CDPSE Privacy Engineering Practice Test 4 — 15 Questions

Question 1

When configuring a Cloud Service Provider's (CSP) 'Storage Access' permissions, which configuration best supports the principle of data segregation?

Accepted Answer

Service-specific IAM policies. Service-specific IAM policies scope permissions to individual services and resources, so each workload or team only accesses the storage it needs — this is the direct implementation of data segregation in a CSP. By attaching narrowly scoped policies (e.g., allowing s3:GetObject only on a specific bucket prefix), the organization enforces logical separation between data domains. This aligns with the principle of least privilege and with segregation-of-duties requirements in privacy frameworks.

Answer

Global administrative access

Answer

Public read-only access

Answer

Wildcard permissions

Question 2

What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?

Accepted Answer

Minimizing or protecting personal data. Privacy-Enhancing Technologies (PETs) are a class of technical measures designed to protect personal data throughout its lifecycle by minimizing collection, limiting linkability, and reducing identifiability. Their core objective is to enable data processing while safeguarding individual privacy, not to improve infrastructure performance. Options like processing power, bandwidth, and software quality are unrelated to the privacy purpose of PETs.

Answer

Increasing processing power

Answer

Improving network bandwidth

Answer

Reducing software bugs

Question 3

Which THREE features are essential when implementing a robust 'Consent Management Platform' (CMP)?

Accepted Answer

Immutable consent audit logs. Option A (Immutable consent audit logs) is correct because a robust CMP must maintain tamper-evident, time-stamped records of every consent grant, change, and withdrawal to demonstrate compliance with regulations such as GDPR Article 7(1) and CCPA, which require the controller to prove consent was obtained. Option D (Granular opt-in toggles) is correct because regulations like GDPR require consent to be specific and informed per processing purpose, so the CMP must let users opt in separately for distinct data uses (e.g., analytics vs. marketing) rather than bundling them into a single blanket acceptance. Option E (Easy consent withdrawal) is correct because GDPR Article 7(3) mandates that withdrawing consent be as simple as giving it, so the CMP must provide an accessible, low-friction mechanism to revoke consent at any time. Option B (Automatic account creation) is not a consent-management function — it is an identity/provisioning feature and could even conflict with data-minimization principles. Option C (Automated data deletion) is a data-lifecycle/retention capability, not an essential CMP feature, since the CMP's core role is capturing and enforcing consent state rather than executing deletion workflows.

Answer

Automatic account creation

Answer

Automated data deletion

Question 4

Which TWO of the following are key privacy engineering objectives when designing a system that processes sensitive health data?

Accepted Answer

Data minimization. Data minimization (A) is a core privacy engineering objective because it limits collection and retention of sensitive health data to what is strictly necessary for the specified purpose, reducing exposure and regulatory risk under frameworks like GDPR and HIPAA. Transparency of processing (D) is equally fundamental, since data subjects must be informed about what health data is collected, why, how it is used, and with whom it is shared, enabling informed consent and accountability. Hardware cost reduction (B) is an economic/financial goal, not a privacy objective, and does not address how personal data is protected. Maximum system availability (C) is an availability/security concern that, while important, is not itself a privacy engineering objective and can even conflict with privacy if it encourages excessive data retention. High performance throughput (E) is a performance engineering goal unrelated to protecting the privacy of health data.

Answer

Hardware cost reduction

Answer

Maximum system availability

Answer

High performance throughput

Question 5

Which THREE privacy-enhancing technologies are commonly used to facilitate data analysis on distributed datasets without centralizing the raw PII?

Accepted Answer

Federated Learning. Federated Learning (A) is correct because it trains models locally on each distributed data source and only shares model updates or gradients with a central aggregator, so raw PII never leaves its origin. Secure Multi-Party Computation (B) is correct because it lets multiple parties jointly compute a function over their private inputs while keeping those inputs secret, enabling distributed analysis without pooling raw data. Differential Privacy (C) is correct because it adds calibrated noise or enforces privacy budgets so aggregate statistics and query results can be released without revealing information about any individual record. Full disk encryption (D) is not correct here because it only protects data at rest on a device and does not enable distributed analysis without centralizing raw PII. Network load balancing (E) is not correct because it merely distributes traffic across servers for availability and performance and provides no privacy-preserving computation capability.

Answer

Full disk encryption

Answer

Network load balancing

Question 6

Which TWO actions should be taken when decommissioning an old server containing PII?

