ISACA CDPSE — Certified Data Privacy Solutions Engineer

Question 1

A retailer has accumulated 10 years of customer transaction records that must be kept indefinitely for trend analysis, but legal counsel wants to remove these records from the scope of data subject access requests and erasure obligations under applicable privacy law. The analytics team still requires the ability to study aggregate purchasing patterns over time but does NOT need to re-link records to any individual. Which data persistence technique best satisfies both the legal goal and the analytics requirement?

Accepted Answer

Anonymize the records so that individuals can no longer be identified directly or indirectly, retaining only aggregate-usable data

Answer

Pseudonymize the records by replacing customer identifiers with tokens stored in a separately secured mapping table

Answer

Encrypt the transaction records at rest with a strong key managed by the security team

Answer

Apply a longer retention schedule and restrict access to the analytics team via role-based access controls

Question 2

A healthcare analytics platform stores patient records used by multiple internal teams: clinical staff need full records for treatment, while a marketing team wants access to demographic fields for outreach campaigns. The privacy engineer is designing an access model that enforces purpose limitation at the data layer so that even authorized users can only retrieve fields consistent with their stated processing purpose. Which access control approach BEST enforces this requirement technically?

Accepted Answer

Implement attribute-based access control (ABAC) with policies that evaluate user role, data-field sensitivity tags, and declared processing purpose before granting field-level access

Answer

Grant both teams read access to the full record set and rely on an acceptable-use policy prohibiting out-of-purpose access

Answer

Create a single 'analytics' role with broad read permissions and log all queries for after-the-fact review by the privacy office

Answer

Encrypt the entire patient record at rest and distribute the decryption key to both the clinical and marketing teams

Question 3

A privacy engineer reviewing a company's website discovers that a third-party script collects the user's canvas rendering output, installed fonts, screen resolution, and hardware concurrency, then hashes these values into a persistent identifier used to recognize returning visitors—even after cookies are cleared. The site's consent banner only governs cookie storage. Which action best addresses the underlying privacy concern?

Accepted Answer

Extend the consent management platform to gate the fingerprinting script behind explicit consent, treating device fingerprinting as a tracking technology subject to the same lawful-basis and preference controls as cookies

Answer

Add the fingerprinting script's domain to the site's Content Security Policy allowlist so it loads reliably across browsers

Answer

Rely on the browser's built-in anti-fingerprinting protections, since modern browsers randomize canvas output and no additional controls are required

Answer

Document the fingerprinting activity in the cookie policy text but continue loading the script by default because no cookies are being set

Question 4

A privacy engineer is designing a preference management platform for a global e-commerce site. Users can opt in or out of several distinct processing purposes (marketing email, personalized recommendations, third-party data sharing). Marketing wants a single "Accept All" toggle stored as one boolean to simplify the backend, arguing it reduces database complexity. What is the engineer's BEST design recommendation to support technical enforcement of privacy requirements?

Accepted Answer

Store each purpose as a separate, timestamped consent record with its own status, source, and version of the notice presented

Answer

Store a single aggregate boolean and infer individual purpose consent from the user's account creation date

Answer

Store consent only in the user's browser cookie so no server-side records need to be maintained

Answer

Store the aggregate boolean now and add granular fields later only if a regulator requests evidence

Question 5

A retail company is migrating from client-side JavaScript tags to a server-side tagging architecture, where a single first-party endpoint receives events from browsers and then forwards them to marketing, analytics, and advertising vendors. The privacy engineer must ensure that a user's declined consent for advertising still prevents advertising vendors from receiving data. Which design approach BEST enforces the user's consent decision in this architecture?

Accepted Answer

Propagate the user's granular consent state to the server-side container and configure per-purpose forwarding rules that suppress vendor calls when the corresponding consent is absent

Answer

Rely on each downstream vendor to honor a consent flag included in the forwarded payload according to its own contractual commitments

Answer

Continue collecting all events at the server endpoint and apply consent filtering in a nightly batch job before data is used for advertising

Answer

Set browser cookies with a shortened expiration for users who decline advertising so that vendor tags naturally stop firing

Question 6

A privacy engineer is designing at-rest encryption for a data lake holding sensitive customer records across multiple business units. Compliance requires that a compromise of the storage layer alone must not expose plaintext, and that cryptographic keys never reside in the same trust boundary as the encrypted data. Which design choice BEST satisfies these requirements?

Accepted Answer

Store the data encryption keys in a hardware security module (HSM) managed under a separate key management service outside the storage platform's trust boundary

Answer

Encrypt each dataset with a unique key and store those keys in a protected configuration file on the same storage cluster

Answer

Enable the storage platform's built-in transparent disk encryption using keys the platform generates and retains internally

Answer

Hash the sensitive fields with a salted SHA-256 function before writing them to the data lake

Question 7

A privacy solutions engineer is helping a healthcare analytics company build its data life cycle program. The company handles a mix of marketing contact lists, employee HR records, and patient clinical data. Leadership wants a foundational mechanism that will drive consistent handling — such as encryption strength, access restrictions, and retention periods — as each dataset moves through collection, processing, and disposal. What should the engineer establish FIRST to enable these differentiated controls across the data life cycle?

Accepted Answer

A data classification scheme with defined sensitivity tiers and associated handling requirements

Answer

An automated retention and disposal engine applied uniformly to all datasets

Answer

A data loss prevention (DLP) tool configured with regular-expression pattern matching

Answer

A consent management platform to capture individual preferences at collection

Question 8

A retail company's mobile app initially collects only an email address to create an account, with the stated purpose of order confirmation. Over the following months, the product team wants to progressively collect additional data (birthdate, purchase preferences, location) as users interact with new features, to power a personalized recommendation engine. As the privacy engineer advising on the data life cycle, what is the MOST appropriate control to embed before this progressive collection begins?

