CDPSE Privacy Engineering — Timed 25 Questions

Question 1

A privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?

25 minute time limit — choose an answer to begin.

Accepted Answer

Defining appropriate sensitivity bounds for the input data. Option B is correct because sensitivity bounds (clamping each record's contribution to a defined range, e.g., via bounded-sum or bounded-mean aggregations) directly limit how much any single individual can influence the output, which is a prerequisite for a valid differential privacy guarantee. Option D is correct because epsilon is the privacy-loss budget: a smaller epsilon means the output distributions for neighboring datasets are closer, so less information about any individual leaks, yielding stronger privacy (at the cost of utility). Option E is correct because the (epsilon, delta)-differential privacy formulation uses delta to bound the probability that the epsilon guarantee fails, providing the probabilistic relaxation needed for mechanisms such as the Gaussian mechanism and for composing many queries. Option A is wrong because a publicly known random seed does not weaken privacy—seeds are not secret keys in differential privacy, and the guarantee holds regardless of seed knowledge. Option C is wrong because dataset size cannot be made infinite and is not a configuration step; while larger datasets improve utility for a fixed epsilon, they are not required to minimize re-identification risk.

Answer

Choosing a random seed that is publicly known

Answer

Increasing the dataset size to infinite

Question 2

In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?

Accepted Answer

Glue DataBrew. AWS Glue DataBrew is a visual data preparation service with built-in PII detection and masking transforms, making it the natural fit for identifying and redacting sensitive columns during ETL. It provides pre-built recipes that can detect PII categories (names, SSNs, credit cards) and apply masking, substitution, or hashing transformations directly in the data preparation workflow. This aligns with the requirement to automatically identify and redact sensitive columns during ETL jobs.

Answer

AWS Glue Schema Registry

Answer

AWS Lake Formation

Answer

Amazon Macie

Question 3

A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?

Accepted Answer

Enable AWS KMS with Customer Managed Keys (SSE-KMS). SSE-KMS with Customer Managed Keys (CMKs) gives the organization full control over the key lifecycle — creation, rotation, disabling, and deletion — while AWS KMS performs the actual encryption and decryption. This satisfies privacy-by-design requirements for encryption at rest with customer-managed keys because the customer governs access via key policies and IAM, and can audit every key use through CloudTrail. It is the only option that combines AWS-managed encryption infrastructure with customer-controlled keys.

Answer

Enable S3 Managed Keys (SSE-S3)

Answer

Enable S3 Object Lock

Answer

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 4

When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?

Accepted Answer

Automated data portability export. GDPR Article 15 grants data subjects the right to access their personal data and receive a copy of it in a commonly used, machine-readable format. An automated data portability export directly fulfills this by allowing users to download their data, which also supports Article 20 (Right to Data Portability). This feature ensures transparency and control, aligning with the Privacy Dashboard's purpose of empowering users.

Answer

Account deletion button

Answer

Consent management toggle

Answer

Marketing preference settings

Question 5

In a database, you need to replace social security numbers with a consistent, non-reversible value for analytics. What is the best approach?

Accepted Answer

Salted one-way hashing. Salted one-way hashing produces a consistent, non-reversible value for each SSN, so the same SSN always yields the same hash (enabling joins and analytics) while the original cannot be recovered. A per-record or per-dataset salt prevents rainbow-table and frequency-analysis attacks, making it the best fit for analytics on SSNs where reversibility is not required.

Answer

Deterministic encryption

Answer

Format-preserving encryption

Answer

Randomized tokenization

Question 6

When designing a data retention policy, which technical configuration in S3 best automates the process?

Accepted Answer

S3 Lifecycle policy. S3 Lifecycle policies are the native S3 mechanism for automating object transitions and expiration based on age or date, directly enforcing a data retention schedule without custom code. They can transition objects to cheaper storage classes (e.g., Standard-IA, Glacier) and ultimately expire (delete) them after a defined period, satisfying retention and disposal requirements. This makes them the correct technical control for automating retention policy enforcement in S3.

Answer

S3 Replication

Answer

S3 Inventory

Answer

S3 Object Lock

Question 7

When designing a system with k-anonymity, which metric measures the impact of generalization on the utility of the data?

Accepted Answer

Discernibility penalty. The discernibility penalty is the metric used in k-anonymity to quantify the utility loss caused by generalization and suppression. It measures how distinguishable individual records become after anonymization, with higher values indicating greater information loss. This metric directly reflects the trade-off between privacy protection and data utility.

