20+ practice questions focused on Privacy Engineering — one of the most tested topics on the ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Privacy Engineering PracticeA privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?
Explanation: Option B is correct because sensitivity bounds (clamping each record's contribution to a defined range, e.g., via bounded-sum or bounded-mean aggregations) directly limit how much any single individual can influence the output, which is a prerequisite for a valid differential privacy guarantee. Option D is correct because epsilon is the privacy-loss budget: a smaller epsilon means the output distributions for neighboring datasets are closer, so less information about any individual leaks, yielding stronger privacy (at the cost of utility). Option E is correct because the (epsilon, delta)-differential privacy formulation uses delta to bound the probability that the epsilon guarantee fails, providing the probabilistic relaxation needed for mechanisms such as the Gaussian mechanism and for composing many queries. Option A is wrong because a publicly known random seed does not weaken privacy—seeds are not secret keys in differential privacy, and the guarantee holds regardless of seed knowledge. Option C is wrong because dataset size cannot be made infinite and is not a configuration step; while larger datasets improve utility for a fixed epsilon, they are not required to minimize re-identification risk.
In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?
Explanation: AWS Glue DataBrew is a visual data preparation service with built-in PII detection and masking transforms, making it the natural fit for identifying and redacting sensitive columns during ETL. It provides pre-built recipes that can detect PII categories (names, SSNs, credit cards) and apply masking, substitution, or hashing transformations directly in the data preparation workflow. This aligns with the requirement to automatically identify and redact sensitive columns during ETL jobs.
A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?
Explanation: SSE-KMS with Customer Managed Keys (CMKs) gives the organization full control over the key lifecycle — creation, rotation, disabling, and deletion — while AWS KMS performs the actual encryption and decryption. This satisfies privacy-by-design requirements for encryption at rest with customer-managed keys because the customer governs access via key policies and IAM, and can audit every key use through CloudTrail. It is the only option that combines AWS-managed encryption infrastructure with customer-controlled keys.
When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?
Explanation: GDPR Article 15 grants data subjects the right to access their personal data and receive a copy of it in a commonly used, machine-readable format. An automated data portability export directly fulfills this by allowing users to download their data, which also supports Article 20 (Right to Data Portability). This feature ensures transparency and control, aligning with the Privacy Dashboard's purpose of empowering users.
In a database, you need to replace social security numbers with a consistent, non-reversible value for analytics. What is the best approach?
Explanation: Salted one-way hashing produces a consistent, non-reversible value for each SSN, so the same SSN always yields the same hash (enabling joins and analytics) while the original cannot be recovered. A per-record or per-dataset salt prevents rainbow-table and frequency-analysis attacks, making it the best fit for analytics on SSNs where reversibility is not required.
+15 more Privacy Engineering questions available
Practice all Privacy Engineering questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Privacy Engineering. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Privacy Engineering questions on the CDPSE frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Privacy Engineering is tested as part of the ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) blueprint. Practicing with targeted Privacy Engineering questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CDPSE practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Privacy Engineering is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Privacy Engineering practice session with instant scoring and detailed explanations.
Start Privacy Engineering Practice →