Medium — CDPSE Practice Quiz

Question 1

A retailer has accumulated 10 years of customer transaction records that must be kept indefinitely for trend analysis, but legal counsel wants to remove these records from the scope of data subject access requests and erasure obligations under applicable privacy law. The analytics team still requires the ability to study aggregate purchasing patterns over time but does NOT need to re-link records to any individual. Which data persistence technique best satisfies both the legal goal and the analytics requirement?

Accepted Answer

Anonymize the records so that individuals can no longer be identified directly or indirectly, retaining only aggregate-usable data

Answer

Pseudonymize the records by replacing customer identifiers with tokens stored in a separately secured mapping table

Answer

Encrypt the transaction records at rest with a strong key managed by the security team

Answer

Apply a longer retention schedule and restrict access to the analytics team via role-based access controls

Question 2

A healthcare analytics platform stores patient records used by multiple internal teams: clinical staff need full records for treatment, while a marketing team wants access to demographic fields for outreach campaigns. The privacy engineer is designing an access model that enforces purpose limitation at the data layer so that even authorized users can only retrieve fields consistent with their stated processing purpose. Which access control approach BEST enforces this requirement technically?

Accepted Answer

Implement attribute-based access control (ABAC) with policies that evaluate user role, data-field sensitivity tags, and declared processing purpose before granting field-level access

Answer

Grant both teams read access to the full record set and rely on an acceptable-use policy prohibiting out-of-purpose access

Answer

Create a single 'analytics' role with broad read permissions and log all queries for after-the-fact review by the privacy office

Answer

Encrypt the entire patient record at rest and distribute the decryption key to both the clinical and marketing teams

Question 3

A privacy engineer is designing a preference management platform for a global e-commerce site. Users can opt in or out of several distinct processing purposes (marketing email, personalized recommendations, third-party data sharing). Marketing wants a single "Accept All" toggle stored as one boolean to simplify the backend, arguing it reduces database complexity. What is the engineer's BEST design recommendation to support technical enforcement of privacy requirements?

Accepted Answer

Store each purpose as a separate, timestamped consent record with its own status, source, and version of the notice presented

Answer

Store a single aggregate boolean and infer individual purpose consent from the user's account creation date

Answer

Store consent only in the user's browser cookie so no server-side records need to be maintained

Answer

Store the aggregate boolean now and add granular fields later only if a regulator requests evidence

Question 4

A privacy engineer is designing at-rest encryption for a data lake holding sensitive customer records across multiple business units. Compliance requires that a compromise of the storage layer alone must not expose plaintext, and that cryptographic keys never reside in the same trust boundary as the encrypted data. Which design choice BEST satisfies these requirements?

Accepted Answer

Store the data encryption keys in a hardware security module (HSM) managed under a separate key management service outside the storage platform's trust boundary

Answer

Encrypt each dataset with a unique key and store those keys in a protected configuration file on the same storage cluster

Answer

Enable the storage platform's built-in transparent disk encryption using keys the platform generates and retains internally

Answer

Hash the sensitive fields with a salted SHA-256 function before writing them to the data lake

Question 5

A privacy solutions engineer is helping a healthcare analytics company build its data life cycle program. The company handles a mix of marketing contact lists, employee HR records, and patient clinical data. Leadership wants a foundational mechanism that will drive consistent handling — such as encryption strength, access restrictions, and retention periods — as each dataset moves through collection, processing, and disposal. What should the engineer establish FIRST to enable these differentiated controls across the data life cycle?

Accepted Answer

A data classification scheme with defined sensitivity tiers and associated handling requirements

Answer

An automated retention and disposal engine applied uniformly to all datasets

Answer

A data loss prevention (DLP) tool configured with regular-expression pattern matching

Answer

A consent management platform to capture individual preferences at collection

Question 6

A retail company's mobile app initially collects only an email address to create an account, with the stated purpose of order confirmation. Over the following months, the product team wants to progressively collect additional data (birthdate, purchase preferences, location) as users interact with new features, to power a personalized recommendation engine. As the privacy engineer advising on the data life cycle, what is the MOST appropriate control to embed before this progressive collection begins?

Accepted Answer

Ensure each new data element is tied to a specific, disclosed purpose and a corresponding lawful basis before it is collected at the relevant interaction point

Answer

Collect all the additional data elements at account creation so consent only needs to be obtained once, simplifying the user experience

Answer

Rely on the existing account-creation consent, since the user already agreed to the privacy policy when signing up

Answer

Defer any privacy analysis until the recommendation engine is fully built, then apply de-identification to the aggregated dataset

Question 7

A privacy engineer is reviewing a new marketing web form before launch. The business wants to capture as much prospect information as possible for future campaigns, so the form currently includes 22 fields, including date of birth, household income, and national ID number. The stated purpose is to send prospects an email newsletter and occasional product offers. Which action best aligns the form design with the data minimization and collection limitation principles?

