CDPSE Privacy Engineering — 10 Questions

Question 1

A privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defining appropriate sensitivity bounds for the input data. Option B is correct because sensitivity bounds (clamping each record's contribution to a defined range, e.g., via bounded-sum or bounded-mean aggregations) directly limit how much any single individual can influence the output, which is a prerequisite for a valid differential privacy guarantee. Option D is correct because epsilon is the privacy-loss budget: a smaller epsilon means the output distributions for neighboring datasets are closer, so less information about any individual leaks, yielding stronger privacy (at the cost of utility). Option E is correct because the (epsilon, delta)-differential privacy formulation uses delta to bound the probability that the epsilon guarantee fails, providing the probabilistic relaxation needed for mechanisms such as the Gaussian mechanism and for composing many queries. Option A is wrong because a publicly known random seed does not weaken privacy—seeds are not secret keys in differential privacy, and the guarantee holds regardless of seed knowledge. Option C is wrong because dataset size cannot be made infinite and is not a configuration step; while larger datasets improve utility for a fixed epsilon, they are not required to minimize re-identification risk.

Answer

Choosing a random seed that is publicly known

Answer

Increasing the dataset size to infinite

Question 2

In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?

Accepted Answer

Glue DataBrew. AWS Glue DataBrew is a visual data preparation service with built-in PII detection and masking transforms, making it the natural fit for identifying and redacting sensitive columns during ETL. It provides pre-built recipes that can detect PII categories (names, SSNs, credit cards) and apply masking, substitution, or hashing transformations directly in the data preparation workflow. This aligns with the requirement to automatically identify and redact sensitive columns during ETL jobs.

Answer

AWS Glue Schema Registry

Answer

AWS Lake Formation

Answer

Amazon Macie

Question 3

A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?

Accepted Answer

Enable AWS KMS with Customer Managed Keys (SSE-KMS). SSE-KMS with Customer Managed Keys (CMKs) gives the organization full control over the key lifecycle — creation, rotation, disabling, and deletion — while AWS KMS performs the actual encryption and decryption. This satisfies privacy-by-design requirements for encryption at rest with customer-managed keys because the customer governs access via key policies and IAM, and can audit every key use through CloudTrail. It is the only option that combines AWS-managed encryption infrastructure with customer-controlled keys.

Answer

Enable S3 Managed Keys (SSE-S3)

Answer

Enable S3 Object Lock

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 4

When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?

Accepted Answer

Automated data portability export. GDPR Article 15 grants data subjects the right to access their personal data and receive a copy of it in a commonly used, machine-readable format. An automated data portability export directly fulfills this by allowing users to download their data, which also supports Article 20 (Right to Data Portability). This feature ensures transparency and control, aligning with the Privacy Dashboard's purpose of empowering users.

Answer

Account deletion button

Answer

Consent management toggle

Answer

Marketing preference settings

Question 5

In a database, you need to replace social security numbers with a consistent, non-reversible value for analytics. What is the best approach?

Accepted Answer

Salted one-way hashing. Salted one-way hashing produces a consistent, non-reversible value for each SSN, so the same SSN always yields the same hash (enabling joins and analytics) while the original cannot be recovered. A per-record or per-dataset salt prevents rainbow-table and frequency-analysis attacks, making it the best fit for analytics on SSNs where reversibility is not required.

Answer

Deterministic encryption

Answer

Format-preserving encryption

Answer

Randomized tokenization

Question 6

When designing a data retention policy, which technical configuration in S3 best automates the process?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies are the native S3 mechanism for automating object transitions and expiration based on age or date, directly enforcing a data retention schedule without custom code. They can transition objects to cheaper storage classes (e.g., Standard-IA, Glacier) and ultimately expire (delete) them after a defined period, satisfying retention and disposal requirements. This makes them the correct technical control for automating retention policy enforcement in S3.

Answer

S3 Replication

Answer

S3 Inventory

Answer

S3 Object Lock

Question 7

When designing a system with k-anonymity, which metric measures the impact of generalization on the utility of the data?

Accepted Answer

Discernibility penalty. The discernibility penalty is the metric used in k-anonymity to quantify the utility loss caused by generalization and suppression. It measures how distinguishable individual records become after anonymization, with higher values indicating greater information loss. This metric directly reflects the trade-off between privacy protection and data utility.

Answer

Epsilon value

Answer

Entropy loss

Answer

F-score

Question 8

When encrypting data for long-term storage, which configuration is most important for privacy?

Accepted Answer

Frequent key rotation. Frequent key rotation limits the blast radius if a key is compromised, because ciphertext encrypted under retired keys becomes inaccessible once those keys are destroyed, and it satisfies regulatory expectations (NIST SP 800-57, PCI DSS Req. 3.6) for cryptoperiod management. For long-term storage, rotation combined with proper key destruction supports both confidentiality and crypto-shredding for erasure. It is the single most impactful configuration for sustained privacy protection.

Answer

Disabling logging

Answer

Hardcoding the key

Answer

Using a single global key

Question 9

Which of the following is an effective way to implement 'Right to Erasure' in a distributed database system?

Accepted Answer

Asynchronous deletion across nodes. Asynchronous deletion across nodes allows the erasure request to propagate to all replicas without blocking the primary write path, ensuring eventual consistency of deletion while maintaining availability in a distributed system. This approach is standard for implementing GDPR Article 17 in sharded or replicated databases, where synchronous deletion across all nodes would create latency and availability problems. It must be paired with verification that all replicas and backups are purged within the regulatory timeframe.

Answer

Deleting the entire database

Answer

Marking records as deleted

Answer

Overwriting with new user data

Question 10

You are auditing a system for 'Data Minimization'. Which discovery finding would be a primary concern?

Accepted Answer

Holding data beyond the retention period. Data minimization under GDPR Article 5(1)(c) requires that personal data be adequate, relevant, and limited to what is necessary for the stated purpose. Holding data beyond the retention period violates the storage limitation principle (Article 5(1)(e)) and is a direct indicator that minimization controls are failing. An auditor would flag this as a primary concern because it shows data is being kept without a lawful purpose.

Answer

Using AES-256 for encryption

Answer

Using a pseudonym for database keys

Answer

Encrypting backups