CDPSE Practice Questions

Question 1

A healthcare organization is implementing a data retention policy for electronic health records (EHRs) in a hybrid cloud environment. The policy must ensure that records are retained for the legally required period, then securely disposed of. Which approach best ensures compliance and secure disposal?

Accepted Answer

Implement a policy-driven retention system that automatically enforces retention periods and triggers cryptographic erasure of expired records across all storage tiers, with audit logs.. A policy-driven retention system with cryptographic erasure automates enforcement and ensures irreversible disposal across all copies. It addresses the complexity of hybrid cloud environments by removing reliance on manual processes. Audit logs provide accountability. This approach aligns with legal retention requirements and data minimization principles.

Answer

Store EHRs in an encrypted database and, upon retention expiry, delete the records and their backups manually, documenting each deletion in a log.

Answer

Use a third-party archival service to store EHRs indefinitely, and rely on the service provider's security certifications to ensure compliance.

Answer

Encrypt EHRs with a single organization-wide key and, at retention expiry, delete the key to render all records inaccessible, while keeping backups for disaster recovery.

Question 2

In the context of 'Privacy-Preserving Machine Learning', what is the purpose of the 'Membership Inference Attack' simulation during testing?

Accepted Answer

To identify if training data is leaked. A Membership Inference Attack (MIA) attempts to determine whether a specific individual's data was part of a model's training set. Simulating MIA during testing helps identify if the model leaks information about its training data, which is a privacy risk. The goal is not to improve model performance but to assess and mitigate privacy leakage.

Answer

To optimize model accuracy

Answer

To improve training speed

Answer

To validate input quality

Question 3

A CDPSE is advising a startup that has developed a mobile app for tracking fitness activities. The app collects users' heart rate, sleep patterns, and GPS location. The startup plans to use this data to provide personalized health insights and also to share aggregated data with research partners. Before launching, the CDPSE must ensure that the privacy policy reflects the appropriate legal basis for processing. Which of the following is the MOST appropriate legal basis for processing this health and location data under the GDPR?

Accepted Answer

Explicit consent, obtained from users after providing clear information about the processing purposes.. Processing health data (heart rate, sleep) and precise location data falls under special categories of personal data under the GDPR, requiring a higher legal basis. Explicit consent is the most appropriate and commonly used basis for such processing, as it ensures individuals are fully informed and agree to the specific uses. Other legal bases like legitimate interests, contract performance, or vital interests are either insufficient or inapplicable for sensitive data in this context.

Answer

Vital interests, because the health insights could potentially save lives in emergency situations.

Answer

Performance of a contract, because users agree to the app's terms of service upon download.

Answer

Legitimate interests, because the app provides benefits to users and research partners.

Question 4

A privacy engineer is configuring a database that stores personal data. To support the principle of access control, the engineer needs to ensure that users can only access data necessary for their role. Which database feature should be used to restrict access at the row level based on user attributes?

Accepted Answer

Row-level security (RLS) policies. Row-level security (RLS) policies are designed to restrict access to rows based on user attributes, such as role or department. This enables fine-grained access control, ensuring users only see data relevant to their role. Column-level encryption, views, and table-level RBAC do not provide dynamic row-level filtering per user, making them unsuitable for this requirement.

Answer

Role-based access control (RBAC) at the table level

Answer

Database views with WHERE clauses

Answer

Column-level encryption

Question 5

A privacy engineer is configuring a data retention policy for a system that processes customer personal data. The policy must automatically delete data after its retention period expires. Which technical control best ensures that personal data is not retained beyond its defined lifecycle?

Accepted Answer

Automated deletion jobs triggered by data age. Automated deletion jobs are the correct control because they systematically remove personal data once the retention period expires, directly enforcing the storage limitation principle. Other controls may protect or restrict access to data but do not ensure its deletion. This makes automated deletion the best technical fit for the stated policy requirement.

Answer

Data loss prevention (DLP) monitoring outbound traffic

Answer

Role-based access control restricting who can view the data

Answer

Database backup encryption

Question 6

A CDPSE is assessing a new automated decision-making system that profiles customers for credit approvals. The system uses machine learning and operates in the EU. Which GDPR requirement must be addressed before deployment?

