Privacy Engineering — CDPSE Practice Quiz

Question 1

A retailer has accumulated 10 years of customer transaction records that must be kept indefinitely for trend analysis, but legal counsel wants to remove these records from the scope of data subject access requests and erasure obligations under applicable privacy law. The analytics team still requires the ability to study aggregate purchasing patterns over time but does NOT need to re-link records to any individual. Which data persistence technique best satisfies both the legal goal and the analytics requirement?

Accepted Answer

Anonymize the records so that individuals can no longer be identified directly or indirectly, retaining only aggregate-usable data

Answer

Pseudonymize the records by replacing customer identifiers with tokens stored in a separately secured mapping table

Answer

Encrypt the transaction records at rest with a strong key managed by the security team

Answer

Apply a longer retention schedule and restrict access to the analytics team via role-based access controls

Question 2

A healthcare analytics platform stores patient records used by multiple internal teams: clinical staff need full records for treatment, while a marketing team wants access to demographic fields for outreach campaigns. The privacy engineer is designing an access model that enforces purpose limitation at the data layer so that even authorized users can only retrieve fields consistent with their stated processing purpose. Which access control approach BEST enforces this requirement technically?

Accepted Answer

Implement attribute-based access control (ABAC) with policies that evaluate user role, data-field sensitivity tags, and declared processing purpose before granting field-level access

Answer

Grant both teams read access to the full record set and rely on an acceptable-use policy prohibiting out-of-purpose access

Answer

Create a single 'analytics' role with broad read permissions and log all queries for after-the-fact review by the privacy office

Answer

Encrypt the entire patient record at rest and distribute the decryption key to both the clinical and marketing teams

Question 3

A privacy engineer reviewing a company's website discovers that a third-party script collects the user's canvas rendering output, installed fonts, screen resolution, and hardware concurrency, then hashes these values into a persistent identifier used to recognize returning visitors—even after cookies are cleared. The site's consent banner only governs cookie storage. Which action best addresses the underlying privacy concern?

Accepted Answer

Extend the consent management platform to gate the fingerprinting script behind explicit consent, treating device fingerprinting as a tracking technology subject to the same lawful-basis and preference controls as cookies

Answer

Add the fingerprinting script's domain to the site's Content Security Policy allowlist so it loads reliably across browsers

Answer

Rely on the browser's built-in anti-fingerprinting protections, since modern browsers randomize canvas output and no additional controls are required

Answer

Document the fingerprinting activity in the cookie policy text but continue loading the script by default because no cookies are being set

Question 4

A privacy engineer is designing a preference management platform for a global e-commerce site. Users can opt in or out of several distinct processing purposes (marketing email, personalized recommendations, third-party data sharing). Marketing wants a single "Accept All" toggle stored as one boolean to simplify the backend, arguing it reduces database complexity. What is the engineer's BEST design recommendation to support technical enforcement of privacy requirements?

Accepted Answer

Store each purpose as a separate, timestamped consent record with its own status, source, and version of the notice presented

Answer

Store a single aggregate boolean and infer individual purpose consent from the user's account creation date

Answer

Store consent only in the user's browser cookie so no server-side records need to be maintained

Answer

Store the aggregate boolean now and add granular fields later only if a regulator requests evidence

Question 5

A retail company is migrating from client-side JavaScript tags to a server-side tagging architecture, where a single first-party endpoint receives events from browsers and then forwards them to marketing, analytics, and advertising vendors. The privacy engineer must ensure that a user's declined consent for advertising still prevents advertising vendors from receiving data. Which design approach BEST enforces the user's consent decision in this architecture?