Accepted Answer

Ensure each new data element is tied to a specific, disclosed purpose and a corresponding lawful basis before it is collected at the relevant interaction point

Answer

Collect all the additional data elements at account creation so consent only needs to be obtained once, simplifying the user experience

Answer

Rely on the existing account-creation consent, since the user already agreed to the privacy policy when signing up

Answer

Defer any privacy analysis until the recommendation engine is fully built, then apply de-identification to the aggregated dataset

Question 9

A privacy engineer is reviewing a new marketing web form before launch. The business wants to capture as much prospect information as possible for future campaigns, so the form currently includes 22 fields, including date of birth, household income, and national ID number. The stated purpose is to send prospects an email newsletter and occasional product offers. Which action best aligns the form design with the data minimization and collection limitation principles?

Accepted Answer

Reduce the form to only the fields required to deliver the newsletter and offers (such as email and name), and remove or make truly optional any field not needed for that stated purpose

Answer

Keep all 22 fields but add a consent checkbox stating that data may be used for future undefined marketing purposes

Answer

Keep all 22 fields but encrypt the national ID and household income values at rest to protect the sensitive data

Answer

Keep all 22 fields and add a retention schedule that deletes the excess data after 24 months

Question 10

A privacy engineer is reviewing an online registration form for a new loyalty program. The business purpose is limited to sending members promotional offers and tracking reward points. The current form collects name, email, home address, date of birth, mobile number, national ID number, and household income. The marketing team insists all fields are 'useful for future analytics we might do.' Which action BEST aligns the form with the collection limitation principle?

Accepted Answer

Remove fields not necessary for the stated loyalty purpose, collecting only name, email, and the minimum needed to administer rewards

Answer

Retain all fields but encrypt the national ID and income data at rest to reduce exposure risk

Answer

Keep all fields but add a broad consent checkbox permitting use for any future analytics purposes

Answer

Mark national ID and income as optional while retaining all fields on the form

Question 11

A fitness app product team wants to add a new feature that recommends nearby running routes. The proposed design requests continuous background access to precise GPS location, the device contact list, microphone, and calendar entries. As the data privacy solutions engineer reviewing the collection design against the data life cycle principle of collection limitation, which recommendation should you make?

Accepted Answer

Restrict collection to coarse location gathered only while the feature is in active use, and remove the contacts, microphone, and calendar access that are not necessary for route recommendations

Answer

Approve all requested data elements because broad collection improves recommendation accuracy and can be retained for future analytics

Answer

Allow all requested access but obtain a single blanket consent covering every permission at first app launch

Answer

Collect all requested elements now but pseudonymize the identifiers so the excess collection is compliant

Question 12

A customer submits a valid erasure request, and the privacy team confirms the individual's personal data must be deleted from production systems. During execution, the data engineer notes that the same records also exist in encrypted backup tapes that are retained for 90 days on a rolling cycle for disaster recovery. Immediately overwriting the backups would break the recovery chain and violate the organization's business continuity obligations. What is the MOST appropriate way to handle the personal data residing on the backup media?

Accepted Answer

Delete the data from production, place the backup copies beyond further processing use, and allow them to be securely destroyed when the backup cycle expires

Answer

Restore each backup tape, delete the individual records, and re-create the backups to ensure immediate erasure across all copies

Answer

Deny the erasure request for the backup copies because disaster recovery constitutes a legitimate exemption from all deletion obligations

Answer

Retain the backups indefinitely but pseudonymize the individual's records so they can no longer be readily identified

Question 13

A privacy solutions engineer must decommission a customer's data from a multi-tenant SaaS platform where all tenants' encrypted records share the same underlying storage volumes and backup sets. The customer contract requires that their personal data be rendered permanently unrecoverable within 30 days of termination, but physical media cannot be destroyed because other active tenants' data resides on the same volumes. Which approach BEST satisfies the destruction requirement?

Accepted Answer

Cryptographic erasure by securely destroying the tenant-specific encryption keys, provided each tenant's data is encrypted with distinct keys

Answer

Overwrite the storage volumes with multiple passes of random data during the next scheduled maintenance window

Answer

Delete the tenant's database records and remove references from the application index

Answer

Retain the tenant's encrypted data indefinitely and rely on access controls to prevent retrieval

Question 14

A financial services firm is decommissioning several on-premises servers containing customer personal data on solid-state drives (SSDs). The IT team proposes running a multi-pass overwrite utility, the same procedure historically used on the firm's magnetic hard drives, to sanitize the SSDs before the servers are sold to a refurbisher. As the privacy solutions engineer reviewing the disposal plan, what is your MOST important concern?

Accepted Answer

Multi-pass overwriting is unreliable on SSDs because wear-leveling and over-provisioning can leave recoverable data in cells the utility cannot address, so a media-appropriate sanitization method should be used

Answer

A single overwrite pass would be sufficient, so the multi-pass approach wastes time and delays the sale to the refurbisher

Answer

The servers should be retained internally rather than sold, since any reuse of the hardware creates unacceptable privacy risk

Answer

The disposal plan should focus on encrypting the drives before sale rather than sanitizing them

Question 15

A retailer terminates a contract with a cloud-based marketing analytics processor that held several million customer records. The contract requires the processor to destroy all personal data upon termination. As the data privacy solutions engineer, what is the MOST important action to ensure the disposal obligation is actually met?

Accepted Answer

Obtain a certificate of destruction and evidence covering all data locations, including backups and replicas, and verify it against the data flow inventory

Answer

Rely on the standard contractual destruction clause, since the processor is legally bound to comply

Answer

Request that the processor return all records to the retailer before deleting its own copies

Answer

Immediately revoke the processor's API credentials and consider the data disposed

Question 16

A privacy engineer maintains data flow diagrams for a customer analytics platform. The platform team has just integrated a new third-party enrichment API that appends demographic attributes to existing customer records before they are loaded into the warehouse. The enrichment adds no new source systems, but the data now includes attributes not present in the original collection. What should the privacy engineer do FIRST to keep the data mapping accurate and support downstream lifecycle controls?

