ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) (CDPSE) — Questions 1–75

A multinational company intends to implement a Global Privacy Policy. What is the greatest challenge to its effective governance?

Which TWO actions should be taken when decommissioning an old server containing PII?

A multinational company is transferring data between its US and EU subsidiaries. Which mechanism is most effective for ensuring cross-border data transfer compliance after the invalidation of previous frameworks?

An organization's privacy policy is updated to reflect a new vendor. What is the most important follow-up action?

In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?

What is the first step in conducting a privacy audit?

Which TWO technical controls are effective for limiting the scope of PII access in a cloud-based SQL environment?

You are configuring an API gateway to implement 'Data Minimization' via response filtering. How is this typically achieved for JSON payloads?

When evaluating a third-party vendor's privacy maturity, which document is most critical for the privacy practitioner to review during the due diligence process?

When implementing Privacy by Design (PbD) in a new mobile application, which TWO of the following are considered proactive technical controls?

Which THREE tasks are associated with 'Data Classification' during the life cycle?

Which TWO metrics are used to measure the effectiveness of data minimization?

When designing a data retention policy, which technical configuration in S3 best automates the process?

When mapping data flows to identify privacy risks, a practitioner discovers that personal data is being transferred to a non-affiliated third party. What is the immediate requirement?

What is the primary function of a 'Data Protection Impact Assessment' (DPIA) from an engineering perspective?

Which TWO of the following should be considered when aligning privacy strategy with broader business objectives?

A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?

Which TWO actions should a CDPSE take to demonstrate 'Privacy by Design' in a software project?

An organization wants to monitor data access patterns for potential privacy violations. Which tool is best for detecting unusual access to PII tables?

In Google Cloud Data Loss Prevention (DLP), which transformation method should be applied to a column containing email addresses to maintain format while ensuring privacy?

When conducting a privacy risk assessment, what is the significance of 'Data Lifecycle Management'?

An organization is updating its privacy governance framework to comply with GDPR. The Data Protection Officer (DPO) needs to ensure that the accountability principle is met. Which of the following actions best demonstrates accountability?

During a DPIA (Data Protection Impact Assessment), a CDPSE identifies a high risk to data subjects due to the use of AI-driven profiling. What is the appropriate next step?

Why is it important to have a defined data retention policy as part of privacy governance?

When encrypting data for long-term storage, which configuration is most important for privacy?

A privacy engineer is implementing differential privacy in a data analytics pipeline. To ensure the privacy budget remains intact over multiple queries, which technique should be applied?

A privacy engineer is implementing 'Tokenization' for credit card processing. Where should the 'vault' be situated to ensure the highest level of privacy?

When conducting a Privacy Impact Assessment (PIA) for a new application, what is the role of 'Data Mapping'?

When classifying data for privacy, what does a 'Restricted' label usually signify?

When establishing a data disposal policy in Informatica Enterprise Data Catalog, what must be configured to ensure the disposal process is auditable?

Which TWO methods are commonly used to achieve data minimization in a legacy database?

Which THREE factors are critical for balancing privacy and utility when using k-anonymity?

Which governance mechanism is best suited for managing privacy risks in an agile development environment?

A company needs to share customer demographics with a third party. Which technique allows for statistical analysis without revealing individual identities?

A practitioner is setting up data minimization. Which feature in Google Cloud Spanner helps ensure that data is stored in specific regions for local compliance?

Which component in an API gateway is used to ensure PII is not sent to third-party endpoints?

What is the primary function of a 'Data Inventory' in a privacy program?

Which document should a CDPSE practitioner review first when establishing a new privacy governance program?

Which TWO outcomes result from effective data classification?

Which THREE factors should be considered when defining a data retention schedule?

Which of the following is the most effective method for evaluating the maturity of a privacy governance program?

What is the primary function of a privacy policy for external users?

In the context of data classification, which metadata field is most critical for determining the disposal date?

When configuring AWS Macie to perform data minimization, which configuration is required to prevent the service from scanning internal metadata fields that do not contain customer PII?

You are auditing a system for 'Data Minimization'. Which discovery finding would be a primary concern?

A privacy analyst is conducting a data map in ServiceNow. Which feature allows them to link a database table directly to a 'Processing Activity' record?

When establishing a privacy steering committee, who should be included to ensure organizational support?

A CDPSE practitioner is integrating privacy controls into the SDLC. Which action best ensures privacy by design during the requirements gathering phase?

Which feature in Microsoft Purview Information Protection should be used to automatically identify and classify documents containing credit card numbers as they are created?

Which role is primarily responsible for the overall oversight of privacy governance within an organization to ensure that privacy policies are being followed?

Which THREE factors influence the maturity level of an organization's privacy governance?

A privacy engineer is auditing log data. Which action best aligns with data minimization requirements for logs?

Which THREE items should be included in a Privacy Impact Assessment (PIA) report?

What is the main purpose of a Privacy Impact Assessment (PIA) in the governance framework?

When a third-party vendor reports a data breach, what is the first step the CDPSE should take?

Which THREE documents are typically required for compliance with global privacy regulations?

A privacy engineer is configuring Azure SQL Database to ensure that sensitive columns containing PII are hidden from non-privileged users. Which feature should be implemented to achieve dynamic data masking?

Which TWO actions help improve privacy in a containerized environment (e.g., Kubernetes)?

When using Varonis to identify 'stale' data for minimization, what criteria must be defined to avoid false positives?

Which of the following is an example of a Privacy-Enhancing Technology (PET) that focuses on data minimization?

Which of the following activities is essential for maintaining effective privacy governance over third-party processors?

In the context of Privacy by Design, what is the primary role of an 'Access Control Matrix' in a microservices architecture?

Which THREE of the following are considered standard 'Privacy-Enhancing Technologies' (PETs) used for data protection in analytics?

Which TWO of the following should be considered when aligning privacy strategy with the business?

When designing a privacy-preserving data pipeline, which TWO strategies help achieve 'Data Minimization'?

During a Data Mapping exercise, the CDPSE discovers that a legacy database stores PII in cleartext. The system is scheduled for decommissioning in 18 months. What is the most appropriate privacy risk mitigation strategy?

An organization is evaluating a cloud service provider (CSP) for storing sensitive customer data. Under the GDPR, what is the most critical step the CDPSE must perform to manage third-party privacy risk?

A privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?

Which of the following is a key objective of a data retention policy?

When implementing differential privacy in a data analytics pipeline, what is the primary technical trade-off the engineer must balance?

Which TWO security measures are most effective in protecting against unauthorized access to PII?

In the privacy lifecycle, what does the term 'Data Collection' primarily involve?

Which TWO of the following are key privacy controls in an AWS environment?

In a data warehouse, which technique is most effective for protecting PII during the ETL (Extract, Transform, Load) process while still allowing analytics?

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application that uses behavioral tracking. Which action should be prioritized to ensure compliance with privacy-by-design principles?