75 of 78 questions · Page 1/2 · Privacy Engineering topic · Answers revealed
Which TWO actions should be taken when decommissioning an old server containing PII?
Renders data unrecoverable.
Why this answer
Cryptographic erasure and physical destruction are industry-standard methods for ensuring data cannot be recovered.
In a Google Cloud environment, you need to implement a policy to automatically redact PII from documents uploaded to Cloud Storage. Which service should be integrated?
The DLP API provides native integration to redact sensitive data from storage sources.
Why this answer
Cloud Data Loss Prevention (DLP) API allows for the inspection, de-identification, and redaction of PII within unstructured data.
Which TWO technical controls are effective for limiting the scope of PII access in a cloud-based SQL environment?
Hides specific sensitive columns.
Why this answer
Column-level security and Row-level security provide the most granular access control to prevent unauthorized PII visibility.
When implementing Privacy by Design (PbD) in a new mobile application, which TWO of the following are considered proactive technical controls?
Ensuring the most restrictive settings are enabled by default is a proactive control.
Why this answer
Data minimization and privacy-default configurations are foundational proactive PbD controls.
When designing a data retention policy, which technical configuration in S3 best automates the process?
This automates deletion based on expiration dates.
Why this answer
S3 Lifecycle policies allow for automatic transition or deletion of objects based on age.
What is the primary function of a 'Data Protection Impact Assessment' (DPIA) from an engineering perspective?
It is a foundational privacy-by-design activity.
Why this answer
A DPIA helps identify privacy risks in the design phase so that controls can be implemented early.
A privacy engineer is configuring Azure Data Factory to ensure PII is masked during integration. Which feature should be configured to apply dynamic data masking on SQL targets?
DDM is the direct tool for masking sensitive data at the database level.
Why this answer
Dynamic Data Masking (DDM) in Azure SQL Database allows masking sensitive data, which can be enforced via integration pipelines.
An organization wants to monitor data access patterns for potential privacy violations. Which tool is best for detecting unusual access to PII tables?
DAM tools specifically track queries and row-level access patterns.
Why this answer
Database activity monitoring (DAM) or audit logs analyzed by a SIEM can flag anomalous access behavior.
When encrypting data for long-term storage, which configuration is most important for privacy?
This limits the window of vulnerability for encrypted data.
Why this answer
Key rotation ensures that even if one key is compromised, the impact on the data is contained, and it supports long-term data protection.
A privacy engineer is implementing differential privacy in a data analytics pipeline. To ensure the privacy budget remains intact over multiple queries, which technique should be applied?
Composition theorems provide the mathematical framework to calculate the total privacy budget spent.
Why this answer
Composition theorems in differential privacy allow for the tracking of the cumulative privacy loss (epsilon) as multiple queries are performed on the same dataset.
A privacy engineer is implementing 'Tokenization' for credit card processing. Where should the 'vault' be situated to ensure the highest level of privacy?
Segregation limits exposure and restricts access to the sensitive mapping database.
Why this answer
The vault containing the cleartext data must be isolated in a highly secure environment, often off-site or in a segregated network segment, to minimize the PCI-DSS scope.
Which THREE factors are critical for balancing privacy and utility when using k-anonymity?
These are the target of generalization.
Why this answer
Choosing the right quasi-identifiers, the value of k, and the generalization level are key to balancing privacy and utility.
A company needs to share customer demographics with a third party. Which technique allows for statistical analysis without revealing individual identities?
It provides a mathematical guarantee of privacy for individuals in a statistical dataset.
Why this answer
Differential privacy adds mathematical noise to prevent individual re-identification while preserving global trends.
Which component in an API gateway is used to ensure PII is not sent to third-party endpoints?
This allows modifying the request payload to remove PII.
Why this answer
A request transformation policy can be used to scrub or redact specific headers or body fields before the request is forwarded.
You are auditing a system for 'Data Minimization'. Which discovery finding would be a primary concern?
