CDPSE Privacy Risk Management And Compliance Practice Test 2 — 15 Questions

Question 1

Which document should a CDPSE review to understand the organization's legal basis for processing employee personal data?

Accepted Answer

The Record of Processing Activities (ROPA).. The Record of Processing Activities (ROPA) is a GDPR-mandated document that details all personal data processing activities, including purposes, legal bases, data categories, and recipients. Reviewing the ROPA provides a comprehensive view of the legal basis for processing employee data. Other documents like the employee handbook may mention privacy but do not systematically document legal bases.

Answer

The vendor management list.

Answer

The firewall configuration log.

Answer

The employee handbook.

Question 2

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Accepted Answer

Activate the incident response plan to assess the scope and notify affected individuals if required.. When a third-party vendor reports a data breach, the first step is to activate the incident response plan. This ensures a structured approach to assess the scope, contain the breach, and determine notification requirements. It is the immediate action that triggers all necessary procedures.

Answer

Review the vendor's insurance policy coverage.

Answer

Demand the vendor perform an independent audit of their systems.

Answer

Suspend all services provided by the vendor immediately.

Question 3

A company is preparing for a CCPA audit. Which internal process is most important to demonstrate compliance regarding the 'Right to Know'?

Accepted Answer

A fully updated data inventory map showing data lineage.. The CCPA 'Right to Know' requires a business to disclose the specific categories and pieces of personal information it has collected, the sources of that information, the purposes of collection, and the third parties with whom it is shared. A fully updated data inventory map with data lineage is the only artifact that can trace each data element from collection point through processing and onward sharing, which is exactly what is needed to answer a consumer's or auditor's Right to Know request. Without this map, the organization cannot reliably produce the required disclosures.

Answer

Marketing brochures describing the product features.

Answer

The latest penetration test report for the customer portal.

Answer

A list of all employees with database access.

Question 4

Which technique should be used to protect personal data during software testing?

Accepted Answer

Data masking or using synthetic data sets.. Data masking and synthetic data sets protect personal data during testing by ensuring testers work with realistic but non-identifiable or fabricated records. Masking replaces sensitive fields (names, SSNs, card numbers) with fictitious values while preserving format and referential integrity, and synthetic data is generated from scratch so no real individual is represented. This satisfies privacy principles like data minimization and purpose limitation because production PII is never exposed in lower-trust test environments.

Answer

Implementing strict multi-factor authentication for developers.

Answer

Full encryption of the test database.

Answer

Restricting the test environment access to only senior engineers.

Question 5

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

Accepted Answer

The lack of human intervention in automated decision-making processes.. The main privacy concern regarding the Right to Explanation in automated credit decisions is the lack of human intervention in automated decision-making processes. When a system makes credit decisions without meaningful human involvement, the data subject cannot obtain an explanation of the logic involved or contest the outcome, which undermines the right to explanation and the broader right not to be subject to solely automated decisions. This is the core tension that GDPR Article 22 and related transparency provisions address.

Answer

The system is too slow for real-time credit processing.

Answer

The cost of maintaining the automated system infrastructure.

Answer

The inability of the system to process non-numeric data types.

Question 6

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

Accepted Answer

Communicating the privacy policy update to the data subjects.. When a privacy policy is updated to reflect a new vendor, the most important follow-up action is to communicate the update to data subjects, because transparency obligations require that individuals are informed about how their personal data is processed and by whom. Adding a vendor typically means personal data will be shared with or processed by a new party, which materially changes the processing described in the notice, so data subjects must be informed before or at the time the change takes effect. This preserves the transparency principle central to privacy regulations such as GDPR Articles 13–14 and supports informed consent where applicable.

Answer

Archiving the previous version of the privacy policy for internal records.

Answer

Requesting a new SOC 2 report from the new vendor.

Answer

Updating the internal audit schedule to include the new vendor.

Question 7

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

Accepted Answer

It identifies privacy risks at each stage from collection to deletion.. Data Lifecycle Management (DLM) is significant in privacy risk assessments because it provides a structured framework to identify privacy risks at every stage of data handling — from collection, use, storage, sharing, to deletion. By mapping risks to each lifecycle phase, organizations can ensure controls are applied where they are most needed, such as consent at collection or secure deletion at end-of-life.

Answer

It reduces the power consumption of the storage systems.

Answer

It determines the software development methodology.

Answer

It ensures that the database is always updated with the latest patches.

Question 8

What does 'Privacy by Default' imply regarding system configuration?