Accepted Answer

Reduce the form to only the fields required to deliver the newsletter and offers (such as email and name), and remove or make truly optional any field not needed for that stated purpose

Answer

Keep all 22 fields but add a consent checkbox stating that data may be used for future undefined marketing purposes

Answer

Keep all 22 fields but encrypt the national ID and household income values at rest to protect the sensitive data

Answer

Keep all 22 fields and add a retention schedule that deletes the excess data after 24 months

Question 8

A privacy engineer is reviewing an online registration form for a new loyalty program. The business purpose is limited to sending members promotional offers and tracking reward points. The current form collects name, email, home address, date of birth, mobile number, national ID number, and household income. The marketing team insists all fields are 'useful for future analytics we might do.' Which action BEST aligns the form with the collection limitation principle?

Accepted Answer

Remove fields not necessary for the stated loyalty purpose, collecting only name, email, and the minimum needed to administer rewards

Answer

Retain all fields but encrypt the national ID and income data at rest to reduce exposure risk

Answer

Keep all fields but add a broad consent checkbox permitting use for any future analytics purposes

Answer

Mark national ID and income as optional while retaining all fields on the form

Question 9

A fitness app product team wants to add a new feature that recommends nearby running routes. The proposed design requests continuous background access to precise GPS location, the device contact list, microphone, and calendar entries. As the data privacy solutions engineer reviewing the collection design against the data life cycle principle of collection limitation, which recommendation should you make?

Accepted Answer

Restrict collection to coarse location gathered only while the feature is in active use, and remove the contacts, microphone, and calendar access that are not necessary for route recommendations

Answer

Approve all requested data elements because broad collection improves recommendation accuracy and can be retained for future analytics

Answer

Allow all requested access but obtain a single blanket consent covering every permission at first app launch

Answer

Collect all requested elements now but pseudonymize the identifiers so the excess collection is compliant

Question 10

A financial services firm is decommissioning several on-premises servers containing customer personal data on solid-state drives (SSDs). The IT team proposes running a multi-pass overwrite utility, the same procedure historically used on the firm's magnetic hard drives, to sanitize the SSDs before the servers are sold to a refurbisher. As the privacy solutions engineer reviewing the disposal plan, what is your MOST important concern?

Accepted Answer

Multi-pass overwriting is unreliable on SSDs because wear-leveling and over-provisioning can leave recoverable data in cells the utility cannot address, so a media-appropriate sanitization method should be used

Answer

A single overwrite pass would be sufficient, so the multi-pass approach wastes time and delays the sale to the refurbisher

Answer

The servers should be retained internally rather than sold, since any reuse of the hardware creates unacceptable privacy risk

Answer

The disposal plan should focus on encrypting the drives before sale rather than sanitizing them

Question 11

A retailer terminates a contract with a cloud-based marketing analytics processor that held several million customer records. The contract requires the processor to destroy all personal data upon termination. As the data privacy solutions engineer, what is the MOST important action to ensure the disposal obligation is actually met?

Accepted Answer

Obtain a certificate of destruction and evidence covering all data locations, including backups and replicas, and verify it against the data flow inventory

Answer

Rely on the standard contractual destruction clause, since the processor is legally bound to comply

Answer

Request that the processor return all records to the retailer before deleting its own copies

Answer

Immediately revoke the processor's API credentials and consider the data disposed

Question 12

A privacy engineer maintains data flow diagrams for a customer analytics platform. The platform team has just integrated a new third-party enrichment API that appends demographic attributes to existing customer records before they are loaded into the warehouse. The enrichment adds no new source systems, but the data now includes attributes not present in the original collection. What should the privacy engineer do FIRST to keep the data mapping accurate and support downstream lifecycle controls?

Accepted Answer

Update the data flow diagram to reflect the new enrichment step, the added attribute categories, and the resulting change in data elements flowing into the warehouse

Answer

Schedule the change for the next annual data mapping refresh since no new source systems were added

Answer

Immediately delete the enriched demographic attributes because they were not part of the original collection

Answer

Notify affected customers that additional attributes are now stored before documenting the change internally

Question 13

During a review of a retailer's website, a privacy solutions engineer discovers that the current data flow diagrams do not reflect several third-party JavaScript tags (advertising and analytics pixels) that transmit visitor identifiers to external vendors. Marketing added these tags directly through the tag manager without notifying privacy or IT. What is the MOST important reason to update the data flow diagrams to capture these tags before taking other action?