Accepted Answer

Propagate the user's granular consent state to the server-side container and configure per-purpose forwarding rules that suppress vendor calls when the corresponding consent is absent

Answer

Rely on each downstream vendor to honor a consent flag included in the forwarded payload according to its own contractual commitments

Answer

Continue collecting all events at the server endpoint and apply consent filtering in a nightly batch job before data is used for advertising

Answer

Set browser cookies with a shortened expiration for users who decline advertising so that vendor tags naturally stop firing

Question 6

A privacy engineer is designing at-rest encryption for a data lake holding sensitive customer records across multiple business units. Compliance requires that a compromise of the storage layer alone must not expose plaintext, and that cryptographic keys never reside in the same trust boundary as the encrypted data. Which design choice BEST satisfies these requirements?

Accepted Answer

Store the data encryption keys in a hardware security module (HSM) managed under a separate key management service outside the storage platform's trust boundary

Answer

Encrypt each dataset with a unique key and store those keys in a protected configuration file on the same storage cluster

Answer

Enable the storage platform's built-in transparent disk encryption using keys the platform generates and retains internally

Answer

Hash the sensitive fields with a salted SHA-256 function before writing them to the data lake

Question 7

A privacy engineer is reviewing a new customer notification service that emails users about account activity. The service currently includes the customer's full account number and recent transaction amounts directly in the email body to reduce support calls. Email is sent over standard SMTP to whatever mail provider the customer uses. Which design change BEST addresses the privacy risk while preserving the notification's usefulness?

Accepted Answer

Remove the full account number and transaction details from the email body and instead notify the user of activity with a secure link requiring authentication to view details

Answer

Enforce opportunistic TLS on outbound SMTP connections and keep the account number and transaction amounts in the email body

Answer

Encrypt the entire email body with the company's public key so only the company can decrypt stored copies

Answer

Add a disclaimer to the email footer stating that the message may contain confidential information intended only for the recipient

Question 8

A privacy engineer reviews a microservices architecture where dozens of internal services exchange personal data over the corporate network. The team argues that because the traffic never leaves the internal data center, TLS between services is unnecessary and adds latency. A recent internal penetration test demonstrated that an attacker who compromised one host could passively capture plaintext personal data flowing between other services. Which recommendation best addresses the identified privacy risk while aligning with a defense-in-depth approach?

Accepted Answer

Implement mutual TLS (mTLS) for all service-to-service communication so personal data in transit is encrypted and endpoints are mutually authenticated

Answer

Rely on network segmentation and firewall rules to isolate services carrying personal data, since encryption of internal traffic is optional within a trusted zone

Answer

Encrypt personal data only at the perimeter gateway and leave internal service traffic in plaintext to preserve performance

Answer

Apply full-disk encryption on each service host to protect the personal data that transits between services

Question 9

A privacy engineer is hardening a mobile banking app that transmits personal financial data to backend APIs over TLS. During a threat assessment, the team identifies that attackers on compromised or corporate-proxied networks could present fraudulent certificates trusted by the device's OS trust store, enabling interception of personal data. Which technical control most directly mitigates this specific interception risk at the mobile endpoint?

Accepted Answer

Certificate pinning that validates the server certificate or public key against a known set bundled in the app

Answer

Upgrading the TLS cipher suites to enforce AES-256-GCM and forward secrecy

Answer

Encrypting the personal data payload at rest on the device using the platform keystore

Answer

Requiring step-up biometric authentication before the app calls sensitive backend APIs

Question 10

A support team needs read access to a production customer database to troubleshoot live issues, but they should not see full national ID numbers or full payment card numbers. The privacy engineer must ensure that the underlying stored data remains intact and fully usable by billing batch jobs, while support staff only ever see obscured values based on their role. Which technical control best meets these requirements?

Accepted Answer

Apply dynamic data masking so sensitive fields are obfuscated at query time based on the requesting user's role, without altering stored values

Answer

Statically mask the entire production database so all sensitive fields are permanently replaced with fictitious values

Answer

Encrypt the sensitive columns at rest and grant the support team the decryption keys for troubleshooting

Answer

Replace the sensitive fields with tokens stored in a vault and give support staff access to the detokenization service

Question 11

A privacy engineer is reviewing the design of a new mobile analytics SDK before release. The product team wants each event payload to include the user's full device identifier, precise account email, and raw GPS coordinates so that the analytics team can 'have everything available in case a future question comes up.' The stated business need is only to measure feature adoption rates by broad region and by whether a user is on a free or paid plan. Which design change best applies the privacy engineering principle at stake?