Accepted Answer

Update the data flow diagram to reflect the new enrichment step, the added attribute categories, and the resulting change in data elements flowing into the warehouse

Answer

Schedule the change for the next annual data mapping refresh since no new source systems were added

Answer

Immediately delete the enriched demographic attributes because they were not part of the original collection

Answer

Notify affected customers that additional attributes are now stored before documenting the change internally

Question 17

A privacy solutions engineer is reviewing a newly created data flow diagram for a customer loyalty program. The diagram accurately depicts systems, storage locations, and cross-border transfers. However, during review the engineer notices that one downstream analytics platform receives transaction data that was originally collected only to process reward redemptions. What is the engineer's MOST important next action based on this observation?

Accepted Answer

Determine whether the analytics use is compatible with the original collection purpose and whether an appropriate legal basis exists

Answer

Update the data flow diagram to add the analytics platform as an approved recipient so the documentation stays current

Answer

Encrypt the transaction data in transit to the analytics platform to reduce the risk of interception

Answer

Increase the retention period for the analytics platform to support longer-term trend reporting

Question 18

During a review of a retailer's website, a privacy solutions engineer discovers that the current data flow diagrams do not reflect several third-party JavaScript tags (advertising and analytics pixels) that transmit visitor identifiers to external vendors. Marketing added these tags directly through the tag manager without notifying privacy or IT. What is the MOST important reason to update the data flow diagrams to capture these tags before taking other action?

Accepted Answer

Undocumented client-side data flows represent unmapped disclosures of personal data to processors and third parties that must be understood to assess purpose, legal basis, and downstream controls

Answer

The diagrams must show every technology component to satisfy software asset management inventories

Answer

Tag managers slow page load times and the diagrams help identify performance bottlenecks

Answer

The diagrams are needed to renegotiate the advertising vendor contracts at a lower cost

Question 19

A privacy engineer is asked to update the organization's data flow diagrams for a customer relationship management (CRM) platform before a new marketing analytics initiative launches. During the mapping exercise, the engineer discovers that a subprocessor replicates a copy of customer records to a data center in a third country that is not documented in the current record of processing activities or any transfer mechanism. What should the privacy engineer do FIRST?

Accepted Answer

Document the newly identified data flow and undocumented cross-border transfer in the data map, then escalate the finding so a lawful transfer mechanism and risk assessment can be evaluated

Answer

Immediately instruct the subprocessor to delete all replicated records in the third country to eliminate the exposure

Answer

Proceed with the marketing analytics launch since the transfer predates the new initiative and is outside its scope

Answer

Add an encryption control to the replicated data set so the transfer no longer requires a lawful basis

Question 20

A privacy engineer is reviewing a new customer notification service that emails users about account activity. The service currently includes the customer's full account number and recent transaction amounts directly in the email body to reduce support calls. Email is sent over standard SMTP to whatever mail provider the customer uses. Which design change BEST addresses the privacy risk while preserving the notification's usefulness?

Accepted Answer

Remove the full account number and transaction details from the email body and instead notify the user of activity with a secure link requiring authentication to view details

Answer

Enforce opportunistic TLS on outbound SMTP connections and keep the account number and transaction amounts in the email body

Answer

Encrypt the entire email body with the company's public key so only the company can decrypt stored copies

Answer

Add a disclaimer to the email footer stating that the message may contain confidential information intended only for the recipient

Question 21

A privacy engineer reviews a microservices architecture where dozens of internal services exchange personal data over the corporate network. The team argues that because the traffic never leaves the internal data center, TLS between services is unnecessary and adds latency. A recent internal penetration test demonstrated that an attacker who compromised one host could passively capture plaintext personal data flowing between other services. Which recommendation best addresses the identified privacy risk while aligning with a defense-in-depth approach?

Accepted Answer

Implement mutual TLS (mTLS) for all service-to-service communication so personal data in transit is encrypted and endpoints are mutually authenticated

Answer

Rely on network segmentation and firewall rules to isolate services carrying personal data, since encryption of internal traffic is optional within a trusted zone

Answer

Encrypt personal data only at the perimeter gateway and leave internal service traffic in plaintext to preserve performance

Answer

Apply full-disk encryption on each service host to protect the personal data that transits between services

Question 22

A privacy engineer is hardening a mobile banking app that transmits personal financial data to backend APIs over TLS. During a threat assessment, the team identifies that attackers on compromised or corporate-proxied networks could present fraudulent certificates trusted by the device's OS trust store, enabling interception of personal data. Which technical control most directly mitigates this specific interception risk at the mobile endpoint?

Accepted Answer

Certificate pinning that validates the server certificate or public key against a known set bundled in the app

Answer

Upgrading the TLS cipher suites to enforce AES-256-GCM and forward secrecy

Answer

Encrypting the personal data payload at rest on the device using the platform keystore

Answer

Requiring step-up biometric authentication before the app calls sensitive backend APIs

Question 23

A privacy solutions engineer is establishing the organization's first enterprise data inventory to support Data Life Cycle Management. During initial interviews, several business units confirm they store customer personal data in departmentally-provisioned SaaS tools and local spreadsheets that were never registered with IT. Which action should the engineer take FIRST to ensure the data inventory accurately reflects where personal data resides?

Accepted Answer

Perform automated data discovery and network scanning to detect unregistered repositories and reconcile results against the self-reported inventory

Answer

Require each business unit to sign an attestation that all personal data has been disclosed before finalizing the inventory

Answer

Block all unsanctioned SaaS applications at the network firewall to force data back into approved systems

Answer

Apply the organization's data classification scheme to the repositories that have already been reported

Question 24

A privacy engineer is building the organization's first data inventory to support Data Life Cycle Management. The engineering team has already catalogued each data store with system name, hosting location, data owner, and the categories of personal data held. During review, the DPO notes that the inventory cannot be used to enforce retention limitation or purpose limitation because a critical attribute is missing. Which attribute should be added to each inventory entry to MOST directly enable these controls?