Answer

Epsilon value

Answer

Entropy loss

Answer

F-score

Question 8

When encrypting data for long-term storage, which configuration is most important for privacy?

Accepted Answer

Frequent key rotation. Frequent key rotation limits the blast radius if a key is compromised, because ciphertext encrypted under retired keys becomes inaccessible once those keys are destroyed, and it satisfies regulatory expectations (NIST SP 800-57, PCI DSS Req. 3.6) for cryptoperiod management. For long-term storage, rotation combined with proper key destruction supports both confidentiality and crypto-shredding for erasure. It is the single most impactful configuration for sustained privacy protection.

Answer

Disabling logging

Answer

Hardcoding the key

Answer

Using a single global key

Question 9

Which of the following is an effective way to implement 'Right to Erasure' in a distributed database system?

Accepted Answer

Asynchronous deletion across nodes. Asynchronous deletion across nodes allows the erasure request to propagate to all replicas without blocking the primary write path, ensuring eventual consistency of deletion while maintaining availability in a distributed system. This approach is standard for implementing GDPR Article 17 in sharded or replicated databases, where synchronous deletion across all nodes would create latency and availability problems. It must be paired with verification that all replicas and backups are purged within the regulatory timeframe.

Answer

Deleting the entire database

Answer

Marking records as deleted

Answer

Overwriting with new user data

Question 10

You are auditing a system for 'Data Minimization'. Which discovery finding would be a primary concern?

Accepted Answer

Holding data beyond the retention period. Data minimization under GDPR Article 5(1)(c) requires that personal data be adequate, relevant, and limited to what is necessary for the stated purpose. Holding data beyond the retention period violates the storage limitation principle (Article 5(1)(e)) and is a direct indicator that minimization controls are failing. An auditor would flag this as a primary concern because it shows data is being kept without a lawful purpose.

Answer

Using AES-256 for encryption

Answer

Using a pseudonym for database keys

Answer

Encrypting backups

Question 11

Which TWO techniques should be used to protect PII in non-production environments to ensure the data remains non-identifiable?

Accepted Answer

Pseudonymization. Pseudonymization (A) is correct because it replaces direct identifiers with artificial identifiers or tokens, so PII in non-production environments cannot be linked to a specific individual without separately held mapping data. Anonymization (E) is correct because it irreversibly removes or alters identifying details so the data can no longer be attributed to an identifiable person, which is the strongest way to keep non-production data non-identifiable. Full database mirroring (B) is not appropriate because it copies production PII intact into non-production, increasing exposure rather than protecting it. Public internet exposure (C) is clearly wrong because it makes PII more accessible to unauthorized parties. Plaintext replication (D) is also wrong because it moves readable PII without masking, tokenizing, or removing identifiers.

Answer

Full database mirroring

Answer

Public internet exposure

Answer

Plaintext replication

Question 12

You are configuring AWS Macie to identify PII in an S3 bucket. Which setting must be enabled to ensure that specific sensitive data patterns are detected across all files regardless of their object tags?

Accepted Answer

Custom data identifiers. Custom data identifiers in Amazon Macie let you define regex and keyword-based patterns (for example, a proprietary employee ID format or region-specific national ID) that Macie will scan for across objects, independent of object tags or classifications. Because the question requires detecting specific sensitive patterns regardless of tags, custom data identifiers are the correct mechanism. Managed identifiers cover common PII types but not organization-specific formats.

Answer

IAM Role trust policy

Answer

S3 Bucket Policy modification

Answer

S3 Object Lock

Question 13

A privacy engineer is designing a data anonymization pipeline for a healthcare dataset. The dataset contains patient identifiers, demographics, and medical diagnoses. The goal is to release the data for research while preventing re-identification. Which technique should the engineer implement to protect against linkage attacks while preserving data utility for statistical analysis?

Accepted Answer

k-anonymity by generalizing and suppressing quasi-identifiers to ensure each record is indistinguishable from at least k-1 others.. k-anonymity is the appropriate technique because it specifically mitigates linkage attacks by ensuring that each record is indistinguishable from at least k-1 others based on quasi-identifiers. This preserves the statistical properties needed for research while reducing re-identification risk. Other methods either fail to address linkage or destroy data utility.

Answer

Pseudonymization by replacing patient identifiers with randomly generated tokens.

Answer

Homomorphic encryption to allow computations on encrypted data without decryption.

Answer

Data masking by replacing all values with random characters, including medical diagnoses.

Question 14

A privacy engineer is configuring a web application to comply with the principle of data minimization. The application collects user data for a newsletter subscription. Which design change best implements data minimization?

