CDPSE Privacy Engineering — 20 Questions

Question 1

A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?

Accepted Answer

SQL Dynamic Data Masking policies. Dynamic Data Masking (DDM) in Azure SQL Database allows masking sensitive data, which can be enforced via integration pipelines.

Answer

Azure Policy definition

Answer

Data Factory Mapping Data Flows

Answer

Azure Key Vault access policies

Question 2

A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?

Accepted Answer

Cloud DLP de-identification template. Cloud DLP (Data Loss Prevention) triggers can be integrated to inspect and redact content in Cloud Storage.

Answer

IAM conditions

Answer

Storage Transfer Service

Answer

Bucket lock

Question 3

A privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?

Accepted Answer

Defining appropriate sensitivity bounds for the input data. Differential privacy involves setting epsilon, delta, and ensuring proper noise injection.

Answer

Choosing a random seed that is publicly known

Answer

Increasing the dataset size to infinite

Question 4

In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API allows for the inspection, de-identification, and redaction of PII within unstructured data.

Answer

Cloud Storage buckets lifecycle policy

Answer

Cloud Identity and Access Management

Answer

Cloud Logging

Question 5

When implementing Privacy by Design (PbD) in a new mobile application, which TWO of the following are considered proactive technical controls?

Accepted Answer

Default privacy settings. Data minimization and privacy-default configurations are foundational proactive PbD controls.

Answer

Periodic external audits

Answer

End-user training

Answer

Comprehensive incident response plan

Question 6

In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?

Accepted Answer

Glue DataBrew. Glue DataBrew allows for data profiling and recipe-based transformations including PII redaction.

Answer

AWS Glue Schema Registry

Answer

AWS Lake Formation

Answer

Amazon Macie

Question 7

A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) limits sensitive data exposure by masking it to non-privileged users at the query execution level.

Answer

Always Encrypted

Answer

Row-Level Security

Answer

Transparent Data Encryption

Question 8

A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?

Accepted Answer

Enable AWS KMS with Customer Managed Keys (SSE-KMS). AWS KMS with customer-managed keys provides better control over access and rotation than S3-managed keys.

Answer

Enable S3 Managed Keys (SSE-S3)

Answer

Enable S3 Object Lock

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 9

A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?

Accepted Answer

server_side_encryption_configuration. The 'sse_algorithm' attribute must be set to 'aws:kms' to enforce server-side encryption with KMS.

Answer

bucket_acl

Answer

versioning_enabled

Answer

public_access_block

Question 10

Which technique is most effective for minimizing PII in a non-production database environment while maintaining referential integrity?

Accepted Answer

Tokenization. Format-preserving encryption or tokenization maintains the structure of the data for testing while protecting the underlying PII.

Answer

Full deletion

Answer

Masking with random noise

Answer

Hashing with a static salt

Question 11

In the context of Privacy by Design, what is the primary role of an 'Access Control Matrix' in a microservices architecture?

Accepted Answer

Principle of least privilege implementation. It explicitly maps subjects to objects and permissions, ensuring the principle of least privilege.

Answer

Log aggregation

Answer

Threat modeling

Answer

Data classification

Question 12

Which of the following is an example of a Privacy-Enhancing Technology (PET) that focuses on data minimization?

Accepted Answer

Synthetic data generation. Synthetic data generation creates new data that mimics the properties of real data without containing the original PII.

Answer

Hardware Security Modules (HSMs)

Answer

AES-256 Encryption

Answer

Vulnerability scanning

Question 13

When implementing differential privacy in a data analytics pipeline, what is the primary technical trade-off the engineer must balance?

Accepted Answer

Privacy budget and accuracy. The epsilon parameter controls the privacy budget, affecting the accuracy of the output and the level of privacy protection.

Answer

Anonymization speed and data volume

Answer

Encryption speed and latency

Answer

Scalability and storage costs

Question 14

When using Homomorphic Encryption, what is the primary limitation for a privacy engineer to consider?

Accepted Answer

Computational overhead. Homomorphic encryption is extremely computationally intensive, often causing significant performance degradation.

Answer

Data loss during processing

Answer

Inability to perform search

Answer

Lack of vendor support

Question 15

You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?

Accepted Answer

Apply suppression to direct identifiers. Quasi-identifiers must be identified, and direct identifiers must be suppressed or removed, as k-anonymity does not protect against direct identification.

Answer

Add synthetic noise

Answer

Normalize the dataset

Answer

Increase the k-value

Question 16

A company needs to share customer demographics with a third party. Which technique allows for statistical analysis without revealing individual identities?

Accepted Answer

Differential privacy. Differential privacy adds mathematical noise to prevent individual re-identification while preserving global trends.

Answer

Encryption

Answer

Data deletion

Answer

Pseudonymization

Question 17

Which of the following is an example of an 'operational' technical control for privacy?

Accepted Answer

Data discovery scanning tools. Automated data discovery scans identify where PII exists, which is necessary for managing privacy.

Answer

Privacy policy document

Answer

Standard Operating Procedure

Answer

Privacy impact assessment

Question 18

A privacy engineer is auditing log data. Which action best aligns with data minimization requirements for logs?

Accepted Answer

Configuring log masking rules. Log masking or filtering ensures that sensitive information is not persisted in log files.

Answer

Centralizing logs in a SIEM

Answer

Enabling full verbose logging

Answer

Setting a long retention policy

Question 19

You are troubleshooting a Federated Learning model. Privacy leakage is occurring during model updates. Which parameter should you adjust to improve privacy?

Accepted Answer

Implement secure aggregation. Adding secure aggregation and increasing the noise in gradients helps prevent inference attacks on model updates.

Answer

Change the learning rate

Answer

Increase the batch size

Answer

Decrease the number of epochs

Question 20

When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?

Accepted Answer

Automated data portability export. Self-service data export allows users to exercise their right of access without manual intervention.

Answer

Account deletion button

Answer

Consent management toggle

Answer

Marketing preference settings