Accepted Answer

Cryptographic erasure of the drives. Cryptographic erasure (Option B) is correct because destroying the encryption keys that protect the data renders the PII permanently unrecoverable, which is an approved media-sanitization method for encrypted drives under NIST SP 800-88. Physical destruction of the drives (Option D) is also correct because shredding, incinerating, or pulverizing the storage media guarantees the PII cannot be reconstructed, satisfying the strongest sanitization requirement for decommissioned hardware. Saving logs to a cloud bucket (Option A) does not sanitize the drives and may even increase PII exposure, moving data to a temporary folder (Option C) merely relocates the PII without removing it, and reformatting the partition (Option E) only removes file-system references, leaving recoverable data remnants on the disk.

Answer

Saving logs to a cloud bucket

Answer

Moving data to a temporary folder

Answer

Reformatting the partition

Question 7

Which THREE factors are critical for balancing privacy and utility when using k-anonymity?

Accepted Answer

Selection of quasi-identifiers. Option A is correct because k-anonymity only works when you first identify the quasi-identifiers (e.g., ZIP code, age, gender) that could be joined with external data to re-identify individuals; choosing them correctly determines what must be protected. Option B is correct because the k-value sets the minimum group size each record must share, directly trading off privacy (higher k) against data utility (lower k). Option D is correct because the generalization level (and suppression) determines how much detail is blurred in quasi-identifiers, which controls the privacy-utility balance. Option C is not a design factor for balancing privacy and utility; total user count affects feasibility but is not a tuning knob. Option E is irrelevant because server CPU count is a performance resource, not a privacy-utility parameter.

Answer

The total number of users

Answer

The server CPU count

Question 8

Which TWO technical controls are effective for limiting the scope of PII access in a cloud-based SQL environment?

Accepted Answer

Column-level security. Column-level security (A) is correct because it restricts which columns (fields) a given user or role can read, so PII stored in specific columns can be hidden while non-sensitive columns remain accessible, directly limiting the scope of PII exposure. Row-level security (B) is correct because it filters which rows a user can see based on predicates such as tenant ID or region, ensuring users only access the PII records that pertain to them. Together these two controls enforce least-privilege access at the data granularity level in a cloud SQL environment. Public network access (C) is not a limiting control; it broadens exposure by allowing connections from the internet. Full database export (D) increases PII scope by copying the entire dataset out of the database. Verbose error logging (E) is a monitoring/diagnostic measure and can even leak sensitive data in error messages, so it does not limit PII access.

Answer

Public network access

Answer

Full database export

Answer

Verbose error logging

Question 9

Which TWO methods are effective for preventing 'Inference Attacks' in a data analytics platform?

Accepted Answer

Query throttling/auditing. Query throttling and auditing (A) is correct because inference attacks rely on repeatedly issuing many overlapping or narrowly scoped queries and correlating the results; rate-limiting, capping query volume, and logging/alerting on suspicious query patterns reduce the attacker's ability to aggregate enough outputs to deduce sensitive facts. Differential privacy (C) is correct because it adds calibrated statistical noise to query results so that any single individual's data has a bounded influence on the output, mathematically limiting what can be inferred about specific records even across many queries. The remaining options are not preventive controls: disabling all encryption (B) weakens confidentiality and makes inference/exfiltration easier, full public data access (D) directly exposes the data and enables inference, and raw data export (E) hands over the underlying records, which is the opposite of preventing inference.

Answer

Disabling all encryption

Answer

Full public data access

Answer

Raw data export

Question 10

Which TWO of the following are privacy-by-design principles relevant to software development?

Accepted Answer

Proactive and preventative. Option A, 'Proactive and preventative,' is correct because privacy-by-design, as articulated by Ann Cavoukian, requires anticipating and preventing privacy risks before they occur rather than remediating them after a breach or complaint. Option B, 'Privacy by Default,' is correct because it mandates that the most privacy-protective settings apply automatically without requiring user action, ensuring personal data is protected by default. In contrast, option C, 'Maximum data retention,' contradicts the data-minimization and storage-limitation principles, which require keeping personal data only as long as necessary. Option D, 'Maximize development speed,' is a business goal unrelated to privacy principles and can conflict with proper privacy safeguards. Option E, 'Focus on user interface color,' concerns visual design aesthetics and has no bearing on privacy-by-design principles.

Answer

Maximum data retention

Answer

Maximize development speed

Answer

Focus on user interface color

Question 11

Which TWO of the following are key privacy controls in an AWS environment?