Accepted Answer

Collect only the user's email address and store it in a dedicated database with strict access controls.. Data minimization requires collecting only personal data that is adequate, relevant, and limited to what is necessary for the specified purpose. For a newsletter subscription, the email address is the only necessary data. Collecting additional information or retaining it indefinitely fails to meet this principle.

Answer

Collect the user's email address and IP address to detect fraudulent subscriptions.

Answer

Collect the user's email address, full name, and phone number to personalize future communications.

Answer

Collect the user's email address and retain it indefinitely to ensure future communications.

Question 15

A privacy engineer is evaluating a cloud-based customer analytics platform that processes personal data across multiple regions. The platform uses a shared responsibility model. Which two actions should the engineer take to ensure privacy compliance in the cloud environment? (Choose two.)

Accepted Answer

Verify that the cloud provider's data processing agreement (DPA) includes standard contractual clauses (SCCs) for cross-border data transfers.. The engineer should verify that the DPA includes SCCs for lawful cross-border transfers and implement CMEK to maintain control over data at rest. These actions directly address privacy compliance in a shared responsibility cloud model, ensuring legal transfer mechanisms and enhanced data protection.

Answer

Store all personal data in a single region to avoid cross-border transfer issues.

Answer

Conduct regular privacy impact assessments (PIAs) on the cloud provider's infrastructure.

Answer

Rely on the cloud provider's default encryption settings for data in transit and at rest.

Question 16

A privacy engineer is configuring a database that stores customer personal data. The engineer must ensure that data is protected in the event of a physical disk theft. Which control is most appropriate?

Accepted Answer

Enable transparent data encryption (TDE) on the database.. Transparent data encryption (TDE) is the most appropriate control because it encrypts the entire database at rest, including data files and backups, protecting against physical disk theft. Other options like column-level encryption, auditing, or self-encrypting drives either do not fully protect the database files or are less integrated with database operations.

Answer

Configure database auditing to log all access to personal data.

Answer

Store the database on a self-encrypting drive (SED) and manage keys in a hardware security module (HSM).

Answer

Implement column-level encryption for all columns containing personal data.

Question 17

A privacy engineer is designing a system to support the GDPR right to data portability. The system must allow users to export their data in a structured, commonly used, and machine-readable format. Which two technical requirements must be met to ensure the export is both interoperable and secure? (Choose two.)

Accepted Answer

The export must be encrypted in transit and at rest, and accessible only to the authenticated user.. Data portability requires that the export include all personal data provided by the user and data generated by their activity, ensuring completeness. Additionally, the export must be secured via encryption and authentication to prevent unauthorized access. Proprietary formats, public URLs, and PDFs fail to meet interoperability or security requirements. Thus, the two correct requirements are content completeness and secure delivery.

Answer

The export format must use a proprietary binary encoding to minimize size.

Answer

The export format must be a human-readable PDF to ensure users can review it.

Answer

The export must be delivered via an unauthenticated public URL for convenience.

Question 18

A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?

Accepted Answer

SQL Dynamic Data Masking policies. Dynamic data masking (DDM) on SQL targets is a database-engine feature configured via SQL DDM policies, which mask column values at query time for non-privileged users without altering stored data. In Azure, this is enabled on Azure SQL Database, Azure SQL Managed Instance, and SQL Server via T-SQL (CREATE MASKED COLUMN) or the Azure portal's Dynamic Data Masking blade. Azure Data Factory itself does not apply DDM; it relies on the target SQL engine's masking policy.

Answer

Azure Policy definition

Answer

Data Factory Mapping Data Flows

Answer

Azure Key Vault access policies

Question 19

A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?

Accepted Answer

Cloud DLP de-identification template. Cloud DLP de-identification templates define the specific transformation rules (e.g., masking, tokenization, redaction) applied to sensitive data like PII. Integrating a de-identification template with Cloud Storage allows automatic redaction of PII before external users access the files, satisfying the requirement for automated, policy-driven data minimization. This is the native Google Cloud mechanism for content-level redaction, not access control or lifecycle management.

Answer

IAM conditions

Answer

Storage Transfer Service

Answer

Bucket lock

Question 20

In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is the Google Cloud service designed to discover, classify, and redact sensitive data like PII. Integrating the DLP API with Cloud Storage allows automatic scanning and redaction of uploaded documents based on configured infoType detectors and de-identification templates. This is the native, scalable solution for content-level redaction.

Answer

Cloud Storage buckets lifecycle policy

Answer

Cloud Identity and Access Management

Answer

Cloud Logging