Accepted Answer

A Data Protection Impact Assessment (DPIA) must be conducted because the processing involves systematic and extensive evaluation of personal aspects.. Automated profiling for credit decisions is high-risk processing under GDPR. Article 35(3)(a) specifically identifies systematic and extensive evaluation of personal aspects based on automated processing as a trigger for a DPIA. The DPIA must be completed before processing begins to identify and mitigate risks.

Answer

The company must obtain consent from all customers before using the automated system.

Answer

The company must appoint a Data Protection Officer because the system uses artificial intelligence.

Answer

The company must transfer all profiling data to the European Data Protection Board for review.

Question 7

A privacy engineer is reviewing a 'consent management platform' (CMP). Which configuration is necessary to ensure compliance with a user's choice to 'opt-out' of data sharing?

Accepted Answer

Programmatic propagation of the opt-out signal. For a CMP to honor an opt-out, the choice must be programmatically propagated to every downstream system, tag, SDK, or vendor that processes the user's data. A stored preference that never reaches ad tech, analytics, or CRM systems is functionally useless. Programmatic propagation (e.g., via consent strings, APIs, or tag managers) is what actually enforces the user's choice across the data ecosystem.

Answer

Sending an email confirmation to the user

Answer

Storing the choice in a local browser cookie only

Answer

Displaying the privacy policy on the landing page

Question 8

When a conflict arises between business requirements and privacy principles, what should be the first step in the governance process?

Accepted Answer

Conduct a formal Privacy Impact Assessment (PIA).. A Privacy Impact Assessment (PIA) is the structured governance mechanism used to evaluate how a proposed processing activity affects individual privacy and to identify mitigations before the conflict escalates. When business requirements clash with privacy principles, the PIA provides an objective, documented analysis that lets governance bodies weigh risks, apply controls, or redesign the process rather than simply choosing one side. It is the recognized first step because it produces the evidence needed for any subsequent decision.

Answer

Ignore the privacy principle.

Answer

Ask the CEO to override the privacy policy.

Answer

Immediately terminate the project.

Question 9

A privacy engineer is implementing a data minimization strategy for a microservices application deployed on Kubernetes. The application processes customer payment data in ephemeral pods. The engineer must ensure that sensitive data is not persisted beyond the processing window and that any residual data in the container filesystem is securely removed. Which approach BEST achieves this?

Accepted Answer

Configure the pods to use an emptyDir volume with medium: Memory and ensure the application writes sensitive data only to that volume.. The correct approach uses an emptyDir volume with medium: Memory, which stores data in RAM and automatically deletes it when the pod terminates. This ensures that sensitive payment data is not written to persistent storage and is securely removed upon pod deletion, satisfying data minimization and disposal requirements. Other options involve persistent storage or insecure mechanisms that leave residual data.

Answer

Mount a hostPath volume to a dedicated directory on the node and apply a cron job to delete files older than one hour.

Answer

Use a PersistentVolume with a StorageClass that supports encryption at rest and set the reclaim policy to Delete.

Answer

Store sensitive data in a ConfigMap and mount it as a volume, then delete the ConfigMap after processing.

Question 10

Which THREE types of data are typically targeted for aggressive minimization?

Accepted Answer

Redundant, Obsolete, and Trivial (ROT) data. Option B is correct because ROT data (Redundant, Obsolete, and Trivial) has no ongoing business or legal value, so it is a prime candidate for aggressive minimization to reduce storage costs and breach exposure. Option D is correct because financial and payment information (e.g., cardholder data under PCI DSS) is highly sensitive and subject to strict retention limits, making it a frequent target for minimization. Option E is correct because PII is protected by privacy regulations such as GDPR and CCPA, which mandate data minimization and storage limitation, so organizations aggressively purge unneeded PII. Option A is not typically minimized aggressively because system logs for performance analysis are often retained for troubleshooting, capacity planning, and security monitoring. Option C is not a minimization target because publicly available documentation contains no sensitive or regulated data and poses little risk if retained.

Answer

System logs for performance analysis

Answer

Publicly available documentation

Question 11

You are mapping personal data flows for a global enterprise. Which approach is most effective for demonstrating accountability under GDPR?

