CDPSE Privacy Risk Management And Compliance Practice Test 3 — 15 Questions

Question 1

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

Accepted Answer

An assessment of the necessity and proportionality of the processing.. Option B is correct because a DPIA must include an assessment of the necessity and proportionality of the processing operations in relation to their purpose, as required by GDPR Article 35(7)(b). Option C is correct because Article 35(7)(c) mandates an assessment of the risks to the rights and freedoms of data subjects arising from the processing. Option E is correct because Article 35(7)(a) requires a systematic description of the envisaged processing operations and the purposes of the processing. Option A is not part of a DPIA, as developer salaries are irrelevant to privacy risk analysis and would themselves constitute unnecessary personal data. Option D is not required, since a business continuity plan addresses operational resilience rather than the privacy-specific necessity, proportionality, and risk assessments a DPIA demands.

Answer

A detailed list of the developer team's salaries.

Answer

A copy of the organization's business continuity plan.

Question 2

A CDPSE is advising on a website redesign. What is the most important privacy-related feature for a contact form?

Accepted Answer

Including a link to the privacy policy near the submission button.. Under GDPR and similar privacy laws, transparency is a core principle: data subjects must be informed about how their personal data will be processed at the point of collection. Placing a link to the privacy policy near the submission button ensures the notice is easily accessible before the user submits their information, satisfying the requirement for informed consent or lawful processing. This is the most critical privacy feature because it directly supports the data subject's right to be informed.

Answer

Integrating the form with a social media account.

Answer

Adding a 'Submit' button with a vibrant color.

Answer

Allowing users to upload large file attachments.

Question 3

Which TWO actions should a CDPSE prioritize when assessing a vendor for privacy compliance?

Accepted Answer

Ensure the vendor contract includes specific privacy and data protection clauses.. Option B is correct because a CDPSE must ensure the vendor contract contains specific privacy and data protection clauses, such as data processing terms, breach notification obligations, data subject rights support, and restrictions on secondary use, which establish enforceable accountability and compliance requirements. Option E is correct because reviewing the vendor's most recent third-party audit reports, such as SOC 2, provides independent assurance over the design and operating effectiveness of the vendor's security and privacy controls, which is essential for assessing privacy compliance risk. Option A is not relevant because office interior quality has no bearing on privacy compliance or data protection controls. Option C is not a reliable or sufficient assessment method, since social media complaints are anecdotal and do not verify privacy compliance. Option D is inappropriate because requesting a vendor's full customer list is unnecessary for privacy assessment and could itself create privacy and confidentiality risks.

Answer

Check if the vendor has a high-quality office interior.

Answer

Verify the vendor's social media presence to check for public complaints.

Answer

Request the vendor's list of all their customers.

Question 4

Which THREE documents are typically required for compliance with global privacy regulations?

Accepted Answer

Data Processing Agreements (DPAs) with third-party vendors.. Option A is correct because Data Processing Agreements (DPAs) are contractually required under regulations such as GDPR Article 28 whenever a controller engages a third-party processor, ensuring the vendor handles personal data lawfully and with appropriate safeguards. Option D is correct because a public-facing privacy notice satisfies transparency obligations under GDPR Articles 13-14 and similar laws (e.g., CCPA/CPRA), informing data subjects about what data is collected, why, and their rights. Option E is correct because a Record of Processing Activities (ROPA) is mandated by GDPR Article 30, documenting purposes, categories of data, recipients, and retention periods to demonstrate accountability. Option B does not belong because a daily log of all staff internet activity is a monitoring practice, not a privacy compliance document, and could itself raise privacy concerns. Option C does not belong because an inventory of company-issued laptops is an asset-management record, not a document required by global privacy regulations.

Answer

A daily log of all staff internet activity.

Answer

A list of all company-issued laptops.

Question 5

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

Accepted Answer

Setting default retention periods to automatically delete data that is no longer needed.. Data minimization is a core privacy principle requiring that only data strictly necessary for a defined purpose be collected and that it not be kept longer than needed. Option B is correct because setting default retention periods that automatically delete data no longer needed enforces storage limitation, ensuring data is purged once its purpose expires rather than retained indefinitely. Option C is correct because limiting collection to only what is strictly necessary for the stated purpose directly implements the collection-side of data minimization, reducing the volume and scope of personal data processed. Option A is incorrect because collecting all possible data points is the opposite of minimization, expanding data collection beyond necessity. Option D is incorrect because increasing database storage capacity addresses infrastructure, not the amount or lifespan of personal data collected. Option E is incorrect because publicly exposing personal data on the intranet grossly violates confidentiality and minimization principles.