Accepted Answer

The documented processing purpose and associated legal basis for each data category

Answer

The encryption algorithm and key length applied to each data store

Answer

The total storage volume and monthly growth rate of each data store

Answer

The vendor SLA and uptime guarantee for each hosting environment

Question 25

A privacy engineer at a fast-growing fintech company established a data inventory 18 months ago as a one-time project. Since then, the company launched three new mobile products, acquired a competitor, and migrated several systems to the cloud. During a recent regulatory inquiry, the company could not accurately identify all systems processing customer financial data. Which action would MOST effectively prevent this problem from recurring?

Accepted Answer

Establish a process that automatically updates the data inventory whenever change-management, procurement, and system-onboarding events occur

Answer

Schedule a comprehensive manual re-inventory of all systems every three years to capture accumulated changes

Answer

Encrypt all databases containing customer financial data so their contents are protected during inquiries

Answer

Require each business unit to sign an annual attestation confirming they have not acquired any new systems

Question 26

A support team needs read access to a production customer database to troubleshoot live issues, but they should not see full national ID numbers or full payment card numbers. The privacy engineer must ensure that the underlying stored data remains intact and fully usable by billing batch jobs, while support staff only ever see obscured values based on their role. Which technical control best meets these requirements?

Accepted Answer

Apply dynamic data masking so sensitive fields are obfuscated at query time based on the requesting user's role, without altering stored values

Answer

Statically mask the entire production database so all sensitive fields are permanently replaced with fictitious values

Answer

Encrypt the sensitive columns at rest and grant the support team the decryption keys for troubleshooting

Answer

Replace the sensitive fields with tokens stored in a vault and give support staff access to the detokenization service

Question 27

A privacy engineer is supporting a project that migrates customer records from an on-premises order-management system into a new SaaS platform. During the extract-transform-load (ETL) process, the team discovers that several free-text 'notes' fields in the legacy system contain embedded personal data (e.g., health remarks, alternate contact details) that were never part of the documented data model. What should the privacy engineer recommend FIRST before the load step proceeds?

Accepted Answer

Assess the embedded personal data against the migration's documented purpose and lawful basis, then transform or exclude fields that fall outside the approved scope

Answer

Load all fields as-is to preserve data integrity, and schedule a post-migration data quality review to clean up the notes fields later

Answer

Encrypt the entire notes column during transit and at rest so the undocumented personal data is protected in the new platform

Answer

Pseudonymize the notes fields by tokenizing all free-text values before loading them into the SaaS platform

Question 28

A retail company is migrating customer records from an aging on-premises CRM to a new cloud-based data warehouse that will support both operations and analytics. The legacy CRM has accumulated 15 years of records, including many inactive accounts, duplicate entries, and free-text notes fields containing sensitive personal data collected under purposes that no longer apply. The project manager wants to lift-and-shift all records as-is to meet the migration deadline, then clean up later. As the privacy solutions engineer, what should you recommend FIRST?

Accepted Answer

Apply data minimization and quality controls before migration by filtering out records that exceed retention limits or lack a current lawful purpose, and remediating duplicate and unnecessary data

Answer

Proceed with the full lift-and-shift to meet the deadline, since data quality and minimization can be addressed after the warehouse is operational

Answer

Encrypt all records in transit and at rest during migration, which satisfies the privacy obligations for the legacy dataset

Answer

Migrate all records but restrict analytics access to the warehouse to authorized personnel only

Question 29

A privacy engineer is reviewing the design of a new mobile analytics SDK before release. The product team wants each event payload to include the user's full device identifier, precise account email, and raw GPS coordinates so that the analytics team can 'have everything available in case a future question comes up.' The stated business need is only to measure feature adoption rates by broad region and by whether a user is on a free or paid plan. Which design change best applies the privacy engineering principle at stake?

Accepted Answer

Send a pseudonymous session token instead of the email, replace raw GPS with a coarse region code, and drop the device identifier, so only the region and plan tier remain in the payload

Answer

Encrypt the full event payload at rest and restrict analytics table access to named analysts via role-based controls

Answer

Collect all fields as requested but add a retention timer that purges the raw analytics events after 24 months

Answer

Obtain explicit consent from users to collect the full identifiers, email, and precise GPS coordinates before the SDK transmits any event

Question 30

A data privacy solutions engineer discovers that a marketing analytics team routinely exports customer datasets from the production data warehouse into ad-hoc spreadsheets and personal cloud drives to build campaign models. Each export creates uncontrolled copies of personal data that persist indefinitely, outside any retention schedule or access control. Which action should the engineer prioritize to address the underlying data persistence risk?

Accepted Answer

Provide analysts a governed analytics environment where queries run against controlled datasets without exporting raw personal data, and disable local export capability

Answer

Encrypt all exported spreadsheets and personal cloud drive folders used by the marketing team

Answer

Issue a policy reminder instructing analysts to delete exported files within 30 days of use

Answer

Increase the retention period in the data warehouse so analysts do not need to keep local copies

Question 31

A privacy solutions engineer reviews a company's data storage strategy. Active customer records are kept in a high-performance database, while records inactive for over two years are automatically moved to a low-cost cold storage tier. During the review, the engineer finds that cold storage retains records indefinitely because the archival process was designed only to reduce storage cost, with no linkage to the customers' original retention requirements. What is the engineer's BEST recommendation to align this persistence practice with privacy principles?

Accepted Answer

Integrate the retention schedule into the archival process so records in cold storage are disposed of when their retention period expires

Answer

Encrypt all cold storage archives to protect the indefinitely retained records

Answer

Move the cold storage archives to an even lower-cost tier to further reduce persistence expenses

Answer

Restrict access to the cold storage tier to a limited set of administrators

Question 32

A privacy engineer is designing the data-subject data portability feature for a SaaS HR platform. The regulation requires that individuals be able to receive their personal data and transmit it to another controller without hindrance. The product team proposes exporting each individual's records as a rendered PDF report because it is easy to generate from the existing reporting module. What is the engineer's BEST response to satisfy the portability requirement?