Accepted Answer

Send a pseudonymous session token instead of the email, replace raw GPS with a coarse region code, and drop the device identifier, so only the region and plan tier remain in the payload

Answer

Encrypt the full event payload at rest and restrict analytics table access to named analysts via role-based controls

Answer

Collect all fields as requested but add a retention timer that purges the raw analytics events after 24 months

Answer

Obtain explicit consent from users to collect the full identifiers, email, and precise GPS coordinates before the SDK transmits any event

Question 12

A privacy engineer is designing the data-subject data portability feature for a SaaS HR platform. The regulation requires that individuals be able to receive their personal data and transmit it to another controller without hindrance. The product team proposes exporting each individual's records as a rendered PDF report because it is easy to generate from the existing reporting module. What is the engineer's BEST response to satisfy the portability requirement?

Accepted Answer

Require the export to be in a structured, commonly used, machine-readable format (e.g., JSON or CSV) so the data can be reused and transmitted to another controller.

Answer

Accept the PDF because it contains all the individual's personal data and is human-readable.

Answer

Provide the PDF but add an option to encrypt it with the individual's password to ensure security during transfer.

Answer

Export only aggregated summary statistics to minimize the personal data disclosed in the portability response.

Question 13

A privacy engineer is designing the technical workflow to fulfill data subject access requests (DSARs) across a company's microservices architecture, where personal data about a single individual is distributed across a CRM, a support ticketing system, a marketing platform, and multiple event-logging databases keyed on different identifiers. The compliance team requires that responses be complete within the statutory deadline and include all data associated with the requester. Which design approach BEST ensures accurate and complete DSAR fulfillment?

Accepted Answer

Implement an identity resolution layer that maps the requester's disparate system identifiers, then orchestrate automated collection queries against each mapped data store

Answer

Query only the CRM as the authoritative system of record, since it contains the master customer profile linked to all other systems

Answer

Export full database dumps from each system to a central location and manually search for the requester's email address each time a request arrives

Answer

Rely on each system owner to receive DSAR notifications by email and independently return whatever data they believe is relevant

Question 14

A privacy engineer is designing the erasure workflow for a customer platform that uses a primary relational database plus a separate Elasticsearch cluster to power full-text search. When a validated deletion request is processed, records are removed from the relational database, but testing shows that deleted customers' names and email addresses remain returnable through the search interface for several hours. Which design change BEST ensures the erasure obligation is technically enforced across the system?

Accepted Answer

Make the search index deletion part of the same erasure transaction/orchestration so both stores are updated as a single completed operation before the request is marked fulfilled

Answer

Rely on the next full nightly reindex job to eventually remove the stale documents from the search cluster

Answer

Encrypt the search index at rest so that residual personal data is protected until it is overwritten

Answer

Add a legal disclaimer to the search UI stating that recently deleted records may still appear temporarily

Question 15

A retail analytics team wants to share a customer dataset with an external research firm to study purchasing trends. The team removes names, emails, and account numbers but retains ZIP code, birth date, and gender. A privacy engineer reviewing the plan is concerned the dataset may still permit re-identification. Which action BEST addresses the engineer's concern before the data is shared?