This violates the principle of storing only what is needed for as long as needed.
Why this answer
Storing PII longer than the legal or business necessity period is a direct violation of data minimization and retention principles.
Which feature in Microsoft Purview Information Protection should be used to automatically identify and classify documents containing credit card numbers as they are created?
This feature automatically applies protection based on detected sensitive info types.
Why this answer
Sensitivity labels combined with Auto-labeling policies allow for the automated identification and tagging of sensitive data based on content patterns.
A privacy engineer is auditing log data. Which action best aligns with data minimization requirements for logs?
Masking removes or replaces PII in logs.
Why this answer
Log masking or filtering ensures that sensitive information is not persisted in log files.
A privacy engineer is configuring Azure SQL Database to ensure that sensitive columns containing PII are hidden from non-privileged users. Which feature should be implemented to achieve dynamic data masking?
DDM is the specific SQL feature designed to mask sensitive data in the result set of a query.
Why this answer
Dynamic Data Masking (DDM) limits sensitive data exposure by masking it to non-privileged users at the query execution level.
Which TWO actions help improve privacy in a containerized environment (e.g., Kubernetes)?
Protects keys and passwords.
Why this answer
Network policies and secrets management are essential for limiting access and protecting sensitive data in containers.
Which of the following is an example of a Privacy-Enhancing Technology (PET) that focuses on data minimization?
Synthetic data allows for analysis without using real PII.
Why this answer
Synthetic data generation creates new data that mimics the properties of real data without containing the original PII.
In the context of Privacy by Design, what is the primary role of an 'Access Control Matrix' in a microservices architecture?
The matrix ensures granular control based on need-to-know.
Why this answer
It explicitly maps subjects to objects and permissions, ensuring the principle of least privilege.
Which THREE of the following are considered standard 'Privacy-Enhancing Technologies' (PETs) used for data protection in analytics?
Adds mathematical noise to protect individual identity.
Why this answer
Differential privacy, secure multi-party computation, and homomorphic encryption are core PETs designed for privacy-preserving computation.
When designing a privacy-preserving data pipeline, which TWO strategies help achieve 'Data Minimization'?
This reduces the granularity of data at the entry point of the pipeline.
Why this answer
Data aggregation and truncation/hashing are effective ways to reduce the granularity of data and minimize the presence of identifiable information.
A privacy engineer is implementing differential privacy on a dataset using Google Cloud's Differential Privacy library. Which THREE configuration steps are critical for minimizing re-identification risk?
Sensitivity bounds dictate the amount of noise required.
Why this answer
Differential privacy involves setting epsilon, delta, and ensuring proper noise injection.
When implementing differential privacy in a data analytics pipeline, what is the primary technical trade-off the engineer must balance?
Differential privacy requires balancing the noise level (privacy) against result utility (accuracy).
Why this answer
The epsilon parameter controls the privacy budget, affecting the accuracy of the output and the level of privacy protection.
Which TWO of the following are key privacy controls in an AWS environment?
Identifies PII in S3.
Why this answer
AWS Macie (for discovery) and AWS KMS (for encryption/control) are critical privacy tools.
When pseudonymizing a database using SHA-256 hashing, what is the most critical requirement to prevent re-identification via brute-force or dictionary attacks?
A salt ensures that identical inputs result in different hashes, mitigating rainbow table attacks.
Why this answer
Adding a unique, secret salt to each input before hashing prevents the use of precomputed rainbow tables to reverse the hash.
Which THREE attributes are typically included in a 'Privacy Metadata' schema to support automated data governance?
Essential for accountability.
Why this answer
Data classification, retention policies, and data owner information are standard components of privacy metadata.
Which THREE technical approaches assist in 'Right to Portability' implementation?
Useful for generating clean data exports.
Why this answer
Standardized data formats, secure APIs, and automated export services allow users to move their data easily.
When using 'k-anonymity' to protect a dataset, what does the parameter 'k' represent?