Accepted Answer

Require the export to be in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so the data can be reused and transmitted to another controller.

Answer

Accept the PDF because it contains all the individual's personal data and is human-readable.

Answer

Provide the PDF but add an option to encrypt it with the individual's password to ensure security during transfer.

Answer

Export only aggregated summary statistics to minimize the personal data disclosed in the portability response.

Question 33

A privacy engineer is reviewing a customer loyalty program that has operated for eight years. Analysis shows many customer records contain outdated addresses, duplicate profiles for the same individual, and email fields populated with placeholder values entered by staff to bypass mandatory field validation. Marketing is using this data to send personalized offers, and several complaints have arisen because offers were sent to wrong recipients. Which action best addresses the underlying privacy principle at risk?

Accepted Answer

Implement data quality controls including validation rules, de-duplication routines, and periodic accuracy verification against authoritative sources

Answer

Encrypt the loyalty database at rest to protect the personal data from unauthorized disclosure

Answer

Shorten the retention period for loyalty records so stale data is purged more frequently

Answer

Obtain fresh marketing consent from all loyalty members before sending further offers

Question 34

A healthcare provider shares patient records with a downstream research partner for approved secondary analytics. Several months later, patients file corrections to their contact and diagnosis data with the provider. The research partner continues to process the original, uncorrected copies. As the privacy solutions engineer, which control should you prioritize to address the data quality obligation across the data lifecycle?

Accepted Answer

Establish a downstream propagation mechanism that pushes approved corrections to all parties holding shared copies within defined timeframes

Answer

Require the research partner to independently re-verify all patient data with each individual before every analysis run

Answer

Encrypt the shared research dataset at rest and in transit to protect the integrity of the records

Answer

Shorten the retention period for the research dataset so outdated records are disposed of more quickly

Question 35

A subscription streaming company retains customer payment card details, viewing history, and account credentials indefinitely. During a privacy review, the data privacy engineer finds that former customers who canceled their subscriptions more than three years ago still have all of this data stored in the active production database. The finance team argues the payment records may be useful for future win-back marketing campaigns. Which action best aligns the company with the data retention limitation principle?

Accepted Answer

Establish retention periods tied to the specific purpose each data category serves, and securely dispose of or de-identify data once its purpose has been fulfilled and no legal obligation requires its retention

Answer

Move all former-customer records to an encrypted cold-storage archive so the production database performs better while the data remains available indefinitely for potential marketing

Answer

Retain all data indefinitely but restrict access to former-customer records to the marketing team only, documenting the win-back purpose in the data inventory

Answer

Keep the data until a former customer submits an erasure request, since retaining data is permissible until an individual objects

Question 36

A privacy engineer is designing retention rules for a customer loyalty program. The marketing team wants to keep all transaction and profile data indefinitely 'in case it's useful later.' Legal requires financial records be kept 7 years, and the program's stated purpose is delivering rewards based on the last 24 months of activity. What is the BEST approach to defining the retention schedule?

Accepted Answer

Set retention periods per data category tied to the specific purpose each category serves, applying the longest legally required period only to data with a binding legal obligation

Answer

Adopt a single organization-wide retention period of 7 years for all loyalty data to simplify enforcement and satisfy the legal requirement

Answer

Retain all data indefinitely but restrict marketing access to records older than 24 months to honor the program purpose

Answer

Delete all loyalty data after 24 months since that is the program's stated operational purpose

Question 37

A retail company wants to share a customer transaction dataset with an external marketing analytics partner to build predictive models. The dataset includes names, email addresses, purchase history, and loyalty IDs. Legal has confirmed a valid legal basis exists, and a data processing agreement is in place. As the privacy engineer, what is the MOST important control to implement before transmitting the dataset to the partner?

Accepted Answer

Apply pseudonymization or field-level de-identification to remove direct identifiers not required for the modeling purpose, then transmit only the necessary attributes over an encrypted channel

Answer

Encrypt the full dataset at rest and in transit while transmitting all fields, since the DPA legally binds the partner to protect the data

Answer

Require the partner to sign an additional non-disclosure agreement before any data is shared

Answer

Transmit the complete dataset and rely on the partner's contractual obligation to delete unused fields after modeling is complete

Question 38

A privacy solutions engineer is designing controls for a customer-support platform that routinely shares subsets of customer records with an outsourced analytics team. During a review, the engineer finds that once records are exported to the analytics environment, there is no reliable way to determine who accessed which records, when, or for what stated purpose. The business wants to preserve the sharing arrangement but demonstrate accountability over the shared data. Which control should the engineer prioritize to close this gap?

Accepted Answer

Implement immutable access and processing logs in the analytics environment that record the identity, timestamp, records accessed, and processing purpose

Answer

Encrypt the exported records at rest in the analytics environment using organization-managed keys

Answer

Require the analytics team to sign a data processing agreement with confidentiality obligations before each export

Answer

Reduce the number of attributes shared with the analytics team to the minimum needed for the analysis

Question 39

A privacy engineer is designing the technical workflow to fulfill data subject access requests (DSARs) across a company's microservices architecture, where personal data about a single individual is distributed across a CRM, a support ticketing system, a marketing platform, and multiple event-logging databases keyed on different identifiers. The compliance team requires that responses be complete within the statutory deadline and include all data associated with the requester. Which design approach BEST ensures accurate and complete DSAR fulfillment?

Accepted Answer

Implement an identity resolution layer that maps the requester's disparate system identifiers, then orchestrate automated collection queries against each mapped data store

Answer

Query only the CRM as the authoritative system of record, since it contains the master customer profile linked to all other systems

Answer

Export full database dumps from each system to a central location and manually search for the requester's email address each time a request arrives

Answer

Rely on each system owner to receive DSAR notifications by email and independently return whatever data they believe is relevant

Question 40

A privacy engineer is designing the erasure workflow for a customer platform that uses a primary relational database plus a separate Elasticsearch cluster to power full-text search. When a validated deletion request is processed, records are removed from the relational database, but testing shows that deleted customers' names and email addresses remain returnable through the search interface for several hours. Which design change BEST ensures the erasure obligation is technically enforced across the system?

