Privacy Engineering practice questions

Choosing a random seed that is publicly known

Why it fails: Publicly known seeds can lead to deterministic behavior.

Increasing the dataset size to infinite

Why it fails: This is not a configurable parameter or a valid approach.

AWS Glue Schema Registry

Why it fails: Schema Registry manages schema versions, not data content.

AWS Lake Formation

Why it fails: Lake Formation controls access but does not redact data inside ETL jobs.

Amazon Macie

Why it fails: Macie discovers sensitive data but does not perform ETL redaction.

Enable S3 Managed Keys (SSE-S3)

Why it fails: SSE-S3 uses service-managed keys which offers less control than customer-managed keys.

Enable S3 Object Lock

Why it fails: Object Lock is for data integrity/retention, not encryption at rest.

Enable Server-Side Encryption with Customer-Provided Keys (SSE-C)

Why it fails: SSE-C requires the client to manage key material, which increases the risk of loss.

Account deletion button

Why it fails: This relates to the Right to Erasure.

Consent management toggle

Why it fails: This relates to rights to withdraw consent.

Marketing preference settings

Why it fails: This is a business preference, not a data right.

Deterministic encryption

Why it fails: Encryption is reversible.

Format-preserving encryption

Why it fails: This is also reversible.

Randomized tokenization

Why it fails: Tokenization typically uses a vault to reverse the value.

S3 Replication

Why it fails: This is for data redundancy.

S3 Inventory

Why it fails: This is for reporting.

S3 Object Lock

Why it fails: This prevents deletion.

Epsilon value

Why it fails: Epsilon is for differential privacy.

Entropy loss

Why it fails: This is not a standard k-anonymity metric.

F-score

Why it fails: This is for machine learning model evaluation.

Disabling logging

Why it fails: This hinders audit capability.

Hardcoding the key

Why it fails: This is a critical security vulnerability.

Using a single global key

Why it fails: This is a single point of failure.

Deleting the entire database

Why it fails: This is not feasible for multi-tenant systems.

Marking records as deleted

Why it fails: This is 'soft delete' and does not fulfill the requirement.

Overwriting with new user data

Why it fails: This does not guarantee complete erasure.

Using AES-256 for encryption

Why it fails: This is a good security practice.

Using a pseudonym for database keys

Why it fails: This is a privacy-enhancing technique.

Encrypting backups

Why it fails: This is a security best practice.

Full database mirroring

Why it fails: Copying production data verbatim preserves every direct identifier, so the non-production copy remains fully identifiable. Mirroring suits realistic load or failover testing where fidelity matters, but anonymisation, masking or synthetic generation is required whenever PII must become non-identifiable.

Public internet exposure

Why it fails: Publishing a dataset to the public internet exposes the PII rather than removing identifiability, and grants uncontrolled access. Public exposure fits deliberately open datasets such as reference or weather data; protecting PII demands masking, tokenisation or synthetic data inside a controlled environment.

Plaintext replication

Why it fails: Plaintext replication copies PII verbatim into non-production, leaving it directly identifiable and failing the masking requirement. It tempts because it is the fastest way to obtain realistic test data, and it would be acceptable only for synthetic or already de-identified datasets containing no personal data.

IAM Role trust policy

Why it fails: IAM roles govern permissions to access Macie, not the scope of discovery.

S3 Bucket Policy modification

Why it fails: Bucket policies control access, not content scanning.

S3 Object Lock

Why it fails: S3 Object Lock is for WORM compliance, not PII discovery.

Pseudonymization by replacing patient identifiers with randomly generated tokens.

Why it fails: Pseudonymization replaces direct identifiers but does not prevent linkage attacks using quasi-identifiers such as age, zip code, and diagnosis. An attacker could still re-identify individuals by combining these attributes with external data. This technique preserves utility but fails to provide robust anonymization against linkage attacks.

Homomorphic encryption to allow computations on encrypted data without decryption.

Why it fails: Homomorphic encryption enables computation on encrypted data but does not anonymize the dataset for release. The data remains encrypted, and researchers would need decryption keys, which reintroduces privacy risks. It is not a technique for anonymizing data for open release and is computationally intensive.

Data masking by replacing all values with random characters, including medical diagnoses.

Why it fails: Data masking that randomizes all values destroys data utility entirely, making statistical analysis impossible. It also does not guarantee protection against re-identification if the masking is reversible or if patterns remain. This approach is overly destructive and unsuitable for research purposes.

Collect the user's email address and IP address to detect fraudulent subscriptions.

Why it fails: While fraud detection is a legitimate purpose, collecting IP address may not be strictly necessary for a newsletter and could be considered excessive. Data minimization requires collecting only what is adequate, relevant, and limited to the purpose. IP address collection might be disproportionate without a demonstrated need.

Collect the user's email address, full name, and phone number to personalize future communications.

Why it fails: Collecting additional data like full name and phone number exceeds the purpose of newsletter subscription. This violates data minimization because it collects more than needed. Even if used for personalization, it is not necessary for the stated purpose and increases privacy risk.

Collect the user's email address and retain it indefinitely to ensure future communications.

Why it fails: Indefinite retention violates the storage limitation principle, which is closely tied to data minimization. Data should be kept only as long as necessary for the purpose. Retaining indefinitely increases risk and non-compliance with privacy regulations like GDPR.

