ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) (CDPSE) — Questions 76–150

When pseudonymizing a database using SHA-256 hashing, what is the most critical requirement to prevent re-identification via brute-force or dictionary attacks?

Which THREE attributes are typically included in a 'Privacy Metadata' schema to support automated data governance?

Which THREE technical approaches assist in 'Right to Portability' implementation?

When using 'k-anonymity' to protect a dataset, what does the parameter 'k' represent?

A CDPSE practitioner is configuring a data discovery job in OneTrust to identify PII in a structured database. Which setting must be enabled to ensure the tool automatically masks the data upon discovery based on a predefined classification tag?

In the context of the data lifecycle, what is the primary benefit of using a 'Data Catalog' tool like Alation?

Which governance artifact is best for documenting the accountability for privacy decisions?

When configuring a Cloud Service Provider's (CSP) 'Storage Access' permissions, which configuration best supports the principle of data segregation?

In the context of the NIST Privacy Framework, what is the primary role of the 'Govern' (GV) function?

Which of the following is an effective way to implement 'Right to Erasure' in a distributed database system?

Which THREE of the following are benefits of a centralized privacy governance model?

In MongoDB, what is the most effective way to ensure data minimization regarding personally identifiable information?

When aligning privacy strategy with business objectives, what is the primary metric to demonstrate the value of a privacy program to stakeholders?

In the event of a personal data breach, which TWO actions are required to satisfy the notification obligations under many modern privacy regulations (e.g., GDPR)?

You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?

What is the primary role of a Data Privacy Officer (DPO)?

Which TWO actions should a CDPSE prioritize when assessing a vendor for privacy compliance?

Which principle is represented by ensuring a user's data is only available to the specific application service that needs it?

You are managing data in a Kubernetes environment. What strategy should be used to support data minimization for ephemeral pods?

A company is implementing a new CCPA compliance tool. Which feature should be used to automate the 'Right to Opt-Out' request process for web visitors?

When privacy governance is integrated into IT governance, what is the most significant benefit?

An organization is conducting a privacy maturity assessment. Which item represents the highest level of maturity in privacy policy development?

Which THREE of the following are essential components of an effective privacy governance framework?

Which TWO of the following are primary benefits of establishing a mature privacy governance program?

A third-party vendor is providing an API integration for customer support. As a CDPSE, what is the first step you should take in the third-party privacy risk management lifecycle?

In Snowflake, what is the effect of using a 'Dynamic Data Masking' policy on a column containing PII when a non-authorized user runs a SELECT query?

Which TWO factors must be considered when determining if a cross-border data transfer is lawful under GDPR?

Which TWO attributes are essential to include in a data mapping register for privacy compliance?

Which TWO of the following are privacy-by-design principles relevant to software development?

Which tool is best suited for establishing the scope of a privacy governance program by identifying where personal data resides across the organization?

During a data minimization project, you use Privacera to filter access to specific columns in a Hive table. Which mechanism is used to enforce this policy?

Which THREE elements are essential in a Data Protection Impact Assessment (DPIA) report?

When managing privacy risks, which TWO approaches help in 'Data Minimization'?

You are configuring AWS Macie to identify PII in an S3 bucket. Which setting must be enabled to ensure that specific sensitive data patterns are detected across all files regardless of their object tags?

When performing a data minimization assessment, which feature in Oracle Data Safe helps identify excessive data collection by flagging columns that contain sensitive data but are rarely queried?

A CDPSE practitioner is conducting a Privacy Impact Assessment (PIA) for a new marketing application. During the data flow mapping phase, they identify that PII is being transferred to a cloud service provider located in a non-equivalent jurisdiction. Which action should the practitioner prioritize to ensure compliance with the GDPR?

Which THREE of the following are essential elements of a privacy governance framework?

When configuring 'Dynamic Data Masking' in SQL Server, which permission is required for a user to see the unmasked data?

An organization uses a 'Privacy-preserving Synthetic Data' generator. What is the primary purpose of this tool in a development environment?

Which TWO activities are involved in the 'data mapping' life cycle phase?

Which THREE types of personal data are typically considered 'special category' or 'sensitive' data under privacy regulations?

In a federated learning architecture, how is the model trained without exposing the underlying local datasets?

A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?

When designing a system with k-anonymity, which metric measures the impact of generalization on the utility of the data?

A company is using an automated system to make credit decisions. What is the main privacy concern regarding the 'Right to Explanation'?

An organization is implementing a 'Privacy by Design' framework for a machine learning model used to predict customer churn. Which technique should be utilized to minimize privacy risk while maintaining model utility?

When configuring a 'Data Disposal' process, why is it critical to verify the 'Chain of Custody'?

When implementing Secure Multi-Party Computation (SMPC), what is the primary benefit?

Which THREE features are essential when implementing a robust 'Consent Management Platform' (CMP)?

During a data mapping exercise in BigID, you need to identify data that has exceeded its retention period. Which attribute should be used to filter the data inventory?

How can an organization ensure privacy is considered during the vendor procurement phase?

Which THREE types of data are considered 'sensitive' and require heightened privacy controls?

When establishing a Privacy Risk Assessment methodology, which TWO components are essential to ensure the assessment is repeatable and defensible?

A company is considering the use of a data broker. Which privacy risk is most significant?

To prevent 're-identification' of an anonymized dataset, what process should be applied if the dataset is merged with external public data?

When implementing a privacy management system, what is the best approach to gain executive support?

What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?

What is the first step in creating a data inventory for a privacy program?

Which TWO options represent common risks when data life cycle management is not implemented?

In a database, you need to replace social security numbers with a consistent, non-reversible value for analytics. What is the best approach?

During an audit, it is found that an application logs user session tokens including sensitive user IDs. What is the correct privacy recommendation?

A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?

How can a CDPSE ensure that personal data is only kept for as long as necessary?

What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?

Which THREE techniques effectively protect data during the 'use' phase of the life cycle?

Your organization is preparing for a CCPA/CPRA audit. You are asked to verify the 'Right to Opt-Out of Sale or Sharing' implementation. Which technical requirement must be validated to ensure compliance with the Global Privacy Control (GPC) signal?

You are implementing 'Privacy-Preserving Record Linkage' between two databases. What is the most effective approach?

When managing data retention in Azure Data Lake Storage (ADLS) Gen2, how do you implement a policy that deletes files older than 7 years?

When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?

Which THREE privacy engineering activities are performed during the 'Maintenance' phase of the system lifecycle?

Which TWO of the following are key components of a robust privacy governance framework?

Which THREE activities should be included in an organization's privacy compliance monitoring program to identify potential regulatory non-compliance?

A CDPSE is reviewing a vendor's privacy controls. Which finding would be considered a major non-compliance risk?

In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?

Which THREE techniques are commonly used to achieve 'Pseudonymization' for PII in data sets?