Accepted Answer

Make the search index deletion part of the same erasure transaction/orchestration so both stores are updated as a single completed operation before the request is marked fulfilled

Answer

Rely on the next full nightly reindex job to eventually remove the stale documents from the search cluster

Answer

Encrypt the search index at rest so that residual personal data is protected until it is overwritten

Answer

Add a legal disclaimer to the search UI stating that recently deleted records may still appear temporarily

Question 41

A privacy engineer reviewing a data governance program finds that a customer analytics data set is stored in a cloud data warehouse managed by the IT infrastructure team, populated by the marketing department, and analyzed by the data science team. When a data subject requests deletion of their personal data, no group takes responsibility for authorizing and executing the deletion, and each team points to the others. Which action would BEST address the underlying governance gap?

Accepted Answer

Formally designate a data owner accountable for the data set's use, access decisions, and lifecycle actions

Answer

Assign the IT infrastructure team as the data custodian responsible for all deletion requests

Answer

Require the privacy office to execute all data subject deletion requests directly

Answer

Encrypt the data set so that deletion requests can be fulfilled by destroying the encryption keys

Question 42

A retail company collected customer purchase histories to fulfill orders and provide receipts. The data science team now wants to reuse this same dataset to train a machine learning model that predicts customer churn and targets retention offers. The original privacy notice listed only order fulfillment and customer service as processing purposes. As the privacy solutions engineer, what should you advise the team to do FIRST before proceeding?

Accepted Answer

Assess whether the churn-prediction use is compatible with the original collection purpose, and if not, establish a valid legal basis and update the notice before using the data

Answer

Pseudonymize the purchase histories so the model can be trained without further approvals

Answer

Allow the training to proceed since the data is already lawfully held by the company

Answer

Delete the dataset after the model is trained to satisfy retention limitation

Question 43

A retail analytics team wants to share a customer dataset with an external research firm to study purchasing trends. The team removes names, emails, and account numbers but retains ZIP code, birth date, and gender. A privacy engineer reviewing the plan is concerned the dataset may still permit re-identification. Which action BEST addresses the engineer's concern before the data is shared?

Accepted Answer

Apply generalization and suppression to the quasi-identifiers so the dataset meets a defined re-identification risk threshold (e.g., k-anonymity)

Answer

Encrypt the dataset in transit and require the research firm to sign a confidentiality agreement

Answer

Replace the ZIP code, birth date, and gender with reversible pseudonyms stored in a separate key vault

Answer

Add the direct identifiers back and rely on the research firm's access controls to limit exposure

Question 44

A retailer's analytics team wants an internal copy of customer transaction data to build purchasing-trend models. Business requirements state that analysts must never be able to identify individuals, yet the fraud investigation team must retain a controlled ability to re-link records back to specific customers when a confirmed fraud case is opened. As the privacy solutions engineer, which data transformation approach best satisfies both requirements?

Accepted Answer

Pseudonymize direct identifiers using a keyed tokenization scheme, storing the mapping key under strict access control available only to the fraud team, while giving analysts the pseudonymized dataset

Answer

Anonymize the entire dataset so no records can ever be re-linked, and require the fraud team to request original records from production when needed

Answer

Encrypt the identifier columns with a shared symmetric key distributed to both the analytics and fraud teams so either team can decrypt as necessary

Answer

Mask the identifiers with irreversible hashing (no salt) so the same customer always maps to the same value, allowing both teams to correlate records

Question 45

A health analytics team wants to release a public dashboard showing aggregate statistics (counts and averages) about patient populations across regions. Privacy engineering is concerned that analysts issuing many overlapping queries could reconstruct individual patient records from the aggregates over time. Which privacy-enhancing technique best addresses this specific reconstruction risk while still allowing useful aggregate reporting?

Accepted Answer

Apply differential privacy by injecting calibrated statistical noise into query results and enforcing a cumulative privacy budget across queries

Answer

Encrypt the underlying patient database at rest using AES-256 and restrict dashboard access with role-based access control

Answer

Pseudonymize patient identifiers by replacing them with tokens and storing the mapping key separately

Answer

Mask direct identifiers such as names and medical record numbers before loading data into the analytics warehouse

Question 46

A privacy solutions engineer reviews DPIAs completed by five different business units over the past year. Each unit used its own approach to rate privacy risks, and the resulting risk ratings vary widely for processing activities that involve similar data and similar risk exposure. Senior management cannot compare or prioritize the risks across units. What should the engineer recommend FIRST to address this problem?

Accepted Answer

Establish a standardized privacy risk assessment methodology with defined likelihood and impact criteria to be applied across all business units

Answer

Require all future DPIAs to be reviewed and re-scored solely by the central privacy office before submission to management

Answer

Mandate that each business unit purchase the same GRC tool to record its DPIA results

Answer

Increase the frequency of DPIAs so that more data points are available for comparison

Question 47

A privacy engineer completes a DPIA for a new AI-driven credit scoring platform that processes large volumes of financial data and produces automated decisions affecting individuals. After applying all feasible technical and organizational controls, the assessment shows that the residual risk to data subjects remains high. What should the privacy engineer recommend as the NEXT step before the processing begins?

Accepted Answer

Consult the relevant supervisory authority prior to commencing the processing

Answer

Document the residual risk in the risk register and accept it under the risk owner's authority

Answer

Proceed with the processing since all feasible controls have already been implemented

Answer

Obtain explicit consent from each affected data subject as the sole basis to proceed

Question 48

A privacy engineer is conducting a DPIA for a new employee wellness platform that will collect health-related biometric data through wearable devices. The DPIA has documented the processing operations, assessed necessity and proportionality, and identified several high risks to employees. Before finalizing the assessment and treatment plan, which action best strengthens the DPIA in accordance with recognized privacy risk management practice?