Accepted Answer

Undocumented client-side data flows represent unmapped disclosures of personal data to processors and third parties that must be understood to assess purpose, legal basis, and downstream controls

Answer

The diagrams must show every technology component to satisfy software asset management inventories

Answer

Tag managers slow page load times and the diagrams help identify performance bottlenecks

Answer

The diagrams are needed to renegotiate the advertising vendor contracts at a lower cost

Question 14

A privacy engineer is asked to update the organization's data flow diagrams for a customer relationship management (CRM) platform before a new marketing analytics initiative launches. During the mapping exercise, the engineer discovers that a subprocessor replicates a copy of customer records to a data center in a third country that is not documented in the current record of processing activities or any transfer mechanism. What should the privacy engineer do FIRST?

Accepted Answer

Document the newly identified data flow and undocumented cross-border transfer in the data map, then escalate the finding so a lawful transfer mechanism and risk assessment can be evaluated

Answer

Immediately instruct the subprocessor to delete all replicated records in the third country to eliminate the exposure

Answer

Proceed with the marketing analytics launch since the transfer predates the new initiative and is outside its scope

Answer

Add an encryption control to the replicated data set so the transfer no longer requires a lawful basis

Question 15

A privacy engineer is reviewing a new customer notification service that emails users about account activity. The service currently includes the customer's full account number and recent transaction amounts directly in the email body to reduce support calls. Email is sent over standard SMTP to whatever mail provider the customer uses. Which design change BEST addresses the privacy risk while preserving the notification's usefulness?

Accepted Answer

Remove the full account number and transaction details from the email body and instead notify the user of activity with a secure link requiring authentication to view details

Answer

Enforce opportunistic TLS on outbound SMTP connections and keep the account number and transaction amounts in the email body

Answer

Encrypt the entire email body with the company's public key so only the company can decrypt stored copies

Answer

Add a disclaimer to the email footer stating that the message may contain confidential information intended only for the recipient

Question 16

A privacy engineer reviews a microservices architecture where dozens of internal services exchange personal data over the corporate network. The team argues that because the traffic never leaves the internal data center, TLS between services is unnecessary and adds latency. A recent internal penetration test demonstrated that an attacker who compromised one host could passively capture plaintext personal data flowing between other services. Which recommendation best addresses the identified privacy risk while aligning with a defense-in-depth approach?

Accepted Answer

Implement mutual TLS (mTLS) for all service-to-service communication so personal data in transit is encrypted and endpoints are mutually authenticated

Answer

Rely on network segmentation and firewall rules to isolate services carrying personal data, since encryption of internal traffic is optional within a trusted zone

Answer

Encrypt personal data only at the perimeter gateway and leave internal service traffic in plaintext to preserve performance

Answer

Apply full-disk encryption on each service host to protect the personal data that transits between services

Question 17

A privacy engineer is hardening a mobile banking app that transmits personal financial data to backend APIs over TLS. During a threat assessment, the team identifies that attackers on compromised or corporate-proxied networks could present fraudulent certificates trusted by the device's OS trust store, enabling interception of personal data. Which technical control most directly mitigates this specific interception risk at the mobile endpoint?

Accepted Answer

Certificate pinning that validates the server certificate or public key against a known set bundled in the app

Answer

Upgrading the TLS cipher suites to enforce AES-256-GCM and forward secrecy

Answer

Encrypting the personal data payload at rest on the device using the platform keystore

Answer

Requiring step-up biometric authentication before the app calls sensitive backend APIs

Question 18

A privacy solutions engineer is establishing the organization's first enterprise data inventory to support Data Life Cycle Management. During initial interviews, several business units confirm they store customer personal data in departmentally-provisioned SaaS tools and local spreadsheets that were never registered with IT. Which action should the engineer take FIRST to ensure the data inventory accurately reflects where personal data resides?

Accepted Answer

Perform automated data discovery and network scanning to detect unregistered repositories and reconcile results against the self-reported inventory

Answer

Require each business unit to sign an attestation that all personal data has been disclosed before finalizing the inventory

Answer

Block all unsanctioned SaaS applications at the network firewall to force data back into approved systems

Answer

Apply the organization's data classification scheme to the repositories that have already been reported

Question 19

A privacy engineer is building the organization's first data inventory to support Data Life Cycle Management. The engineering team has already catalogued each data store with system name, hosting location, data owner, and the categories of personal data held. During review, the DPO notes that the inventory cannot be used to enforce retention limitation or purpose limitation because a critical attribute is missing. Which attribute should be added to each inventory entry to MOST directly enable these controls?