Store all personal data in a single region to avoid cross-border transfer issues.

Why it fails: While data localization can simplify compliance, it may not be feasible or cost-effective for a global analytics platform. It also does not address other privacy requirements like access controls or encryption. This action is overly restrictive and may not align with business needs.

Conduct regular privacy impact assessments (PIAs) on the cloud provider's infrastructure.

Why it fails: PIAs are typically conducted on the organization's own processing activities, not the cloud provider's infrastructure. While due diligence on the provider is important, PIAs focus on the organization's use of data. This action misplaces responsibility and may not satisfy compliance obligations.

Rely on the cloud provider's default encryption settings for data in transit and at rest.

Why it fails: Default encryption may not meet specific privacy requirements or provide sufficient control. The shared responsibility model means the organization must verify and often enhance encryption settings. Relying solely on defaults can lead to compliance gaps, especially for cross-border transfers.

Configure database auditing to log all access to personal data.

Why it fails: Auditing logs access but does not prevent data exposure from a stolen disk. An attacker with physical access can bypass the database and read files directly. Auditing is a detective control, not a preventive one for physical theft. It is useful for monitoring but does not protect data at rest.

Store the database on a self-encrypting drive (SED) and manage keys in a hardware security module (HSM).

Why it fails: Self-encrypting drives provide encryption at the hardware level, but key management can be complex and may not integrate seamlessly with database-level controls. TDE is more directly applicable to database files and offers centralized key management. While SEDs can protect against disk theft, TDE is the more appropriate database-specific control.

Implement column-level encryption for all columns containing personal data.

Why it fails: Column-level encryption protects specific columns but does not encrypt the entire database files. If the disk is stolen, unencrypted columns or metadata could still be exposed. Additionally, column-level encryption can be complex to manage and may impact performance. It is not the most appropriate control for protecting against physical disk theft of the entire database.

The export format must use a proprietary binary encoding to minimize size.

Why it fails: A proprietary binary encoding is not structured, commonly used, or machine-readable in an interoperable sense. It would hinder portability because other systems may not be able to parse it. The GDPR requires formats like JSON, XML, or CSV that are widely supported. Proprietary formats defeat the purpose of data portability.

The export format must be a human-readable PDF to ensure users can review it.

Why it fails: PDF is not a structured, machine-readable format suitable for automated processing by other systems. While human-readable, it fails the interoperability requirement of data portability. The GDPR expects formats like JSON or XML that can be easily imported by other services. PDF would require manual extraction, defeating the purpose.

The export must be delivered via an unauthenticated public URL for convenience.

Why it fails: An unauthenticated public URL would expose personal data to anyone with the link, violating privacy and security. Data portability exports must be protected by authentication and authorization. Convenience cannot override the need to safeguard personal data. This option would create a severe privacy breach.

Azure Policy definition

Why it fails: Azure Policy definitions audit or enforce resource configuration at the control plane; they cannot rewrite column values during pipeline execution, so PII passes through unmasked. They are tempting because they enforce governance, but would be correct for denying non-compliant resource deployments across a subscription.

Data Factory Mapping Data Flows

Why it fails: Mapping Data Flows transform data in Spark during pipeline execution, but dynamic data masking on SQL targets is a database-side feature configured on the SQL platform, not within Data Factory flows. Flows are tempting for in-flight transformation, but would be correct for reshaping or deriving columns during integration.

Azure Key Vault access policies

Why it fails: Key Vault access policies govern permissions to secrets, keys and certificates; they cannot mask columns in a SQL sink. Dynamic data masking is configured on the SQL target itself, or via Data Factory's masking transformations. Key Vault is tempting because it secures credentials used in linked services, which is a separate concern from masking PII values.

IAM conditions

Why it fails: IAM conditions gate access by attributes such as principal, IP or resource path; they cannot transform object content, so PII would still be returned unredacted. Cloud DLP's de-identification actions or inspection templates perform the redaction. IAM conditions suit restricting who may call an API, not altering the data itself.

Storage Transfer Service

Why it fails: Storage Transfer Service moves or replicates data between buckets and external sources; it performs no content inspection or redaction. It is the correct choice for migrating or synchronising large datasets, not for de-identifying PII before external access.

Bucket lock

Why it fails: Bucket lock enforces retention and immutability on objects, preventing deletion or modification; it does not inspect or redact PII. It is the right control when regulatory retention periods must be guaranteed, not for automatic data redaction.

Cloud Storage buckets lifecycle policy

Why it fails: A bucket lifecycle policy automates object transitions, retention and deletion based on age or storage class; it never parses file contents, so it cannot locate or redact PII. Lifecycle rules would be correct if the requirement were to delete or archive uploaded documents automatically after a set period.

Cloud Identity and Access Management

Why it fails: Cloud IAM controls who can access resources and what actions they may perform; it cannot inspect document contents or transform PII. Redaction requires content analysis and transformation. Cloud IAM would be the correct integration if the policy needed to restrict which principals could read or write objects in the bucket.

Cloud Logging

Why it fails: Cloud Logging records and stores audit and platform events; it observes activity rather than modifying stored objects, so it cannot strip PII from uploaded files. Cloud Logging would be the correct integration if the policy required capturing and retaining an audit trail of storage access events.