Hard — CDPSE Practice Quiz

Question 1

A privacy engineer reviewing a company's website discovers that a third-party script collects the user's canvas rendering output, installed fonts, screen resolution, and hardware concurrency, then hashes these values into a persistent identifier used to recognize returning visitors—even after cookies are cleared. The site's consent banner only governs cookie storage. Which action best addresses the underlying privacy concern?

Accepted Answer

Extend the consent management platform to gate the fingerprinting script behind explicit consent, treating device fingerprinting as a tracking technology subject to the same lawful-basis and preference controls as cookies

Answer

Add the fingerprinting script's domain to the site's Content Security Policy allowlist so it loads reliably across browsers

Answer

Rely on the browser's built-in anti-fingerprinting protections, since modern browsers randomize canvas output and no additional controls are required

Answer

Document the fingerprinting activity in the cookie policy text but continue loading the script by default because no cookies are being set

Question 2

A retail company is migrating from client-side JavaScript tags to a server-side tagging architecture, where a single first-party endpoint receives events from browsers and then forwards them to marketing, analytics, and advertising vendors. The privacy engineer must ensure that a user's declined consent for advertising still prevents advertising vendors from receiving data. Which design approach BEST enforces the user's consent decision in this architecture?

Accepted Answer

Propagate the user's granular consent state to the server-side container and configure per-purpose forwarding rules that suppress vendor calls when the corresponding consent is absent

Answer

Rely on each downstream vendor to honor a consent flag included in the forwarded payload according to its own contractual commitments

Answer

Continue collecting all events at the server endpoint and apply consent filtering in a nightly batch job before data is used for advertising

Answer

Set browser cookies with a shortened expiration for users who decline advertising so that vendor tags naturally stop firing

Question 3

A customer submits a valid erasure request, and the privacy team confirms the individual's personal data must be deleted from production systems. During execution, the data engineer notes that the same records also exist in encrypted backup tapes that are retained for 90 days on a rolling cycle for disaster recovery. Immediately overwriting the backups would break the recovery chain and violate the organization's business continuity obligations. What is the MOST appropriate way to handle the personal data residing on the backup media?

Accepted Answer

Delete the data from production, place the backup copies beyond further processing use, and allow them to be securely destroyed when the backup cycle expires

Answer

Restore each backup tape, delete the individual records, and re-create the backups to ensure immediate erasure across all copies

Answer

Deny the erasure request for the backup copies because disaster recovery constitutes a legitimate exemption from all deletion obligations

Answer

Retain the backups indefinitely but pseudonymize the individual's records so they can no longer be readily identified

Question 4

A privacy solutions engineer must decommission a customer's data from a multi-tenant SaaS platform where all tenants' encrypted records share the same underlying storage volumes and backup sets. The customer contract requires that their personal data be rendered permanently unrecoverable within 30 days of termination, but physical media cannot be destroyed because other active tenants' data resides on the same volumes. Which approach BEST satisfies the destruction requirement?

Accepted Answer

Cryptographic erasure by securely destroying the tenant-specific encryption keys, provided each tenant's data is encrypted with distinct keys

Answer

Overwrite the storage volumes with multiple passes of random data during the next scheduled maintenance window

Answer

Delete the tenant's database records and remove references from the application index

Answer

Retain the tenant's encrypted data indefinitely and rely on access controls to prevent retrieval

Question 5

A privacy solutions engineer is reviewing a newly created data flow diagram for a customer loyalty program. The diagram accurately depicts systems, storage locations, and cross-border transfers. However, during review the engineer notices that one downstream analytics platform receives transaction data that was originally collected only to process reward redemptions. What is the engineer's MOST important next action based on this observation?