Accepted Answer

Maintaining a comprehensive Record of Processing Activities (ROPA).. A Record of Processing Activities (ROPA) is the primary accountability artifact under GDPR Article 30, documenting what personal data is processed, why, by whom, where, and for how long. Maintaining a comprehensive ROPA demonstrates accountability because it provides the authoritative map of data flows that regulators, DPOs, and auditors rely on to verify lawful processing. It is the foundational document that supports DPIAs, DSAR responses, and breach assessments.

Answer

Conducting periodic penetration tests.

Answer

Updating the external privacy policy annually.

Answer

Signing NDAs with all employees.

Question 12

You are using AWS Macie to perform a classification scan. Which feature should be configured to notify the privacy team when sensitive data is found?

Accepted Answer

EventBridge Rule. Amazon Macie publishes findings to Amazon EventBridge, so configuring an EventBridge rule to match Macie finding events and route them to an SNS topic, Lambda, or ticketing system is the correct way to notify the privacy team. EventBridge is the native event-routing service that receives Macie's classification findings and can trigger downstream notifications. The other options are access-control, audit-logging, or storage-policy constructs, not notification mechanisms.

Answer

IAM User Permission

Answer

CloudTrail Log

Answer

S3 Policy

Question 13

Which THREE attributes are typically included in a 'Privacy Metadata' schema to support automated data governance?

Accepted Answer

Data owner identifier. Option A (Data owner identifier) is correct because privacy metadata schemas must record the accountable party (person or role) responsible for the data, enabling automated governance workflows such as access approvals, policy enforcement, and incident routing. Option C (Data retention policy) is correct because retention rules define how long data may be kept and when it must be deleted or archived, which automated governance tools use to trigger lifecycle actions and enforce compliance (e.g., GDPR storage limitation). Option E (Data classification label) is correct because classification (e.g., Public, Internal, Confidential, PII) drives automated handling rules such as encryption, masking, access control, and DLP policies. Option B (Database server IP) is not a privacy metadata attribute; it is infrastructure/asset metadata used for network or inventory purposes, not for describing privacy characteristics of the data. Option D (System uptime monitor) is unrelated operational telemetry about availability, not privacy governance metadata.

Answer

Database server IP

Answer

System uptime monitor

Question 14

Which technique should be used to protect personal data during software testing?

Accepted Answer

Data masking or using synthetic data sets.. Data masking and synthetic data sets protect personal data during testing by ensuring testers work with realistic but non-identifiable or fabricated records. Masking replaces sensitive fields (names, SSNs, card numbers) with fictitious values while preserving format and referential integrity, and synthetic data is generated from scratch so no real individual is represented. This satisfies privacy principles like data minimization and purpose limitation because production PII is never exposed in lower-trust test environments.

Answer

Implementing strict multi-factor authentication for developers.

Answer

Full encryption of the test database.

Answer

Restricting the test environment access to only senior engineers.

Question 15

A multinational retailer is implementing a new customer loyalty program that collects purchase history, location data, and device identifiers. The privacy team must determine the lawful basis for processing under the GDPR. The program requires customers to agree to share data with third-party marketing partners. Which lawful basis is most appropriate for this processing activity?

Accepted Answer

Consent. The correct basis is consent because the processing involves sharing personal data with third-party marketing partners, which is not necessary for contract performance or legal compliance, and legitimate interests would likely be overridden by data subject rights. Consent ensures individuals have control over their data and is explicitly required when data is used for marketing beyond the original purpose.

Answer

Legitimate interests

Answer

Contractual necessity

Answer

Legal obligation

ISACA Certified Data Privacy Solutions Engineer CDPSE practice test

Three ways to study

Study CDPSE by domain

Study CDPSE by topic

Privacy Engineering practice questions

Privacy Governance practice questions

Privacy Risk Management And Compliance practice questions

Data Life Cycle Management practice questions

CDPSE fundamentals practice questions

CDPSE scenario practice questions

CDPSE troubleshooting practice questions

ISACA Certified Data Privacy Solutions Engineer (CDPSE) (CDPSE) practice questions