CDPSE Privacy Engineering Practice Test 6 — 15 Questions

Question 1

A privacy engineer is reviewing a 'consent management platform' (CMP). Which configuration is necessary to ensure compliance with a user's choice to 'opt-out' of data sharing?

Accepted Answer

Programmatic propagation of the opt-out signal. For a CMP to honor an opt-out, the choice must be programmatically propagated to every downstream system, tag, SDK, or vendor that processes the user's data. A stored preference that never reaches ad tech, analytics, or CRM systems is functionally useless. Programmatic propagation (e.g., via consent strings, APIs, or tag managers) is what actually enforces the user's choice across the data ecosystem.

Answer

Sending an email confirmation to the user

Answer

Storing the choice in a local browser cookie only

Answer

Displaying the privacy policy on the landing page

Question 2

Which THREE of the following are considered standard 'Privacy-Enhancing Technologies' (PETs) used for data protection in analytics?

Accepted Answer

Differential Privacy. Differential Privacy (B) is a canonical PET because it adds calibrated noise (e.g., Laplace or Gaussian mechanisms) to query results so that individual records cannot be distinguished, while aggregate analytics remain statistically useful. Secure Multi-Party Computation (C) is a standard PET that lets multiple parties jointly compute a function over their combined private inputs without revealing those inputs to each other. Homomorphic Encryption (E) is also a recognized PET, allowing computations to be performed directly on ciphertext (e.g., via schemes like Paillier, BFV, or CKKS) so data stays encrypted during analytics. By contrast, a Network Intrusion Detection System (A) is a security monitoring control for detecting malicious traffic, not a data-privacy technique, and Full-Disk Encryption (D) protects data at rest against physical theft but does not enable privacy-preserving analytics on shared or outsourced data.

Answer

Network Intrusion Detection System

Answer

Full-Disk Encryption

Question 3

When designing a privacy-preserving data pipeline, which TWO strategies help achieve 'Data Minimization'?

Accepted Answer

Truncating or hashing identifiers before ingestion. Data minimization means collecting and keeping only the personal data that is strictly necessary for the stated purpose, so option B is correct: truncating or hashing identifiers before ingestion removes or de-identifies direct identifiers so the pipeline never stores more identifying detail than needed. Option E is also correct because aggregating data points to a higher level of abstraction reduces granularity and prevents individual-level records from being retained, which directly limits the amount of personal data processed. Option A is wrong because disabling all audit logging does not minimize data; it removes accountability and security controls, and audit logs are typically required for compliance. Option C is wrong because increasing backup retention keeps personal data longer, which contradicts minimization and storage-limitation principles. Option D is wrong because storing all raw data in a data lake for future use is the opposite of minimization, as it retains maximal data beyond current necessity.

Answer

Disabling all audit logging

Answer

Increasing the retention period for backups

Answer

Storing all raw data in a data lake for future use

Question 4

Which THREE techniques are commonly used to achieve 'Pseudonymization' for PII in data sets?

Accepted Answer

Partial masking. Partial masking (A) is correct because it replaces part of a PII value with a placeholder (e.g., showing only the last four digits of an account number), which preserves some utility while preventing direct identification and can be reversed only with additional reference data, fitting the pseudonymization goal of replacing direct identifiers with artificial ones. Hashing with a secure salt (C) is correct because a salted cryptographic hash maps an identifier to a consistent pseudonym that supports matching or joins without revealing the original value, and the salt defends against rainbow-table and precomputation attacks. Tokenization (D) is correct because it substitutes a sensitive value with a non-sensitive surrogate token whose mapping to the original data is held in a separate, protected token vault, which is a canonical pseudonymization technique. Data deletion (B) is not pseudonymization because it irreversibly removes the data rather than replacing identifiers, and encryption without key management (E) is not a valid pseudonymization technique since pseudonymization requires controlled re-identification via separately kept keying material, which is absent here.

Answer

Data deletion

Answer

Encryption without key management

Question 5

Which TWO actions should be taken when performing a 'Privacy Impact Assessment' (PIA) on a new software tool?

Accepted Answer

Evaluate potential risks to the rights and freedoms of individuals. A Privacy Impact Assessment (PIA) is a structured process for identifying and mitigating privacy risks before deploying a new tool, so option D is correct: evaluating potential risks to the rights and freedoms of individuals is the core purpose of a PIA, aligning with GDPR-style risk analysis of how personal data processing may affect data subjects. Option E is also correct because documenting the data lifecycle from collection to destruction is a fundamental PIA activity — it maps what personal data is collected, why, how it is stored and shared, retention periods, and secure disposal, which is necessary to assess and mitigate privacy risks. The other options do not belong: deleting all historical databases (A) is a destructive, indiscriminate action unrelated to assessment, updating server firmware (B) is a routine patch-management task with no bearing on privacy risk evaluation, and purchasing the most expensive enterprise security suite (C) is a cost-driven procurement decision rather than a PIA step, since a PIA evaluates risks and controls rather than mandating a specific product.