Accepted Answer

Seek the views of the affected employees or their representatives on the intended processing, where appropriate

Answer

Submit the DPIA directly to the supervisory authority for prior approval before any consultation

Answer

Have the CISO sign off on the encryption controls so the DPIA can be closed

Answer

Delay the DPIA until the platform is deployed so that real usage data can inform the risk ratings

Question 49

A retailer plans to deploy an AI-driven system that continuously analyzes in-store video feeds combined with loyalty-card purchase history to profile individual shoppers and predict future buying behavior at scale. The privacy engineer must advise the project team on the required first step before development proceeds. Which action is MOST appropriate?

Accepted Answer

Conduct a data protection impact assessment (DPIA) because the processing involves systematic, large-scale profiling likely to result in high risk to individuals

Answer

Proceed with development and perform a DPIA only if a data subject files a complaint about the profiling

Answer

Document the processing in the records of processing activities and rely on that as sufficient risk analysis

Answer

Obtain cyber-liability insurance to transfer the residual privacy risk before deployment

Question 50

A privacy engineer is designing encryption for a database that stores customers' personal data at rest. Compliance requires that individual data encryption keys can be rotated frequently without re-encrypting the entire multi-terabyte dataset, and that a single compromised key exposes the smallest possible data set. Which encryption architecture best satisfies these requirements?

Accepted Answer

Envelope encryption, where data encryption keys (DEKs) encrypt the records and are themselves encrypted by a periodically rotated key encryption key (KEK) held in a key management service

Answer

Full-disk encryption using a single symmetric key managed by the storage platform, rotated annually during a maintenance window

Answer

Application-layer encryption using one shared static symmetric key hardcoded in the application configuration for all records

Answer

Transparent Data Encryption (TDE) with the master key stored in the same database instance as the encrypted data

Question 51

A healthcare analytics platform stores patient records in a shared database. Data scientists need to run cohort analyses on diagnosis codes and treatment outcomes but must never access patient names, contact details, or national identifiers. The privacy engineer is designing the technical encryption controls. Which approach BEST enforces this privacy requirement while preserving analytical utility?

Accepted Answer

Apply field-level (column-level) encryption to the direct identifier fields with keys held by a separate key management service the analytics role cannot access, leaving diagnosis and outcome fields queryable

Answer

Enable full-database transparent data encryption (TDE) so all data is encrypted at rest and decrypted automatically for any authenticated user

Answer

Encrypt the entire patient table and grant data scientists the decryption key so they can decrypt only the records they need for each analysis

Answer

Rely on TLS encryption in transit between the analytics application and the database to protect the identifier fields during queries

Question 52

A healthcare analytics firm wants to outsource statistical computations on patient records to a third-party cloud service. The firm requires that the cloud provider be able to perform the computations without ever having access to the underlying plaintext values, and the results returned must be usable by the firm. Which privacy-enhancing technology BEST satisfies this requirement?

Accepted Answer

Homomorphic encryption, allowing computation directly on ciphertext

Answer

Format-preserving encryption applied to each record field before upload

Answer

Tokenization of the identifiers with a vault retained by the firm

Answer

TLS encryption of data in transit to the cloud provider

Question 53

A mobile banking app collects a user's precise location only at the moment they attempt to locate the nearest ATM. The product team wants to inform users about this specific use without overwhelming them with the full privacy policy. As the privacy engineer, which approach BEST satisfies the transparency requirement while preserving usability?

Accepted Answer

Present a just-in-time (contextual) notice at the point of location collection, explaining the specific purpose and linking to the full privacy policy

Answer

Require the user to scroll through and accept the entire privacy policy again before the ATM-locator feature loads

Answer

Rely on the initial notice shown at account registration, since the user already consented to the app's terms

Answer

Add a footnote about location use in the app's settings menu where users can find it if they look

Question 54

An internal privacy audit team is scheduled to assess whether the organization's data retention controls are operating effectively across three business units. Each unit has documented retention schedules and automated deletion jobs. The audit lead wants to provide the audit committee with assurance about how the controls actually perform in practice, not just whether they exist. Which approach will BEST support this assurance objective?

Accepted Answer

Select a sample of records past their retention period and test whether the automated deletion jobs actually purged them

Answer

Review the retention policy documents and confirm each business unit has signed off on the retention schedules

Answer

Interview the business unit managers to obtain their confirmation that deletion jobs are running as scheduled

Answer

Verify that deletion job scripts are configured with the correct retention parameters in the scheduling tool

Question 55

A privacy solutions engineer is supporting an internal audit of data subject access request (DSAR) handling across a large customer service organization that processes thousands of requests monthly. The auditor wants to conclude whether the DSAR control is operating effectively throughout the audit period, but the team lacks the time to review every request. What is the MOST appropriate approach for gathering audit evidence?

Accepted Answer

Select a statistically representative sample of DSARs from across the entire audit period and test them against the control's requirements

Answer

Review only the DSARs that were escalated as complaints, since those represent the highest-risk cases

Answer

Rely on management's self-assessment attestation that all DSARs were completed within the required timeframe

Answer

Examine the most recent 10 DSARs processed to confirm the control is currently functioning

Question 56

A privacy audit conducted six months ago identified several control deficiencies in a company's marketing data platform. Management submitted remediation plans and reported that all corrective actions are now complete. As the privacy solutions engineer supporting the audit function, what is the MOST important action to take before closing the audit findings?

Accepted Answer

Independently test the implemented controls to verify that the remediation is operating effectively

Answer

Accept management's completion attestation and formally close the findings in the audit tracking system

Answer

Schedule a full re-audit of the entire marketing data platform to reassess all risks

Answer

Update the risk register to reflect that residual risk has been reduced to an acceptable level

Question 57

A privacy manager plans an audit of a critical cloud payroll processor that handles employee personal data on the organization's behalf. When defining the audit scope, the processor's contract states that on-site inspections are limited to once per year with 30 days' notice, and the processor offers an independent SOC 2 Type II report and ISO 27701 certificate as alternatives. What should the privacy manager do FIRST to ensure the audit provides adequate assurance over the processor's privacy controls?