Accepted Answer

The system is pre-configured with the strictest privacy settings.. Privacy by Default, a core principle of GDPR Article 25 and privacy-by-design frameworks, requires that systems ship with the most privacy-protective settings already enabled — the user must not have to take action to obtain privacy. Only the minimum necessary personal data should be collected, used, and shared unless the user affirmatively changes settings. Option B captures this 'strictest by default' posture, which is the regulatory expectation.

Answer

Systems are configured to be open until the user manually secures them.

Answer

Users are required to opt-in to all marketing emails.

Answer

Data is deleted after 30 days if not accessed by an administrator.

Question 9

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

Accepted Answer

The vendor lacks a documented process for handling data subject erasure requests.. A vendor lacking a documented process for handling data subject erasure requests is a major non-compliance risk because it directly violates GDPR/CCPA obligations to honor erasure rights. Without a documented process, the vendor cannot reliably fulfill DSRs, exposing the organization to regulatory penalties and reputational damage.

Answer

The vendor uses a different database encryption algorithm than the organization.

Answer

The vendor's privacy policy is not written in the user's native language.

Answer

The vendor only updates their privacy policy once every two years.

Question 10

What is the first step in creating a data inventory for a privacy program?

Accepted Answer

Identifying and locating the personal data held by the organization.. A data inventory must begin by identifying and locating the personal data the organisation actually holds — across databases, SaaS apps, endpoints, and paper records — because you cannot classify, map, or protect what you have not found. This discovery step produces the raw material for the record of processing activities (RoPA) and data flow maps. Retention schedules, DPO appointment, and policy drafting all depend on knowing what data exists.

Answer

Defining the organization's data retention schedule.

Answer

Appointing a Data Protection Officer.

Answer

Drafting a new privacy policy.

Question 11

A company is implementing a Bring Your Own Device (BYOD) policy. What is the primary privacy challenge?

Accepted Answer

Separating corporate data from personal data to maintain user privacy.. The primary privacy challenge in BYOD is separating corporate data from personal data to maintain user privacy. Organizations need to protect corporate information without intruding on employees' personal data, which requires technologies like containerization or mobile application management.

Answer

Ensuring the device battery lasts for the entire workday.

Answer

Ensuring that all devices use the same operating system version.

Answer

Managing the cellular data costs of employees.

Question 12

When evaluating a third-party's security, what should the CDPSE focus on to ensure effective privacy risk management?

Accepted Answer

The right to audit the vendor's privacy and security controls.. The right to audit is the contractual mechanism that gives the CDPSE ongoing assurance that a third party's privacy and security controls actually operate as claimed. Without audit rights, the organization cannot independently verify vendor compliance, making it impossible to manage privacy risk effectively across the vendor lifecycle. This is a foundational third-party risk management control emphasized in privacy and security frameworks.

Answer

The visual design of the vendor's public-facing website.

Answer

The vendor's number of employees.

Answer

The vendor's annual marketing expenditure.

Question 13

How can a CDPSE ensure that personal data is only kept for as long as necessary?

Accepted Answer

Implementing automated retention and disposal schedules in the data management system.. Ensuring data is kept only as long as necessary requires enforceable retention and disposal controls, which automated retention and disposal schedules in the data management system provide. Automation applies consistent rules across systems, triggers deletion or anonymization at defined intervals, and produces auditable evidence of compliance. This directly implements storage limitation and data minimization principles.

Answer

Requiring employees to delete their own emails after one year.

Answer

Manually reviewing every file in the database each month.

Answer

Conducting annual security training for all staff.

Question 14

A company is considering the use of a data broker. Which privacy risk is most significant?

Accepted Answer

The lack of visibility into the data broker's consent collection methods.. The most significant privacy risk when using a data broker is the lack of visibility into the broker's consent collection methods. Data brokers often aggregate personal data from various sources without direct interaction with the individuals, making it difficult to ensure that valid consent was obtained for the specific purposes of the broker's activities. This opacity can lead to unlawful processing and privacy violations.

Answer

The broker's physical office location.

Answer

The technical compatibility of the data format.

Answer

The cost of purchasing the data.

Question 15

During an audit, it is found that an application logs user session tokens including sensitive user IDs. What is the correct privacy recommendation?

Accepted Answer

Mask or redact the sensitive user IDs from the application logs.. The correct privacy recommendation is to mask or redact sensitive user IDs from application logs. Logs are often accessed by a wide range of personnel and may be stored in less secure environments; masking ensures that personal data is not exposed unnecessarily, aligning with data minimization and storage limitation principles. This directly addresses the privacy risk of logging sensitive information.

Answer

Restrict access to logs to only the security team.

Answer

Encrypt the log files to protect the sensitive information.

Answer

Increase the frequency of log rotation.