Answer

Delete all historical databases

Answer

Update the server firmware version

Answer

Purchase the most expensive enterprise security suite

Question 6

Which THREE considerations are critical when implementing 'Anonymization' to ensure it meets the standard of being 'irreversible'?

Accepted Answer

Prevention of inference attacks where attributes can be predicted. Option E is correct because removing all direct identifiers (such as names, social security numbers, email addresses, and account numbers) is the foundational step of anonymization—without it, data remains personally identifiable and reversibility is trivial. Option D is correct because protection against linkage attacks using quasi-identifiers (e.g., ZIP code, birth date, gender) is essential; if quasi-identifiers remain unique or near-unique, an attacker can join the dataset with external data sources to re-identify individuals, making the anonymization reversible. Option A is correct because preventing inference attacks—where sensitive attributes can be predicted from other released attributes—is critical to irreversibility; techniques like k-anonymity, l-diversity, and t-closeness address this by ensuring that sensitive values cannot be inferred with confidence. Option B is not correct because user consent is a legal/privacy compliance requirement (e.g., GDPR) but does not by itself make anonymization irreversible. Option C is not correct because AES-256 encryption is a reversible cryptographic operation; encrypted data can be decrypted with the key, so it does not achieve irreversible anonymization.

Answer

Requirement for user consent

Answer

Encrypting the data with AES-256

Question 7

Which THREE types of data are considered 'sensitive' and require heightened privacy controls?

Accepted Answer

Health and medical records. Health and medical records (A) are sensitive because they contain protected health information (PHI) whose disclosure can cause discrimination or harm, and they are regulated under laws such as HIPAA and GDPR's special categories. Biometric identifiers (B) such as fingerprints, facial geometry, and iris scans are uniquely linked to an individual and are irrevocable if compromised, making them a high-risk category requiring heightened privacy controls. Financial account numbers (C) like bank account, credit card, and routing numbers enable fraud and identity theft, so they are classified as sensitive personal data under standards such as PCI DSS and GLBA. By contrast, an employee internal job title (D) is ordinary workforce metadata with low disclosure risk, and a publicly available business address (E) is already open information that by definition cannot be considered sensitive.

Answer

Employee internal job title

Answer

Publicly available business address

Question 8

Which TWO features in a cloud IAM configuration help enforce 'Least Privilege' as a privacy control?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is correct because it grants or denies access dynamically based on attributes such as user department, resource tags, or environment, so permissions can be scoped narrowly to only what matches the required context rather than broad role assignments. Just-in-Time (JIT) privileged access is correct because it grants elevated permissions only for a limited time and only when needed, then automatically revokes them, minimizing standing privileges and reducing the attack surface. Together, ABAC and JIT directly support least privilege by limiting both the scope and duration of access. Hardcoding credentials in scripts is wrong because it exposes secrets and creates persistent, over-broad access. Setting all S3 buckets to public is wrong because it removes access controls entirely. Adding all users to the Admin group is wrong because it grants excessive, standing privileges to everyone.

Answer

Hardcoding credentials in scripts

Answer

Setting all S3 buckets to public

Answer

Adding all users to the 'Admin' group

Question 9

A privacy engineer is designing a system that stores user date-of-birth values in a database. The business requirement is to support age-band analytics (e.g., 18-24, 25-34) without ever exposing the exact birth date to the analytics team. Which privacy engineering technique should be implemented to meet this requirement?

Accepted Answer

Generalization. Generalization is the correct technique because it transforms exact birth dates into broader age ranges, allowing age-band analytics without exposing precise personal data. It directly supports data minimization and purpose limitation by ensuring the analytics team only sees the level of detail necessary for the stated business need. Other techniques either preserve the exact value or protect it without reducing granularity.

Answer

Pseudonymization

Answer

Encryption at rest

Answer

Tokenization

Question 10

A privacy engineer is implementing a consent management platform for a mobile application. The platform must capture, store, and enforce user consent preferences across multiple microservices. Which two actions should the engineer take to ensure consent is technically enforceable and auditable? (Choose two.)