Answer

Collecting all possible user data points to prepare for future analysis.

Answer

Increasing the storage capacity of the database server.

Answer

Making all personal data publicly available on the company intranet.

Question 6

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Accepted Answer

The existence of an adequacy decision by the European Commission for the destination country.. Option A is correct because under GDPR Chapter V, a transfer of personal data to a third country is lawful without further authorization when the European Commission has issued an adequacy decision under Article 45 recognizing that the destination country ensures an adequate level of data protection. Option C is correct because, in the absence of an adequacy decision, Article 46 permits the transfer if the controller or processor provides appropriate safeguards, such as Standard Contractual Clauses (SCCs) adopted by the Commission, binding corporate rules, or an approved certification mechanism. Option B is incorrect because merely having a local office in the destination country does not itself establish a lawful transfer mechanism under GDPR. Option D is incorrect because network speed is an operational performance consideration, not a legal basis for cross-border data transfer. Option E is incorrect because the CIO's personal preference regarding cloud providers is irrelevant to the GDPR legal analysis of whether a transfer is lawful.

Answer

The availability of a local office in the destination country.

Answer

The speed of the network connection between the two countries.

Answer

The preference of the chief information officer regarding cloud providers.

Question 7

Which THREE steps are vital when responding to a Data Subject Access Request (DSAR)?

Accepted Answer

Provide the requested data in a secure and usable format to the data subject.. Option C is correct because a DSAR response must deliver the requested personal data to the data subject in a secure, commonly usable format (e.g., CSV, PDF), ensuring confidentiality and portability. Option D is correct because the organization must locate and retrieve all relevant personal data across its systems, including databases, email, backups, and third-party processors, to fulfill the access request completely. Option E is correct because verifying the requester's identity is essential to prevent unauthorized disclosure of personal data to an impostor. Option A is not appropriate because publicly announcing the requester's identity would itself be a privacy breach and is not required by DSAR procedures. Option B is incorrect because deleting all data immediately is not a valid DSAR response and could destroy evidence or violate retention obligations.

Answer

Publicly announce the identity of the person requesting the data.

Answer

Delete all data immediately after the request is received.

Question 8

Which TWO actions should a CDPSE take to demonstrate 'Privacy by Design' in a software project?

Accepted Answer

Include privacy requirements in the project specification and user stories.. Option C is correct because embedding privacy requirements directly into the project specification and user stories operationalizes Privacy by Design at the earliest stage, ensuring privacy is a functional requirement rather than an afterthought. Option E is correct because conducting regular privacy testing throughout the development lifecycle verifies that privacy controls work as intended before release, which aligns with the proactive, preventive nature of Privacy by Design. Option A is wrong because sharing one password across all database administrative users destroys accountability and violates access-control and authentication principles. Option B is wrong because reviewing privacy only after deployment is reactive, not the proactive 'by design' approach. Option D is wrong because hiding privacy settings from users undermines transparency and user control, which are core Privacy by Design principles.

Answer

Use the same password for all database administrative users.

Answer

Only conduct a privacy review after the application has been deployed.

Answer

Hide all privacy settings from the user to prevent tampering.

Question 9

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

Accepted Answer

Information regarding health or medical records.. Option C is correct because information regarding health or medical records is explicitly listed as a special category of personal data under privacy regulations such as GDPR Article 9, since its misuse can cause significant harm or discrimination. Option D is correct because biometric data used for the purpose of uniquely identifying a natural person is expressly classified as special category data under GDPR Article 9(1), given its sensitive and immutable nature. Option E is correct because data concerning a person's political opinions is one of the enumerated special categories in GDPR Article 9(1), alongside other protected characteristics like religious beliefs and trade union membership. Option A does not belong because publicly available business contact email addresses are ordinary personal data, and even the public-availability exemption does not elevate them to special category status. Option B does not belong because the browser version used by a visitor is technical or device data, which is ordinary personal data at most and carries no sensitive classification under privacy regulations.

Answer

Publicly available business contact email addresses.

Answer

The browser version used by the visitor.

Question 10

Which TWO security measures are most effective in protecting against unauthorized access to PII?

Accepted Answer

Requiring multi-factor authentication (MFA) for access to databases containing PII.. Option A is correct because requiring multi-factor authentication (MFA) for access to databases containing PII adds a second verification factor (something you know plus something you have or are), which directly prevents unauthorized access even if a password is compromised through phishing or reuse. Option B is correct because encrypting personal data both in transit (e.g., TLS 1.2/1.3) and at rest (e.g., AES-256) ensures that intercepted network traffic or stolen storage media remain unreadable without the keys, protecting PII confidentiality. Option C is not a security measure at all—removing passwords eliminates authentication and makes unauthorized access trivial. Option D provides only weak physical obscurity and does nothing against remote or insider logical access to PII. Option E, adding help desk staff, has no direct technical effect on preventing unauthorized access to PII.

