CDPSE Privacy Engineering Practice Test 7 — 15 Questions

Question 1

A privacy engineer is implementing a data retention policy for a customer relationship management (CRM) system. The policy requires that customer records be retained for exactly 7 years and then automatically deleted. The CRM vendor offers a built-in retention feature that soft-deletes records after the period, but the records remain recoverable for 30 days. Which action should the engineer take to ensure compliance with the retention policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the built-in retention feature to soft-delete after 7 years, then schedule a separate process to permanently purge soft-deleted records after the 30-day recovery window.. The correct approach combines the vendor's retention feature for initial soft-deletion with a scheduled purge after the recovery window. This ensures permanent deletion at the required time while maintaining a controlled, auditable process. It respects the policy's exact retention period and avoids risky direct database operations or manual interventions.

Answer

Implement a custom script that hard-deletes records from the production database after 7 years, ignoring the vendor's soft-delete feature.

Answer

Extend the retention period to 7 years and 30 days to account for the soft-delete recovery window, then manually delete records via the CRM user interface.

Answer

Configure the built-in retention feature to soft-delete records after 7 years and rely on the vendor's backup expiration to permanently remove data.

Question 2

A privacy engineer is implementing a data anonymization pipeline for a dataset containing user records. The goal is to prevent re-identification while maintaining data utility for analytics. Which two techniques should be applied to achieve this? (Choose two.)

Accepted Answer

Adding random noise to numerical values. Generalization and adding random noise are effective anonymization techniques that balance privacy and utility. Generalization reduces data precision to make records less unique, while noise addition (e.g., differential privacy) protects individual data points without destroying aggregate patterns. Suppression of all quasi-identifiers harms utility, encryption is reversible, and hashing alone is insufficient for anonymization.

Answer

Suppression of all quasi-identifiers

Answer

Encrypting the dataset with AES-256

Answer

Hashing all direct identifiers with SHA-256

Question 3

A privacy engineer is designing a new customer analytics platform that will process personal data from multiple sources. The platform must support the GDPR right to erasure. Which two technical measures should be implemented to ensure erasure requests can be fulfilled effectively? (Choose two.)

Accepted Answer

Maintain a centralized index that maps all personal data to the individual across all storage systems.. The right to erasure requires the ability to locate and delete all instances of an individual's personal data. A centralized index enables comprehensive discovery across systems, while cryptographic erasure ensures that data in immutable or backup storage can be effectively rendered inaccessible. Together, these measures provide a robust technical foundation for honoring erasure requests in a distributed environment.

Answer

Rely on manual deletion processes triggered by customer support tickets.

Answer

Store all personal data in a single database to simplify deletion.

Answer

Use a write-once, read-many (WORM) storage model for all personal data.

Question 4

A privacy engineer is implementing a data retention policy for a customer relationship management (CRM) system. The policy requires that customer records be retained for exactly 7 years and then automatically deleted. The CRM vendor offers a built-in retention feature that soft-deletes records after the period, but the records remain recoverable for 30 days. Which action should the engineer take to ensure compliance with the retention policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The data lake duplicates personal data, increasing the attack surface and potentially violating data minimization principles.. The most critical concern is that the data lake duplicates personal data, increasing the attack surface and violating data minimization. Centralizing personal data from multiple services creates a high-value target and contradicts privacy by design. While availability, performance, and format compatibility are valid, they are secondary to the fundamental privacy risk of unnecessary data duplication and centralization.

Answer

The data lake may become a single point of failure for DSAR processing, affecting availability.

Answer

The data lake may not support all data formats used by the microservices, leading to incomplete DSAR responses.

Answer

The near real-time ingestion may cause performance degradation in the source microservices.

Question 5

A privacy engineer is configuring a database that stores personal data. To support the principle of access control, the engineer needs to ensure that users can only access data necessary for their role. Which database feature should be used to restrict access at the row level based on user attributes?

Accepted Answer

Row-level security (RLS) policies. Row-level security (RLS) policies are designed to restrict access to rows based on user attributes, such as role or department. This enables fine-grained access control, ensuring users only see data relevant to their role. Column-level encryption, views, and table-level RBAC do not provide dynamic row-level filtering per user, making them unsuitable for this requirement.