Each record must be indistinguishable from k-1 other records.
Why this answer
k-anonymity ensures that any individual in the dataset cannot be distinguished from at least k-1 other individuals.
When configuring a Cloud Service Provider's (CSP) 'Storage Access' permissions, which configuration best supports the principle of data segregation?
This enforces least privilege and segregation.
Why this answer
Using separate service accounts and IAM policies for different services ensures that one service cannot access data belonging to another.
Which of the following is an effective way to implement 'Right to Erasure' in a distributed database system?
This handles distributed nature of data effectively.
Why this answer
A centralized deletion service that triggers asynchronous deletion tasks across all nodes and backups ensures full removal.
You are designing a system for k-anonymity. If a dataset has an identifier that is unique to every row, what is the first step you must take before applying generalization?
Direct identifiers must be removed to prevent simple record linking.
Why this answer
Quasi-identifiers must be identified, and direct identifiers must be suppressed or removed, as k-anonymity does not protect against direct identification.
Which principle is represented by ensuring a user's data is only available to the specific application service that needs it?
Providing only the access required for the specific task.
Why this answer
This is the core definition of the principle of least privilege, a pillar of Privacy by Design.
Which TWO of the following are privacy-by-design principles relevant to software development?
Anticipate risks before they occur.
Why this answer
Privacy by Default and Proactive/Preventative measures are core pillars of Privacy by Design.
You are configuring AWS Macie to identify PII in an S3 bucket. Which setting must be enabled to ensure that specific sensitive data patterns are detected across all files regardless of their object tags?
Custom data identifiers allow users to define specific patterns to search for within the object content.
Why this answer
Custom data identifiers allow for the definition of regex patterns to scan the entire content of S3 objects, rather than relying on metadata tags.
When configuring 'Dynamic Data Masking' in SQL Server, which permission is required for a user to see the unmasked data?
This explicit permission allows the user to view the raw, unmasked data.
Why this answer
The 'UNMASK' permission is required for a user to view the original values hidden by dynamic data masking.
An organization uses a 'Privacy-preserving Synthetic Data' generator. What is the primary purpose of this tool in a development environment?
Synthetic data allows functionality testing while ensuring no real user data is exposed.
Why this answer
Synthetic data mimics the statistical properties of real data without containing actual PII, allowing devs to test without privacy risk.
In a federated learning architecture, how is the model trained without exposing the underlying local datasets?
The raw data never leaves the local device; only the model updates are shared.
Why this answer
Federated learning works by sending the global model to local nodes, training it locally, and sending only the parameter updates (gradients) back to the central server.
A privacy engineer is configuring a new AWS S3 bucket to store sensitive customer data. Which configuration ensures the highest level of privacy by design through encryption at rest using customer-managed keys?
SSE-KMS with customer-managed keys allows for granular key policies and audit logs.
Why this answer
AWS KMS with customer-managed keys provides better control over access and rotation than S3-managed keys.
When designing a system with k-anonymity, which metric measures the impact of generalization on the utility of the data?
It quantifies the loss of utility due to generalization.
Why this answer
Discernibility penalty measures how much the data has been degraded to achieve the k-anonymity requirement.
When implementing Secure Multi-Party Computation (SMPC), what is the primary benefit?
It enables collaborative analysis without sharing raw data.
Why this answer
SMPC allows multiple parties to compute a function over their inputs while keeping those inputs private from each other.
Which THREE features are essential when implementing a robust 'Consent Management Platform' (CMP)?
Necessary to prove compliance.
Why this answer
A CMP must allow for granular consent, withdrawal, and audit trails to be compliant.
Which THREE types of data are considered 'sensitive' and require heightened privacy controls?
Contains highly private information.
Why this answer
Biometric, health, and financial data are explicitly listed as special categories or sensitive data in most privacy regulations like GDPR or CCPA.
To prevent 're-identification' of an anonymized dataset, what process should be applied if the dataset is merged with external public data?