Accepted Answer

Apply generalization and suppression to the quasi-identifiers so the dataset meets a defined re-identification risk threshold (e.g., k-anonymity)

Answer

Encrypt the dataset in transit and require the research firm to sign a confidentiality agreement

Answer

Replace the ZIP code, birth date, and gender with reversible pseudonyms stored in a separate key vault

Answer

Add the direct identifiers back and rely on the research firm's access controls to limit exposure

Question 16

A retailer's analytics team wants an internal copy of customer transaction data to build purchasing-trend models. Business requirements state that analysts must never be able to identify individuals, yet the fraud investigation team must retain a controlled ability to re-link records back to specific customers when a confirmed fraud case is opened. As the privacy solutions engineer, which data transformation approach best satisfies both requirements?

Accepted Answer

Pseudonymize direct identifiers using a keyed tokenization scheme, storing the mapping key under strict access control available only to the fraud team, while giving analysts the pseudonymized dataset

Answer

Anonymize the entire dataset so no records can ever be re-linked, and require the fraud team to request original records from production when needed

Answer

Encrypt the identifier columns with a shared symmetric key distributed to both the analytics and fraud teams so either team can decrypt as necessary

Answer

Mask the identifiers with irreversible hashing (no salt) so the same customer always maps to the same value, allowing both teams to correlate records

Question 17

A health analytics team wants to release a public dashboard showing aggregate statistics (counts and averages) about patient populations across regions. Privacy engineering is concerned that analysts issuing many overlapping queries could reconstruct individual patient records from the aggregates over time. Which privacy-enhancing technique best addresses this specific reconstruction risk while still allowing useful aggregate reporting?

Accepted Answer

Apply differential privacy by injecting calibrated statistical noise into query results and enforcing a cumulative privacy budget across queries

Answer

Encrypt the underlying patient database at rest using AES-256 and restrict dashboard access with role-based access control

Answer

Pseudonymize patient identifiers by replacing them with tokens and storing the mapping key separately

Answer

Mask direct identifiers such as names and medical record numbers before loading data into the analytics warehouse

Question 18

A privacy engineer is designing encryption for a database that stores customers' personal data at rest. Compliance requires that individual data encryption keys can be rotated frequently without re-encrypting the entire multi-terabyte dataset, and that a single compromised key exposes the smallest possible data set. Which encryption architecture best satisfies these requirements?

Accepted Answer

Envelope encryption, where data encryption keys (DEKs) encrypt the records and are themselves encrypted by a periodically rotated key encryption key (KEK) held in a key management service

Answer

Full-disk encryption using a single symmetric key managed by the storage platform, rotated annually during a maintenance window

Answer

Application-layer encryption using one shared static symmetric key hardcoded in the application configuration for all records

Answer

Transparent Data Encryption (TDE) with the master key stored in the same database instance as the encrypted data

Question 19

A healthcare analytics platform stores patient records in a shared database. Data scientists need to run cohort analyses on diagnosis codes and treatment outcomes but must never access patient names, contact details, or national identifiers. The privacy engineer is designing the technical encryption controls. Which approach BEST enforces this privacy requirement while preserving analytical utility?

Accepted Answer

Apply field-level (column-level) encryption to the direct identifier fields with keys held by a separate key management service the analytics role cannot access, leaving diagnosis and outcome fields queryable

Answer

Enable full-database transparent data encryption (TDE) so all data is encrypted at rest and decrypted automatically for any authenticated user

Answer

Encrypt the entire patient table and grant data scientists the decryption key so they can decrypt only the records they need for each analysis

Answer

Rely on TLS encryption in transit between the analytics application and the database to protect the identifier fields during queries

Question 20

A healthcare analytics firm wants to outsource statistical computations on patient records to a third-party cloud service. The firm requires that the cloud provider be able to perform the computations without ever having access to the underlying plaintext values, and the results returned must be usable by the firm. Which privacy-enhancing technology BEST satisfies this requirement?

Accepted Answer

Homomorphic encryption, allowing computation directly on ciphertext

Answer

Format-preserving encryption applied to each record field before upload

Answer

Tokenization of the identifiers with a vault retained by the firm

Answer

TLS encryption of data in transit to the cloud provider

More CDPSE practice