Accepted Answer

Determine the assurance objectives and required control coverage, then assess whether the third-party reports satisfy them before deciding if an on-site audit is needed

Answer

Reject the third-party reports and insist on exercising the contractual on-site inspection right immediately

Answer

Accept the SOC 2 Type II report and ISO 27701 certificate as sufficient assurance without further review

Answer

Renegotiate the contract to allow unlimited on-site inspections before conducting any assessment

Question 58

A privacy officer at a multinational insurer has rolled out mandatory annual privacy awareness training to all employees. Twelve months later, senior management asks for evidence that the training is actually reducing privacy risk within the organization. Completion rates are consistently above 98%. Which of the following would BEST demonstrate the effectiveness of the privacy awareness program?

Accepted Answer

A downward trend in employee-caused privacy incidents combined with phishing and mishandling simulation results

Answer

The percentage of employees who completed the training and passed the end-of-course quiz

Answer

The number of training modules published and the frequency with which content is updated

Answer

Positive employee satisfaction survey scores collected immediately after each training session

Question 59

A privacy engineer is designing a new microservice that ingests customer support chat transcripts. Product management has not yet decided how long transcripts should be kept, and wants to defer the retention decision until after launch to 'see how the data is used.' The engineer must configure the storage layer before go-live. Which approach BEST applies the privacy-by-default principle in this situation?

Accepted Answer

Configure the shortest defensible retention period tied to the stated support purpose and enforce automated deletion by default, adjusting only if a longer period is later justified and documented

Answer

Store transcripts indefinitely until product management finalizes a retention policy, then apply deletion retroactively

Answer

Retain transcripts for the maximum period allowed under the strictest applicable regulation to avoid accidental loss of needed data

Answer

Leave retention unlimited but restrict access to transcripts through role-based access controls until a policy is set

Question 60

A development team is building a new customer support portal. To support forensic investigations, they configure the application to capture full audit logs that include the complete request body of every user interaction, retained indefinitely by default. The privacy engineer reviewing the design notes that these request bodies frequently contain sensitive personal data such as health complaints and payment references. Applying privacy by design and privacy by default principles, what is the MOST appropriate recommendation?

Accepted Answer

Redact or exclude personal data fields from audit log payloads and set a defined retention period aligned to the forensic purpose

Answer

Keep the full-body logging but encrypt the log store and restrict access to the security team

Answer

Disable audit logging entirely to eliminate the risk of capturing personal data

Answer

Retain full logs but obtain broad consent from users covering all possible future forensic uses

Question 61

A social gaming company is launching a new mobile app that will be used by both adults and children. During design, the privacy engineering team must decide how to configure the default profile visibility and in-app chat features for newly created accounts before any age verification or parental consent is completed. Which configuration best applies privacy by default?

Accepted Answer

Set profiles to the most restrictive setting (private, chat disabled) by default until age and any required consent are established

Answer

Set profiles to public and enable open chat by default, then restrict features only after a user is confirmed to be a child

Answer

Prompt users to choose their own visibility and chat settings during onboarding, applying whatever they select

Answer

Enable all social features by default but display a privacy notice describing how to disable them

Question 62

A social networking platform is designing a new feature that lets users share posts publicly or with a limited audience. During privacy engineering review, the team must decide how the audience-selection control should behave when a user creates their first post and has not yet set any preference. Which configuration best satisfies the privacy by default principle?

Accepted Answer

Set the initial audience to the most restrictive option (e.g., 'Only me' or a limited connection list) until the user explicitly chooses to broaden it

Answer

Set the initial audience to 'Public' so users experience the platform's full network effect and can restrict later if desired

Answer

Present a mandatory blocking dialog requiring the user to accept a public-sharing default before the first post can be created

Answer

Randomly assign an audience setting per user to prevent predictable defaults that could be exploited by attackers

Question 63

A privacy engineer is designing a new internal REST API that will allow multiple downstream teams to request customer records. During architecture review, the engineer must decide how the API should behave when a calling service requests fields for which no specific access grant or documented purpose has been configured. Which design approach best embodies privacy by default?

Accepted Answer

Deny the fields by default and return only the attributes explicitly authorized for the caller's registered purpose

Answer

Return all available fields but log the access so unauthorized use can be reviewed after the fact

Answer

Return a masked version of every field so callers always receive a complete record structure

Answer

Return all fields for the first request and prompt the caller to confirm purpose on subsequent requests

Question 64

A privacy engineer is reviewing a new customer-facing payment application before launch. During testing, an invalid card submission returns a detailed error page that includes the full stack trace, the internal database table name, and the masked-but-partially-visible cardholder name and email that were submitted. The development team argues the verbose output is essential for troubleshooting production incidents. Applying privacy by design and privacy by default, what should the engineer recommend?

Accepted Answer

Suppress all personal data and internal system details from user-facing error responses by default, and route full diagnostic detail only to a secured, access-controlled logging system

Answer

Allow the verbose error output to remain in production but require users to accept a privacy notice before submitting the form

Answer

Keep the detailed error page but encrypt the personal data fields shown to the user so they cannot be read in transit

Answer

Retain the full error detail in production for the first 90 days after launch, then reduce verbosity once the application stabilizes

Exam domain	Exam weight	Practice
Privacy Governance	20%	Practice this topic
Privacy Risk Management and Compliance	18%	Practice this topic
Data Life Cycle Management	23%	Practice this topic
Privacy Engineering	39%	Practice this topic

ISACA CDPSE — Certified Data Privacy Solutions Engineer (CDPSE) practice exam & study guide

Start studying CDPSE

All CDPSE study resources

CDPSE exam domains

Sample CDPSE questions

Key CDPSE terms

CDPSE frequently asked questions

Privacy Governance (20%)

Privacy Risk Management and Compliance (18%)

Data Life Cycle Management (23%)

Privacy Engineering (39%)