This assesses if external data can re-identify individuals.
Why this answer
Re-identification risk assessment, specifically linkage attack analysis, must be conducted to ensure the merged dataset remains safe.
What does a 'Privacy-Enhancing Technology' (PET) primarily aim to achieve?
That is the core definition of a PET.
Why this answer
PETs are tools that protect personal data by minimizing it, masking it, or providing mathematical privacy guarantees.
In a database, you need to replace social security numbers with a consistent, non-reversible value for analytics. What is the best approach?
Hashing is one-way, and the salt prevents rainbow table attacks.
Why this answer
Salted hashing produces a consistent value that is non-reversible, ideal for analytics without needing to recover the original ID.
A practitioner is deploying a Google Cloud Storage bucket. To ensure that files containing PII are automatically redacted before being accessed by external users, which Cloud DLP action should be integrated?
DLP de-identification templates define how data is masked or tokenized.
Why this answer
Cloud DLP (Data Loss Prevention) triggers can be integrated to inspect and redact content in Cloud Storage.
You are implementing 'Privacy-Preserving Record Linkage' between two databases. What is the most effective approach?
Bloom filters are a common PET for privacy-preserving comparison.
Why this answer
Bloom filters allow comparing data without exchanging the actual raw values, protecting the underlying PII.
When implementing a 'Privacy Dashboard' for users, which feature is critical for fulfilling GDPR Article 15 (Right of Access) requests?
Portability is a core component of the Right of Access.
Why this answer
Self-service data export allows users to exercise their right of access without manual intervention.
Which THREE privacy engineering activities are performed during the 'Maintenance' phase of the system lifecycle?
Prevents PII breaches.
Why this answer
Continuous monitoring, re-assessing impact, and updating security patches are critical during maintenance.
In AWS Glue, a developer needs to ensure that sensitive columns are automatically identified and redacted during ETL jobs. Which component is best suited for this?
DataBrew provides visual transformations and PII redaction capabilities.
Why this answer
Glue DataBrew allows for data profiling and recipe-based transformations including PII redaction.
Which THREE techniques are commonly used to achieve 'Pseudonymization' for PII in data sets?
Hiding specific characters (e.g., credit card digits) while leaving a portion for identification.
Why this answer
Tokenization, hashing (with salt), and masking (partial) are all accepted methods for pseudonymization.
To ensure that data access logs cannot be tampered with by an administrator with high privileges, which technical control should be implemented?
Immutable storage prevents modification or deletion of existing audit records.
Why this answer
Write-Once-Read-Many (WORM) storage or immutable logging ensures that even admins cannot alter or delete logs after they are written.
You are troubleshooting a Federated Learning model. Privacy leakage is occurring during model updates. Which parameter should you adjust to improve privacy?
Secure aggregation ensures individual updates are not visible to the server.
Why this answer
Adding secure aggregation and increasing the noise in gradients helps prevent inference attacks on model updates.
In the context of 'Privacy-Preserving Machine Learning', what is the purpose of the 'Membership Inference Attack' simulation during testing?
It detects if the model memorizes individual training data.
Why this answer
This simulation tests if a model reveals whether a specific individual's data was used in the training set, exposing a potential privacy breach.
Which TWO techniques should be used to protect PII in non-production environments to ensure the data remains non-identifiable?
Separating identifiers from data reduces risk.
Why this answer
Anonymization and pseudonymization (if key access is restricted) are standard methods for protecting non-prod data.
A privacy engineer is reviewing a 'consent management platform' (CMP). Which configuration is necessary to ensure compliance with a user's choice to 'opt-out' of data sharing?
The signal must be actionable by all integrated vendors to be effective.
Why this answer
The CMP must broadcast the opt-out signal to all downstream ad-tech and analytics providers via a standardized framework like GPP or TCF.
A system architect is using 'Zero Trust' network principles. How does this enhance privacy?
It eliminates implicit trust, ensuring only authorized access to PII.