Accepted Answer

Determine whether the analytics use is compatible with the original collection purpose and whether an appropriate legal basis exists

Answer

Update the data flow diagram to add the analytics platform as an approved recipient so the documentation stays current

Answer

Encrypt the transaction data in transit to the analytics platform to reduce the risk of interception

Answer

Increase the retention period for the analytics platform to support longer-term trend reporting

Question 6

A privacy engineer is supporting a project that migrates customer records from an on-premises order-management system into a new SaaS platform. During the extract-transform-load (ETL) process, the team discovers that several free-text 'notes' fields in the legacy system contain embedded personal data (e.g., health remarks, alternate contact details) that were never part of the documented data model. What should the privacy engineer recommend FIRST before the load step proceeds?

Accepted Answer

Assess the embedded personal data against the migration's documented purpose and lawful basis, then transform or exclude fields that fall outside the approved scope

Answer

Load all fields as-is to preserve data integrity, and schedule a post-migration data quality review to clean up the notes fields later

Answer

Encrypt the entire notes column during transit and at rest so the undocumented personal data is protected in the new platform

Answer

Pseudonymize the notes fields by tokenizing all free-text values before loading them into the SaaS platform

Question 7

A data privacy solutions engineer discovers that a marketing analytics team routinely exports customer datasets from the production data warehouse into ad-hoc spreadsheets and personal cloud drives to build campaign models. Each export creates uncontrolled copies of personal data that persist indefinitely, outside any retention schedule or access control. Which action should the engineer prioritize to address the underlying data persistence risk?

Accepted Answer

Provide analysts a governed analytics environment where queries run against controlled datasets without exporting raw personal data, and disable local export capability

Answer

Encrypt all exported spreadsheets and personal cloud drive folders used by the marketing team

Answer

Issue a policy reminder instructing analysts to delete exported files within 30 days of use

Answer

Increase the retention period in the data warehouse so analysts do not need to keep local copies

Question 8

A healthcare provider shares patient records with a downstream research partner for approved secondary analytics. Several months later, patients file corrections to their contact and diagnosis data with the provider. The research partner continues to process the original, uncorrected copies. As the privacy solutions engineer, which control should you prioritize to address the data quality obligation across the data lifecycle?

Accepted Answer

Establish a downstream propagation mechanism that pushes approved corrections to all parties holding shared copies within defined timeframes

Answer

Require the research partner to independently re-verify all patient data with each individual before every analysis run

Answer

Encrypt the shared research dataset at rest and in transit to protect the integrity of the records

Answer

Shorten the retention period for the research dataset so outdated records are disposed of more quickly

Question 9

A privacy engineer is designing the technical workflow to fulfill data subject access requests (DSARs) across a company's microservices architecture, where personal data about a single individual is distributed across a CRM, a support ticketing system, a marketing platform, and multiple event-logging databases keyed on different identifiers. The compliance team requires that responses be complete within the statutory deadline and include all data associated with the requester. Which design approach BEST ensures accurate and complete DSAR fulfillment?

Accepted Answer

Implement an identity resolution layer that maps the requester's disparate system identifiers, then orchestrate automated collection queries against each mapped data store

Answer

Query only the CRM as the authoritative system of record, since it contains the master customer profile linked to all other systems

Answer

Export full database dumps from each system to a central location and manually search for the requester's email address each time a request arrives

Answer

Rely on each system owner to receive DSAR notifications by email and independently return whatever data they believe is relevant

Question 10

A retail analytics team wants to share a customer dataset with an external research firm to study purchasing trends. The team removes names, emails, and account numbers but retains ZIP code, birth date, and gender. A privacy engineer reviewing the plan is concerned the dataset may still permit re-identification. Which action BEST addresses the engineer's concern before the data is shared?

Accepted Answer

Apply generalization and suppression to the quasi-identifiers so the dataset meets a defined re-identification risk threshold (e.g., k-anonymity)

Answer

Encrypt the dataset in transit and require the research firm to sign a confidentiality agreement

Answer

Replace the ZIP code, birth date, and gender with reversible pseudonyms stored in a separate key vault

Answer

Add the direct identifiers back and rely on the research firm's access controls to limit exposure

Question 11

A retailer's analytics team wants an internal copy of customer transaction data to build purchasing-trend models. Business requirements state that analysts must never be able to identify individuals, yet the fraud investigation team must retain a controlled ability to re-link records back to specific customers when a confirmed fraud case is opened. As the privacy solutions engineer, which data transformation approach best satisfies both requirements?