Accepted Answer

The documented processing purpose and associated legal basis for each data category

Answer

The encryption algorithm and key length applied to each data store

Answer

The total storage volume and monthly growth rate of each data store

Answer

The vendor SLA and uptime guarantee for each hosting environment

Question 20

A privacy engineer at a fast-growing fintech company established a data inventory 18 months ago as a one-time project. Since then, the company launched three new mobile products, acquired a competitor, and migrated several systems to the cloud. During a recent regulatory inquiry, the company could not accurately identify all systems processing customer financial data. Which action would MOST effectively prevent this problem from recurring?

Accepted Answer

Establish a process that automatically updates the data inventory whenever change-management, procurement, and system-onboarding events occur

Answer

Schedule a comprehensive manual re-inventory of all systems every three years to capture accumulated changes

Answer

Encrypt all databases containing customer financial data so their contents are protected during inquiries

Answer

Require each business unit to sign an annual attestation confirming they have not acquired any new systems

Question 21

A support team needs read access to a production customer database to troubleshoot live issues, but they should not see full national ID numbers or full payment card numbers. The privacy engineer must ensure that the underlying stored data remains intact and fully usable by billing batch jobs, while support staff only ever see obscured values based on their role. Which technical control best meets these requirements?

Accepted Answer

Apply dynamic data masking so sensitive fields are obfuscated at query time based on the requesting user's role, without altering stored values

Answer

Statically mask the entire production database so all sensitive fields are permanently replaced with fictitious values

Answer

Encrypt the sensitive columns at rest and grant the support team the decryption keys for troubleshooting

Answer

Replace the sensitive fields with tokens stored in a vault and give support staff access to the detokenization service

Question 22

A retail company is migrating customer records from an aging on-premises CRM to a new cloud-based data warehouse that will support both operations and analytics. The legacy CRM has accumulated 15 years of records, including many inactive accounts, duplicate entries, and free-text notes fields containing sensitive personal data collected under purposes that no longer apply. The project manager wants to lift-and-shift all records as-is to meet the migration deadline, then clean up later. As the privacy solutions engineer, what should you recommend FIRST?

Accepted Answer

Apply data minimization and quality controls before migration by filtering out records that exceed retention limits or lack a current lawful purpose, and remediating duplicate and unnecessary data

Answer

Proceed with the full lift-and-shift to meet the deadline, since data quality and minimization can be addressed after the warehouse is operational

Answer

Encrypt all records in transit and at rest during migration, which satisfies the privacy obligations for the legacy dataset

Answer

Migrate all records but restrict analytics access to the warehouse to authorized personnel only

Question 23

A privacy engineer is reviewing the design of a new mobile analytics SDK before release. The product team wants each event payload to include the user's full device identifier, precise account email, and raw GPS coordinates so that the analytics team can 'have everything available in case a future question comes up.' The stated business need is only to measure feature adoption rates by broad region and by whether a user is on a free or paid plan. Which design change best applies the privacy engineering principle at stake?

Accepted Answer

Send a pseudonymous session token instead of the email, replace raw GPS with a coarse region code, and drop the device identifier, so only the region and plan tier remain in the payload

Answer

Encrypt the full event payload at rest and restrict analytics table access to named analysts via role-based controls

Answer

Collect all fields as requested but add a retention timer that purges the raw analytics events after 24 months

Answer

Obtain explicit consent from users to collect the full identifiers, email, and precise GPS coordinates before the SDK transmits any event

Question 24

A privacy solutions engineer reviews a company's data storage strategy. Active customer records are kept in a high-performance database, while records inactive for over two years are automatically moved to a low-cost cold storage tier. During the review, the engineer finds that cold storage retains records indefinitely because the archival process was designed only to reduce storage cost, with no linkage to the customers' original retention requirements. What is the engineer's BEST recommendation to align this persistence practice with privacy principles?

Accepted Answer

Integrate the retention schedule into the archival process so records in cold storage are disposed of when their retention period expires

Answer

Encrypt all cold storage archives to protect the indefinitely retained records

Answer

Move the cold storage archives to an even lower-cost tier to further reduce persistence expenses

Answer

Restrict access to the cold storage tier to a limited set of administrators

Question 25

A privacy engineer is designing the data-subject data portability feature for a SaaS HR platform. The regulation requires that individuals be able to receive their personal data and transmit it to another controller without hindrance. The product team proposes exporting each individual's records as a rendered PDF report because it is easy to generate from the existing reporting module. What is the engineer's BEST response to satisfy the portability requirement?

Accepted Answer

Require the export to be in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so the data can be reused and transmitted to another controller.

Answer

Accept the PDF because it contains all the individual's personal data and is human-readable.

Answer

Provide the PDF but add an option to encrypt it with the individual's password to ensure security during transfer.

Answer

Export only aggregated summary statistics to minimize the personal data disclosed in the portability response.