Why this answer
It forces authentication and authorization for every request, preventing lateral movement and unauthorized data access.
Which THREE privacy-enhancing technologies are commonly used to facilitate data analysis on distributed datasets without centralizing the raw PII?
Trains models without moving raw data.
Why this answer
SMPC, Federated Learning, and Differential Privacy all allow for privacy-preserving analysis of distributed data.
An organization is using 'Bring Your Own Key' (BYOK) in their cloud environment. What is the primary privacy benefit?
The organization controls when keys are destroyed, limiting provider access.
Why this answer
BYOK allows the data controller to maintain custody of the encryption keys, preventing the cloud provider from accessing the data.
Which feature in an identity provider (IdP) supports privacy by limiting the scope of claims sent to a relying party?
Scopes define the subset of identity information shared.
Why this answer
OIDC scopes allow the requester to ask for only the minimum set of attributes required, supporting data minimization.
A web application stores user logs in a cleartext format. To implement 'Privacy by Design', which technical control is the most appropriate first step to minimize data exposure?
Masking is an effective method to remove or hide sensitive data before it is persisted.
Why this answer
Data minimization ensures that only necessary data is collected and stored, reducing the attack surface immediately.
Which TWO of the following are effective ways to protect logs that contain PII?
Protects data on the storage medium.
Why this answer
Encryption and restricted access control are necessary for protecting sensitive data inside log files.
Which TWO actions should be taken when performing a 'Privacy Impact Assessment' (PIA) on a new software tool?
Assessing risk is the primary goal of the PIA process.
Why this answer
A PIA involves identifying the flow of data and assessing the risks to data subject rights.
Which TWO features in a cloud IAM configuration help enforce 'Least Privilege' as a privacy control?
ABAC allows for dynamic, context-aware access decisions.
Why this answer
Attribute-Based Access Control and Just-in-Time access are primary mechanisms for granular, minimal access.
Which of the following is an example of a physical privacy control?
This is a physical control protecting the infrastructure.
Why this answer
Securing the server room prevents unauthorized physical access to the hardware holding the data.
Which TWO of the following are key privacy engineering objectives when designing a system that processes sensitive health data?
Reducing PII collection is essential.
Why this answer
Data minimization and transparency are fundamental to privacy engineering for sensitive data.
What is the primary privacy advantage of using 'On-Device Processing' for machine learning inference?
By not sending the data to the cloud, the risk of interception or unauthorized storage is eliminated.
Why this answer
On-device processing keeps raw user data on the local device, preventing the need to transmit sensitive information to a central server.
When using Homomorphic Encryption, what is the primary limitation for a privacy engineer to consider?
The performance cost is the main barrier to widespread adoption.
Why this answer
Homomorphic encryption is extremely computationally intensive, often causing significant performance degradation.
A privacy engineer is using Terraform to enforce encryption at rest for S3 buckets. Which resource attribute should be set to 'aws:kms'?
This block defines the encryption settings for the bucket.
Why this answer
The 'sse_algorithm' attribute must be set to 'aws:kms' to enforce server-side encryption with KMS.
Which of the following is an example of an 'operational' technical control for privacy?
These are active tools used in the environment to manage data.
Why this answer
Automated data discovery scans identify where PII exists, which is necessary for managing privacy.
Which of the following is the most effective technical control for implementing the 'Right to be Forgotten' in a distributed microservices environment?
An event bus ensures consistency and auditability for deletion requests across microservices.
Why this answer
A centralized identity service allows for the systematic propagation of deletion requests across all downstream services.
You are integrating a homomorphic encryption library into a cloud-based financial system. What is the primary trade-off you must communicate to stakeholders regarding the implementation of Fully Homomorphic Encryption (FHE)?
FHE operations require massive computational overhead, causing slow query performance.
Why this answer
FHE is computationally expensive, leading to significant latency increases for complex analytical operations on encrypted data.
Ready to test yourself?
Try a timed practice session using only Privacy Engineering questions.