Answer

Role-based access control (RBAC) at the table level

Answer

Database views with WHERE clauses

Answer

Column-level encryption

Question 6

A privacy engineer is reviewing a new mobile application that collects location data. The app currently requests access to the device's precise location every time it is opened, even when the user is not actively using the app. Which privacy engineering principle is being violated?

Accepted Answer

Data minimization. Data minimization is violated because the app collects precise location data more frequently and with greater precision than necessary for its functionality, especially when the user is not actively using the app. This principle dictates that collection should be limited to what is adequate, relevant, and necessary. The other principles address purpose, retention, and security, which are not the primary issues in this scenario.

Answer

Integrity and confidentiality

Answer

Storage limitation

Answer

Purpose limitation

Question 7

A privacy engineer is designing a system that processes biometric data for access control. The system uses a fingerprint scanner that converts the fingerprint into a mathematical template. The engineer must ensure that the original fingerprint cannot be reconstructed from the stored template. Which technique should be implemented?

Accepted Answer

Apply a non-invertible transformation, such as a fuzzy extractor or biohashing, to create a protected template.. The correct technique is a non-invertible transformation such as a fuzzy extractor or biohashing. These methods create a protected template that is irreversible, so the original fingerprint cannot be reconstructed, while still allowing biometric matching. Encryption, hashing, and secure storage do not meet the irreversibility requirement for biometric templates.

Answer

Store the fingerprint template in a secure enclave with strict access controls and audit logging.

Answer

Use a one-way hash function with a salt to store the fingerprint template.

Answer

Store the fingerprint template encrypted with AES-256 and manage keys in a hardware security module (HSM).

Question 8

A privacy engineer at a health-tech company is designing a new patient portal. The portal must allow patients to view their own records but must prevent them from inferring information about other patients through aggregate queries. Which technical control should be implemented to meet this requirement?

Accepted Answer

Differential privacy applied to aggregate query results.. Differential privacy is designed to protect individual privacy when aggregate statistics are released. By adding noise to query results, it ensures that no single patient's data can be inferred. Role-based access control and encryption do not prevent inference from aggregates, and rate limiting only reduces query volume. Thus, differential privacy is the correct technical control.

Answer

Query rate limiting to prevent excessive queries from a single user.

Answer

Role-based access control (RBAC) that restricts users to their own patient ID.

Answer

Encryption of patient records at rest using AES-256.

Question 9

A privacy engineer is implementing a consent management platform (CMP) for a website that uses cookies and similar tracking technologies. The CMP must comply with GDPR and ePrivacy Directive. Which TWO features are essential for the CMP to ensure valid consent? (Choose two.)

Accepted Answer

The CMP must record and store a timestamped proof of consent for each user.. The essential features are the ability for users to withdraw consent as easily as they gave it, and the recording of timestamped proof of consent. These ensure ongoing user control and accountability, both required by GDPR. Blocking all cookies is too broad, pre-checked boxes are invalid, and a single 'accept all' without granularity fails the specificity requirement.

Answer

The CMP must allow users to consent to all cookies with a single click, without granular options.

Answer

The CMP must use pre-checked boxes for non-essential cookies to improve user experience.

Answer

The CMP must block all cookies until the user provides explicit consent for each category.

Question 10

A privacy engineer is implementing a data retention policy for a customer relationship management (CRM) system. The policy requires that customer records be retained for exactly 7 years and then automatically deleted. The CRM vendor offers a built-in retention feature that soft-deletes records after the period, but the records remain recoverable for 30 days. Which action should the engineer take to ensure compliance with the retention policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a scheduled job that queries for inactive tenants and deletes their records using tenant-specific identifiers.. The most effective approach is to implement a scheduled job that identifies inactive tenants and deletes their records using tenant-specific identifiers. This method respects the logical separation in the multi-tenant database, ensures only the intended data is removed, and can be automated for consistent enforcement. Other options either affect other tenants, do not achieve actual deletion, or are overly disruptive.

Answer

Shred the entire database and restore from backups that exclude the inactive tenants.

Answer

Move inactive tenants' data to a separate cold storage table and mark it for deletion after a grace period.

Answer

Encrypt each tenant's data with a unique key and delete the key when the tenant becomes inactive.

Question 11

A multinational e-commerce company is implementing a privacy-preserving data analytics pipeline. The pipeline ingests customer behavior events from web and mobile apps, and analysts need to query the data without accessing raw PII. The company wants to ensure that even if the analytics environment is compromised, raw PII remains protected. Which approach best achieves this?