Accepted Answer

Amazon Macie. Amazon Macie (B) is a key privacy control because it uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3, directly supporting data privacy and compliance requirements. AWS Key Management Service (C) is also a key privacy control because it lets you create and manage cryptographic keys and control their use across AWS services, enabling encryption of data at rest and in transit so that sensitive information remains confidential and access is auditable. The other options do not serve as privacy controls: AWS CloudFront (A) is a content delivery network for caching and accelerating content, AWS Auto Scaling (D) dynamically adjusts compute capacity for availability and cost, and AWS Glue Schema Registry (E) manages and validates schemas for streaming data rather than protecting sensitive data privacy.

Answer

AWS CloudFront

Answer

AWS Auto Scaling

Answer

AWS Glue Schema Registry

Question 12

Which THREE attributes are typically included in a 'Privacy Metadata' schema to support automated data governance?

Accepted Answer

Data owner identifier. Option A (Data owner identifier) is correct because privacy metadata schemas must record the accountable party (person or role) responsible for the data, enabling automated governance workflows such as access approvals, policy enforcement, and incident routing. Option C (Data retention policy) is correct because retention rules define how long data may be kept and when it must be deleted or archived, which automated governance tools use to trigger lifecycle actions and enforce compliance (e.g., GDPR storage limitation). Option E (Data classification label) is correct because classification (e.g., Public, Internal, Confidential, PII) drives automated handling rules such as encryption, masking, access control, and DLP policies. Option B (Database server IP) is not a privacy metadata attribute; it is infrastructure/asset metadata used for network or inventory purposes, not for describing privacy characteristics of the data. Option D (System uptime monitor) is unrelated operational telemetry about availability, not privacy governance metadata.

Answer

Database server IP

Answer

System uptime monitor

Question 13

Which TWO of the following are effective ways to protect logs that contain PII?

Accepted Answer

Encryption at rest. Encryption at rest (A) is correct because it protects PII in logs by rendering the stored data unreadable without the appropriate decryption keys, so even if the underlying storage or backups are exposed, the PII cannot be accessed. Restricted IAM access policies (C) are correct because applying least-privilege permissions ensures only authorized identities can read, modify, or delete the log data, directly limiting exposure of PII to approved personnel and services. Disabling log rotations (B) is not a protection measure; it increases retention and exposure while risking storage exhaustion, and rotation is typically needed for security and compliance. Broad read access for all employees (D) is the opposite of least privilege and would expose PII to unnecessary parties. Sending logs to a public URL (E) makes the data openly accessible, which is a severe data leak rather than a protection.

Answer

Disabling log rotations

Answer

Broad read access for all employees

Answer

Sending logs to a public URL

Question 14

Which THREE technical approaches assist in 'Right to Portability' implementation?

Accepted Answer

Automated data lifecycle management. Option A, automated data lifecycle management, is correct because it provides the systematic tracking, retention, and controlled movement of personal data across its lifecycle, which is essential to locate and assemble all data belonging to a data subject for a portability request. Option B, secure data export APIs, is correct because portability requires a mechanism to transmit personal data to the data subject or another controller in a structured, commonly used format, and authenticated, encrypted APIs enable that transfer safely and reliably. Option E, machine-readable formats, is correct because GDPR-style portability mandates that data be provided in a structured, commonly used, and machine-readable format (e.g., JSON, XML, CSV) so it can be reused without manual intervention. Option C, manual data entry, is not appropriate because it is error-prone, unscalable, and does not satisfy the requirement for an automated, structured, machine-readable transfer. Option D, full database replication, is not appropriate because portability concerns only the specific personal data of the requesting data subject, not wholesale duplication of entire databases, which would expose unrelated data and violate data minimization.

Answer

Manual data entry

Answer

Full database replication

Question 15

Which TWO actions help improve privacy in a containerized environment (e.g., Kubernetes)?

Accepted Answer

Kubernetes Secrets management. Kubernetes Secrets management (B) is correct because it stores sensitive data such as credentials, tokens, and keys in base64-encoded objects that can be mounted as volumes or exposed as environment variables, and when combined with encryption at rest and RBAC restrictions, it prevents credentials from being hard-coded in images or manifests where they could leak. Kubernetes Network Policies (E) are correct because they act as pod-level firewalls using label selectors to define ingress and egress rules, enforcing least-privilege microsegmentation so that a compromised container cannot freely reach other pods or exfiltrate data. Increasing container replica count (A) only affects availability and scaling, not privacy, since more identical instances do not reduce data exposure. Using public container registries (C) weakens privacy by exposing image metadata and potentially pulling untrusted or vulnerable images. Disabling logging (D) is not a privacy control; it removes audit trails and hinders detection of unauthorized access, which is the opposite of good security practice.

Answer

Increasing container replica count

Answer

Using public container registries

Answer

Disabling logging