Accepted Answer

Pseudonymize direct identifiers using a keyed tokenization scheme, storing the mapping key under strict access control available only to the fraud team, while giving analysts the pseudonymized dataset

Answer

Anonymize the entire dataset so no records can ever be re-linked, and require the fraud team to request original records from production when needed

Answer

Encrypt the identifier columns with a shared symmetric key distributed to both the analytics and fraud teams so either team can decrypt as necessary

Answer

Mask the identifiers with irreversible hashing (no salt) so the same customer always maps to the same value, allowing both teams to correlate records

Question 12

A health analytics team wants to release a public dashboard showing aggregate statistics (counts and averages) about patient populations across regions. Privacy engineering is concerned that analysts issuing many overlapping queries could reconstruct individual patient records from the aggregates over time. Which privacy-enhancing technique best addresses this specific reconstruction risk while still allowing useful aggregate reporting?

Accepted Answer

Apply differential privacy by injecting calibrated statistical noise into query results and enforcing a cumulative privacy budget across queries

Answer

Encrypt the underlying patient database at rest using AES-256 and restrict dashboard access with role-based access control

Answer

Pseudonymize patient identifiers by replacing them with tokens and storing the mapping key separately

Answer

Mask direct identifiers such as names and medical record numbers before loading data into the analytics warehouse

Question 13

A privacy engineer completes a DPIA for a new AI-driven credit scoring platform that processes large volumes of financial data and produces automated decisions affecting individuals. After applying all feasible technical and organizational controls, the assessment shows that the residual risk to data subjects remains high. What should the privacy engineer recommend as the NEXT step before the processing begins?

Accepted Answer

Consult the relevant supervisory authority prior to commencing the processing

Answer

Document the residual risk in the risk register and accept it under the risk owner's authority

Answer

Proceed with the processing since all feasible controls have already been implemented

Answer

Obtain explicit consent from each affected data subject as the sole basis to proceed

Question 14

A privacy manager plans an audit of a critical cloud payroll processor that handles employee personal data on the organization's behalf. When defining the audit scope, the processor's contract states that on-site inspections are limited to once per year with 30 days' notice, and the processor offers an independent SOC 2 Type II report and ISO 27701 certificate as alternatives. What should the privacy manager do FIRST to ensure the audit provides adequate assurance over the processor's privacy controls?

Accepted Answer

Determine the assurance objectives and required control coverage, then assess whether the third-party reports satisfy them before deciding if an on-site audit is needed

Answer

Reject the third-party reports and insist on exercising the contractual on-site inspection right immediately

Answer

Accept the SOC 2 Type II report and ISO 27701 certificate as sufficient assurance without further review

Answer

Renegotiate the contract to allow unlimited on-site inspections before conducting any assessment

Question 15

A mobile development team is integrating a popular third-party analytics SDK into a new consumer health app. During a privacy engineering review, the engineer discovers the SDK, once initialized, automatically transmits device identifiers, coarse location, and app event data to the vendor's servers on app launch — before any user interaction. The product team wants to keep the SDK for its crash-reporting features. What is the MOST effective privacy-by-design action for the engineer to recommend?