Accepted Answer

Tokenize PII at ingestion and store tokens in a separate vault; analysts query only tokenized data.. Tokenization at ingestion with a separate vault ensures that raw PII never enters the analytics environment. Analysts query tokenized data, preserving analytical utility while protecting PII. Encryption with key access or row-level security still allows access to raw PII under certain conditions. Thus, tokenization with a vault is the most effective approach.

Answer

Store raw events in an encrypted Amazon S3 bucket and provide analysts with decryption keys.

Answer

Use column-level encryption in the analytics database and grant analysts access to encrypted columns.

Answer

Implement row-level security (RLS) in the analytics database to filter PII based on user role.

Question 12

A healthcare analytics team wants to share a patient dataset with an external research partner for statistical modelling. The dataset contains direct identifiers such as full names, national ID numbers, and dates of birth. The privacy engineer must ensure that re-identification risk is minimized before sharing. Which technique should be applied FIRST to the dataset?

Accepted Answer

Suppress or generalize the direct identifiers and quasi-identifiers.. De-identification begins by removing or generalizing the attributes that make a record unique. Direct identifiers and quasi-identifiers must be transformed before any statistical disclosure control technique can be effective. Applying suppression or generalization first lowers the maximum re-identification risk and creates the conditions under which techniques such as k-anonymity, l-diversity, or differential privacy can be meaningfully applied to the shared dataset.

Answer

Add a random noise value to each numeric field in the dataset.

Answer

Hash the national ID numbers with a SHA-256 algorithm.

Answer

Apply format-preserving encryption to the direct identifiers.

Question 13

A privacy engineer is configuring an Apache Kafka cluster that ingests customer transaction events for downstream analytics. The events include personally identifiable information (PII). The engineer must ensure that PII is irreversibly transformed before it is written to the topic while allowing downstream consumers to still join events by a stable customer identifier. Which approach BEST satisfies this requirement?

Accepted Answer

Implement a Kafka Streams transformation that applies a keyed cryptographic hash with a per-tenant salt to the PII fields before producing to the topic.. The requirement is to irreversibly transform PII before it is written to the Kafka topic while preserving a stable join key. A keyed cryptographic hash with a per-tenant salt achieves both: the hash is one-way, and the salt keeps the identifier stable within a tenant while preventing cross-tenant correlation. In-stream transformation ensures raw PII never reaches the topic.

Answer

Enable TLS encryption on the Kafka broker listeners and configure the topic with a replication factor of three.

Answer

Apply column-level encryption using a shared symmetric key held by the analytics team and store the ciphertext in the Kafka message value.

Answer

Configure Kafka log compaction on the topic so that only the latest record for each customer key is retained.

Question 14

A privacy engineer is selecting a cloud service provider (CSP) for storing sensitive personal data. The organization requires that data be encrypted at rest and that the organization retain control over encryption keys. Which CSP feature best meets this requirement?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the organization to control the encryption keys used for data at rest while benefiting from the CSP's managed infrastructure. This meets the requirement for key control without the operational burden of full client-side encryption. Provider-managed keys do not offer sufficient control, and on-premises key storage may not integrate well with cloud services. HSM as a service is a component that can support CMEK but is not the specific feature itself.

Answer

Client-side encryption with keys stored on-premises

Answer

Provider-managed encryption keys

Answer

Hardware security module (HSM) as a service

Question 15

A financial services firm is implementing a new mobile banking app. The privacy engineer must ensure that data collected from the app is minimized and that users can easily withdraw consent. Which design pattern best supports these requirements?

Accepted Answer

Implement just-in-time consent prompts for each data collection purpose, and provide a simple toggle to withdraw consent.. Just-in-time consent prompts align with data minimization by collecting only what is needed for each purpose, and a simple toggle for withdrawal ensures user control. Blanket consent or complex withdrawal processes fail to meet privacy principles. Immediate anonymization without consent does not address consent requirements. Thus, the just-in-time approach is best.

Answer

Use a single consent at app installation for all current and future data uses, and require users to contact support to withdraw consent.

Answer

Collect data without consent but anonymize it immediately, and provide no consent withdrawal mechanism.

Answer

Collect all possible device and usage data upfront to avoid future app updates, and provide a complex consent withdrawal process.