Answer

Removing all passwords from the system to simplify access.

Answer

Hiding the database server in a locked physical room.

Answer

Increasing the number of help desk staff.

Question 11

Which THREE items should be included in a Privacy Policy that aligns with global transparency requirements?

Accepted Answer

The purpose and legal basis for the processing of personal data.. Option A is correct because global transparency requirements such as GDPR Articles 13-14 mandate that a privacy policy disclose the purposes of processing and the legal basis (e.g., consent, contract, legitimate interest) for each processing activity. Option B is correct because these same provisions require informing data subjects of the retention period or, if that is not possible, the criteria used to determine how long personal data will be stored. Option D is correct because transparency obligations require informing data subjects of their rights, including the right of access (GDPR Article 15) and the right to erasure (Article 17), along with how to exercise them. Option C is not relevant because quarterly financial earnings are corporate financial disclosures, not personal data processing information, and belong in investor relations reports. Option E is not relevant and would be a serious security violation, since internal administrator passwords are confidential credentials that must never be published in a privacy policy or any public document.

Answer

The company's quarterly financial earnings report.

Answer

The internal passwords of the IT administrators.

Question 12

Your organization is preparing for a CCPA/CPRA audit. You are asked to verify the 'Right to Opt-Out of Sale or Sharing' implementation. Which technical requirement must be validated to ensure compliance with the Global Privacy Control (GPC) signal?

Accepted Answer

The server must programmatically honor the GPC signal as a valid opt-out request without requiring user interaction.. Under CCPA/CPRA, the Global Privacy Control signal is a legally recognized opt-out mechanism, and the server must treat it as a valid, binding opt-out request without requiring the user to click a banner or authenticate. Compliance requires programmatic detection of the GPC header/signal and automatic suppression of the sale or sharing of personal information for that user. This is the technical requirement auditors validate when testing the Right to Opt-Out of Sale or Sharing.

Answer

The system must log the user's IP address to verify their residency status before honoring the signal.

Answer

The website must automatically trigger a manual consent banner upon detecting the signal.

Answer

The user must be authenticated via OAuth2 to confirm their identity before the signal is processed.

Question 13

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

Accepted Answer

Categorize the vendor based on the sensitivity and volume of PII they will process.. The first step in any third-party privacy risk management lifecycle is to understand what you are exposing: classify the vendor based on the sensitivity and volume of PII they will process. This tiering determines the depth of due diligence, the contractual terms required, and the ongoing monitoring cadence. Without this categorization, you cannot right-size the DPA, the SOC 2 review, or any technical testing.

Answer

Draft a Data Processing Agreement (DPA).

Answer

Request the vendor's SOC 2 Type II report.

Answer

Conduct a penetration test on the vendor's API endpoints.

Question 14

During a Data Mapping exercise, the CDPSE discovers that a legacy database stores PII in cleartext. The system is scheduled for decommissioning in 18 months. What is the most appropriate privacy risk mitigation strategy?

Accepted Answer

Apply field-level encryption or database transparent data encryption (TDE) as a compensating control.. Applying field-level encryption or transparent data encryption (TDE) is the most appropriate mitigation because it reduces the risk of cleartext PII exposure while the legacy system continues to operate for its remaining 18 months. It is a compensating control that addresses the specific risk (unauthorized disclosure of PII at rest) without disrupting business operations or forcing premature decommissioning. This aligns with the privacy principle of applying appropriate technical safeguards proportionate to the risk and the system's remaining lifecycle.

Answer

Accept the risk formally and do nothing until the system is shut down.

Answer

Anonymize all records in the database immediately.

Answer

Decommission the database immediately regardless of business impact.

Question 15

An organization is implementing a 'Privacy by Design' framework for a machine learning model used to predict customer churn. Which technique should be utilized to minimize privacy risk while maintaining model utility?

Accepted Answer

Differential privacy.. Differential privacy adds calibrated statistical noise to data or model outputs so that any individual's contribution cannot be inferred, while aggregate patterns — and therefore model utility — are preserved. It is a core Privacy by Design technique for ML because it provides a mathematical privacy guarantee (epsilon) rather than relying on policy alone. This directly balances privacy risk against churn-prediction accuracy.

Answer

Full deletion of all customer datasets.

Answer

Obfuscation of the model's source code.

Answer

Conversion of all data to unstructured formats.