tier in most data classification schemes, signifying data whose unauthorized disclosure would cause severe harm — requiring strict need-to-know access, encryption, and enhanced monitoring. It typically covers PII, PHI, credentials, and trade secrets. The label drives controls such as least privilege, MFA, DLP, and audit logging.

Answer

Data that can be shared publicly

Answer

Data that has no retention period

Answer

Data that is no longer needed

Question 11

Which TWO methods are commonly used to achieve data minimization in a legacy database?

Accepted Answer

Anonymization of records. Data minimization means limiting stored personal data to what is strictly necessary, and anonymization of records (C) supports this by irreversibly removing or altering identifying fields so the data no longer relates to an identifiable individual, reducing the scope of protected data held. Purging of obsolete data (D) directly enforces minimization by deleting records that are no longer needed for the stated purpose, using operations such as DELETE or DROP on aged rows/tables per a retention schedule. Mirroring (A) merely duplicates the full dataset to another server for availability or failover, which increases rather than reduces the data footprint. Multi-factor authentication (B) is an access-control safeguard, not a data-reduction technique, and increasing indexing (E) only improves query performance while leaving the volume of stored data unchanged.

Answer

Mirroring the database

Answer

Implementing multi-factor authentication

Answer

Increasing database indexing

Question 12

Which TWO outcomes result from effective data classification?

Accepted Answer

Improved application of security controls. Effective data classification is the process of labeling data by sensitivity and value so that handling rules can be tied to each category. Option A is correct because classification drives improved application of security controls: once data is tagged (e.g., Public, Internal, Confidential, Restricted), the appropriate controls such as encryption, access control lists, and DLP policies can be applied consistently and proportionally to each class. Option B is correct because classification enables automated enforcement of retention policies: retention schedules and disposal rules can be mapped to classification labels, allowing systems (e.g., records management or DLP tools) to automatically retain, archive, or delete data per policy. Option C is not a result of classification, since server processing speed depends on hardware, workload, and tuning, not on data labeling. Option D is not guaranteed, as classification organizes and governs data but does not by itself reduce its volume. Option E is unrelated, because user interface design concerns presentation and usability, not data classification outcomes.

Answer

Increased server processing speed

Answer

Reduction in data volume

Answer

Improved user interface design

Question 13

Which THREE factors should be considered when defining a data retention schedule?

Accepted Answer

Regulatory/Legal requirements. Option B (Regulatory/Legal requirements) is correct because data retention schedules must comply with laws and regulations such as GDPR, HIPAA, SOX, or PCI DSS, which mandate minimum or maximum retention periods for specific data types. Option D (Statutory limitations periods) is correct because the time window in which legal claims can be filed dictates how long records must be preserved to support potential litigation or audits. Option E (Operational business utility) is correct because data that still serves ongoing business functions, such as customer history or transaction records, must be retained for as long as it provides operational value. Option A (number of concurrent users) is not relevant because concurrency affects performance sizing, not how long data should be kept. Option C (storage server hardware cost) is not a defining factor because cost may influence implementation choices but does not determine the legally or operationally required retention period.

Answer

The number of concurrent users

Answer

Storage server hardware cost

Question 14

Which TWO metrics are used to measure the effectiveness of data minimization?

Accepted Answer

Reduction in overall data volume. Data minimization effectiveness is measured by how much data an organization stops collecting, storing, or retaining, so option B (Reduction in overall data volume) is correct because shrinking the total amount of stored data directly demonstrates that unnecessary data is being eliminated. Option D (Decrease in records containing PII) is also correct because the core goal of data minimization under privacy frameworks such as GDPR Article 5(1)(c) is to limit personal data to what is strictly necessary, so fewer PII-bearing records is a direct indicator of success. Option A (Database query response time) is a performance metric, not a data-minimization metric, since query speed can improve or degrade independently of how much data is retained. Option C (Increase in storage capacity) is the opposite of minimization and reflects infrastructure growth rather than reduced data footprint. Option E (User satisfaction scores) measures user experience and is unrelated to the volume or sensitivity of data retained.

Answer

Database query response time

Answer

Increase in storage capacity

Answer

User satisfaction scores

Question 15

Which THREE actions are part of a secure data disposal process?

Accepted Answer

Verification of destruction. Verification of destruction (B) is correct because a secure disposal process must confirm that the sanitization or destruction actually succeeded, e.g., via a certificate of destruction or hash/overwrite verification, so residual data cannot be recovered. Digital wiping/sanitization (C) is correct because it is the core technical action that renders data unrecoverable, using methods such as overwriting (e.g., DoD 5220.22-M or NIST SP 800-88 purge/clear), degaussing, or cryptographic erasure before media reuse or disposal. Logging of the disposal event (E) is correct because an auditable record of what was disposed, when, by whom, and by what method is required for compliance (e.g., GDPR, HIPAA, ISO 27001) and chain-of-custody accountability. Moving data to cold storage (A) is not disposal—it merely relocates data to archival media, where it remains readable and recoverable. Renaming files (D) is not disposal either, since renaming only changes metadata references and leaves the underlying data fully intact and recoverable.

Answer

Moving data to cold storage

Answer

Renaming files