Accepted Answer

Configure the SDK to defer initialization and disable non-essential data collection by default, enabling only the specific data streams required for crash reporting after they are justified

Answer

Add a disclosure in the privacy policy describing the SDK's data transmission and rely on the vendor's contractual commitments to safeguard the data

Answer

Allow the SDK to operate as designed but encrypt all outbound traffic to the vendor using TLS to protect the identifiers in transit

Answer

Present a consent banner on first launch allowing users to opt out of all analytics after the initial data transmission has occurred

Question 16

A healthcare analytics team wants to use a large corpus of clinician free-text notes to build a research dataset. The structured fields (name, MRN, date of birth) are easily tokenized, but the notes themselves contain embedded patient names, phone numbers, and addresses written inline by clinicians. A privacy engineer is asked to design a technical control so the notes can be shared with researchers with minimal re-identification risk. Which approach best addresses the privacy risk in the unstructured free-text?

Accepted Answer

Apply automated named-entity recognition (NER) to detect and redact direct identifiers in the free text, followed by human quality review of a risk-based sample before release

Answer

Encrypt the entire notes field at rest with a field-level key and grant researchers decryption access under a data use agreement

Answer

Tokenize the structured identifier fields and release the free-text notes unchanged, relying on the researchers' contractual confidentiality obligations

Answer

Hash the notes field with a salted SHA-256 function so the original identifiers cannot be recovered from the shared dataset

Question 17

A privacy engineer is designing an IoT smart-home hub that processes camera and microphone streams locally at the edge to detect events. To satisfy privacy-by-design, the team wants to ensure raw sensor data never leaves the device and is not retained longer than necessary. Only anonymized event metadata (e.g., 'motion detected at 14:03') is transmitted to the cloud. Which technical design choice BEST embodies data-oriented privacy engineering for the raw sensor streams?

Accepted Answer

Process sensor streams in an ephemeral in-memory buffer that is overwritten in real time, extracting only the anonymized event metadata before any persistence

Answer

Encrypt the raw video and audio at rest on the device and upload it nightly to a secured cloud bucket for backup

Answer

Store the raw streams locally for 30 days with role-based access so support staff can troubleshoot false-positive detections

Answer

Pseudonymize the raw streams with a device-specific key and forward them to the cloud for centralized event detection

Question 18

A privacy engineer is designing a healthcare records system where patient national ID numbers must be stored confidentially but must also support exact-match lookups by authorized staff. The team proposes standard randomized AES-256 encryption for the field. During testing, they discover that lookups require decrypting every row to find a match, which is unacceptable at scale. Which technique BEST preserves confidentiality while enabling efficient exact-match search on the encrypted values?

Accepted Answer

Deterministic encryption of the national ID field, with strict key access controls

Answer

Store the plaintext national ID in an indexed column and rely on database access controls

Answer

Apply format-preserving encryption and remove the index to reduce exposure

Answer

Hash the national ID with an unsalted SHA-256 digest and index the hash

Question 19

A privacy engineer is reviewing a new mobile banking app that integrates with a third-party budgeting service via OAuth 2.0. Currently, the integration requests a broad scope granting full read access to all account transaction history and personal profile data, and the issued refresh tokens have no expiration. The budgeting feature only needs monthly spending categories. Which design change best applies privacy by design and data minimization to the authorization flow?

Accepted Answer

Restrict the requested OAuth scopes to only the aggregated spending-category data the feature needs, and set finite refresh-token lifetimes with re-consent on expiry

Answer

Keep the broad scope but encrypt the transaction data in transit using TLS 1.3 to protect it from interception

Answer

Continue issuing non-expiring refresh tokens but log all API calls the budgeting service makes for later audit

Answer

Require the user to accept an updated privacy notice describing the full-access scope before the integration is enabled

Question 20

A public health agency wants to release a data set of hospital admissions to external researchers. The raw data includes ZIP code, date of birth, sex, and diagnosis. The privacy engineer must ensure no individual can be singled out by combining the quasi-identifiers, while keeping the data useful for demographic trend analysis. Which technique should the engineer apply to the quasi-identifiers before release?