Accepted Answer

Store consent records with a timestamp, version of the privacy notice, and the specific purposes consented to.. To make consent technically enforceable and auditable, the engineer must both record granular consent details (timestamp, notice version, purposes) and enforce those preferences at the point of processing within each microservice. Recording alone does not prevent processing, and enforcement without a reliable record lacks proof. Together, they create a robust consent management system that supports compliance and user rights.

Answer

Encrypt consent records using a symmetric key stored in the application code to prevent tampering.

Answer

Rely on the mobile operating system's permission prompts as the sole mechanism for capturing consent for all data processing purposes.

Answer

Allow users to change their consent preferences only through a customer support ticket to maintain a controlled audit trail.

Question 11

A privacy engineer is designing a customer analytics platform that ingests data from multiple sources. The platform will use Apache Kafka to stream events. To support the principle of data minimization, the engineer wants to ensure that only the fields necessary for analytics are persisted in the data lake. Which Kafka feature should be used to transform and filter records before they are written to the sink?

Accepted Answer

Kafka Streams with a filter and map operation. Kafka Streams enables in-stream processing, allowing the engineer to filter out records and project only necessary fields before the data reaches the sink. This directly implements data minimization by ensuring that only required data is persisted. Other Kafka features like Connect, ACLs, and idempotence do not perform data transformation or filtering.

Answer

Kafka broker topic-level ACLs

Answer

Kafka Connect with a JDBC source connector

Answer

Kafka producer idempotence

Question 12

A privacy engineer is configuring a data retention policy for a system that processes customer personal data. The policy must automatically delete data after its retention period expires. Which technical control best ensures that personal data is not retained beyond its defined lifecycle?

Accepted Answer

Automated deletion jobs triggered by data age. Automated deletion jobs are the correct control because they systematically remove personal data once the retention period expires, directly enforcing the storage limitation principle. Other controls may protect or restrict access to data but do not ensure its deletion. This makes automated deletion the best technical fit for the stated policy requirement.

Answer

Data loss prevention (DLP) monitoring outbound traffic

Answer

Role-based access control restricting who can view the data

Answer

Database backup encryption

Question 13

A privacy engineer is evaluating a new third-party API that will process personal data. The API requires sending data over the internet. To ensure privacy during transmission, which technical control should be implemented to protect the data in transit?

Accepted Answer

TLS 1.3 with mutual authentication. TLS 1.3 with mutual authentication is the most appropriate control because it encrypts data in transit and verifies both parties' identities, ensuring that personal data is not intercepted or sent to an impostor. It is widely supported for API communications and does not require special network configurations. Other options like IPsec, SSH tunneling, or VPN are either not feasible for third-party APIs or do not provide the same level of application-layer security.

Answer

SSH tunneling to the API endpoint

Answer

IPsec tunnel between the organization and the API provider

Answer

VPN connection to the API provider's network

Question 14

A privacy engineer is working with a data science team that wants to use a production customer database for developing a churn prediction model. The database contains names, email addresses, and purchase histories. The team proposes to replace names and email addresses with random identifiers and store the mapping in a separate table. Which privacy engineering technique is being applied?

Accepted Answer

Pseudonymization. Pseudonymization is the correct technique because it replaces direct identifiers with pseudonyms while maintaining a separate mapping that allows re-identification. This preserves analytical utility for the data science team while reducing privacy exposure. Anonymization would require irreversible de-identification, and masking typically does not involve a reversible mapping. Tokenization is a specific form of pseudonymization often used for payment data, but the scenario's description of a mapping table aligns with general pseudonymization.

Answer

Anonymization

Answer

Data masking

Answer

Tokenization

Question 15

A privacy engineer is designing a new mobile health application that will collect continuous heart rate data from wearable sensors. The application must comply with GDPR and the organization's privacy policy, which mandates data minimization and purpose limitation. The engineer proposes storing raw sensor data indefinitely to support future research. Which action should the engineer take to align with privacy engineering principles?

Accepted Answer

Implement a data retention schedule that automatically deletes raw sensor data after a defined period, retaining only aggregated or anonymized data for research.. The correct action is to implement a retention schedule that deletes raw data after a defined period and retains only aggregated or anonymized data for research. This enforces data minimization and storage limitation, key privacy engineering principles. Encryption, consent, and access controls are important but do not replace the need to limit data retention to what is necessary for the specified purpose.

Answer

Encrypt the raw sensor data at rest and in transit, and store it indefinitely because encryption protects against unauthorized access.

Answer

Store raw sensor data in a separate database with strict access controls, and allow only the research team to access it for any purpose.

Answer

Obtain explicit consent from users to store their data indefinitely for future research, and rely on that consent as the legal basis.