Accepted Answer

Generalize ZIP code to the first three digits and date of birth to year, then verify each combination of quasi-identifiers maps to at least k records

Answer

Encrypt the ZIP code and date of birth fields with AES-256 and share the decryption key with the researchers

Answer

Hash the diagnosis field with SHA-256 so the sensitive attribute cannot be read directly

Answer

Replace each patient's ZIP code with a random token stored in a reversible lookup vault

Question 21

A mobile keyboard app wants to improve its next-word prediction model by learning from the words users type, but the privacy engineering team insists that no individual user's raw typed text should ever leave the device or be reconstructable by the company's central servers. The team wants a technique that adds privacy protection at the point of collection on each device, before any data is transmitted. Which approach best meets this requirement?

Accepted Answer

Apply local differential privacy by adding calibrated noise to each device's contribution before it is sent to the server

Answer

Collect the raw typed text over TLS and apply central differential privacy noise to aggregate query results at the server

Answer

Pseudonymize each user's typed text with a per-user token before transmission and store the mapping in a separate vault

Answer

Hash the typed text with a salted SHA-256 function on the device before sending it to the server for aggregation

Question 22

A healthcare analytics team wants to build a predictive model using patient records held across five hospitals. Regulatory constraints prohibit centralizing the raw patient data in a single repository, but the hospitals are willing to contribute to a shared model. A privacy engineer is asked to recommend an architecture that lets the model learn from all datasets while keeping each hospital's raw records local. Which approach BEST satisfies these requirements?

Accepted Answer

Federated learning, where model parameters are trained locally at each hospital and only aggregated updates are shared with a central coordinator

Answer

Extract, pseudonymize, and copy each hospital's records into a central data lake, then train the model on the combined dataset

Answer

Apply static data masking to each hospital's dataset and email the masked extracts to the analytics team for consolidation

Answer

Grant the analytics team read-only ABAC access to each hospital's production database to query records remotely

Question 23

Two hospitals want to identify patients who received treatment at both facilities to coordinate care, but neither is permitted to disclose plaintext patient identifiers (name, date of birth, national health ID) to the other. A privacy engineer must design a technique that lets both parties match overlapping records without either side learning the identifiers of non-matching patients. Which approach BEST meets this requirement?

Accepted Answer

Implement privacy-preserving record linkage using cryptographically hashed (e.g., Bloom filter–encoded) identifiers exchanged under an agreed keyed scheme

Answer

Have each hospital pseudonymize identifiers with its own internal tokenization vault and exchange the resulting tokens

Answer

Exchange the identifiers over a mutually authenticated TLS channel and delete them after matching

Answer

Aggregate each hospital's patient counts and apply differential privacy noise before comparison

Question 24

After completing a DPIA for a new customer analytics platform, the privacy team identifies a high risk that granular location data could enable re-identification of individuals. The team applies aggregation and access controls, reducing the risk to a level that still exceeds the organization's documented risk appetite. Development leadership wants to launch on schedule. What is the MOST appropriate next step for the privacy engineer?

Accepted Answer

Escalate the residual risk to accountable senior management for a formal risk acceptance decision before launch

Answer

Approve the launch since technical safeguards were already applied to reduce the risk

Answer

Document the residual risk in the risk register and proceed, treating it as an operational matter

Answer

Require that the platform be redesigned to eliminate all location data processing prior to launch

Question 25

A privacy engineer must implement the right to erasure for a microservices platform. Personal data flows into a central append-only event log that feeds several downstream read models (search index, caching layer, analytics materialized views). When an erasure request is confirmed, which technical approach best ensures the individual's personal data is effectively removed while preserving the integrity of the append-only architecture?

Accepted Answer

Encrypt each individual's personal data in the event log with a per-subject key, then delete that key on erasure (crypto-shredding) and trigger rebuilds of downstream read models from the now-unreadable events

Answer

Physically delete the individual's events from the append-only log and rely on downstream services to eventually expire the corresponding cached and indexed records

Answer

Append a tombstone event flagging the record as erased and leave all prior events and downstream read models unchanged, filtering the individual out only at query time

Answer

Mark the individual's account as inactive in the primary identity service so that new events stop being generated for that subject