CertArea
All ISACA exams

Free Certified Data Privacy Solutions Engineer (CDPSE) practice test: 30 questions with answers

30 original questions for Certified Data Privacy Solutions Engineer (CDPSE), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Data Privacy Solutions Engineer (CDPSE) exam guide: topics, cost and format

All 30 Certified Data Privacy Solutions Engineer (CDPSE) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Privacy Engineering (8 questions)

  1. Question 1

    Which privacy engineering practice reduces the amount of personal data a system holds?

    1. ACollecting every possible field at signup, so that future features never need new data collection
    2. BData minimisation by design, collecting only the fields that the feature actually requires
    3. CKeeping a copy of every API request indefinitely, in case the logs prove useful for a future audit
    4. DDuplicating the customer table in three locations, so that the personal data is safer from loss
    Show answer and explanation
    Correct answer: B

    Data minimisation by design collects only what the feature needs, which reduces the data held. Collecting everything, indefinite logging and duplicating tables each increase the data held.

  2. Question 2

    Which technique replaces direct identifiers with a reference that cannot be linked back without a separate key?

    1. APseudonymisation, which replaces identifiers with pseudonyms held separately from the data
    2. BEncryption with the key stored beside the data, so that the data can be decrypted by anyone reading it
    3. CHashing with no salt on the names, which can be reversed easily using a precomputed table
    4. DDeleting the identifiers from the file and keeping the original file in the same folder as the data
    Show answer and explanation
    Correct answer: A

    Pseudonymisation replaces identifiers with pseudonyms, with the link held separately. Co-located keys, unsalted hashes of names and keeping originals beside the data all make re-identification easy.

  3. Question 3

    Which privacy engineering control protects personal data sent between two services?

    1. ASending the data in the URL query string, which is visible to every server it passes through
    2. BSending the data as plain text over an open network, since the network is internal to the company
    3. CEncryption in transit, such as TLS, with the services authenticating each other
    4. DDisabling authentication between the services, so that they do not reject each other's requests
    Show answer and explanation
    Correct answer: C

    TLS with mutual authentication protects data in transit. Plain text, URL parameters and disabled authentication each expose the data.

  4. Question 4

    A mobile app shares a device identifier with an advertising partner. What privacy principle is most at risk?

    1. AThe app's loading speed, which may be slower on older devices with less memory available
    2. BThe app's colour scheme, which may not match the company's brand guidelines for the product
    3. CConsent and transparency, since the user may not know or agree to the sharing of the identifier
    4. DThe app's version number, which may be shown incorrectly in the app store listing for users
    Show answer and explanation
    Correct answer: C

    Sharing identifiers with a third party risks consent and transparency, which the user needs to understand and agree to. Colour, speed and version numbers are unrelated.

  5. Question 5

    Which design pattern lets users set and change their privacy preferences easily within an application?

    1. APrivacy choices that are set once at installation and cannot be changed by the user afterwards
    2. BPrivacy preferences buried in a long document that is only available as a downloadable PDF file
    3. CA privacy settings centre that is easy to find, with clear defaults set to the most protective option
    4. DPrivacy controls that exist only in the vendor's technical documentation, not in the product itself
    Show answer and explanation
    Correct answer: C

    An easy-to-find settings centre with protective defaults supports user control. Buried documents, unchangeable choices and documentation-only controls do not.

  6. Question 6

    A privacy review finds that a new analytics feature re-identifies users from anonymised data. What is the correct conclusion?

    1. AThe data is not truly anonymous, so it must be treated as personal data with the controls that apply to it
    2. BThe data is anonymous because the names were removed, so no further controls are needed for it
    3. CThe feature is acceptable because re-identification only affects a small number of users in practice
    4. DThe finding can be ignored, since analytics teams always work with anonymised data by default
    Show answer and explanation
    Correct answer: A

    Re-identifiable data is not truly anonymous and must be handled as personal data. Removing names alone does not anonymise, and small numbers and team habits do not change the conclusion.

  7. Question 7

    Which activity best helps find privacy problems early in a software project?

    1. APrivacy threat modelling during design, with privacy requirements tracked through development
    2. BA privacy review scheduled only after the system has been in production for several years
    3. CA penetration test of the production database, performed by the operations team after release
    4. DA customer survey asking which features they would like added, sent once the product is live
    Show answer and explanation
    Correct answer: A

    Privacy threat modelling during design, with requirements tracked, finds problems early when they are cheap to fix. Late reviews, production-only tests and post-release surveys find them too late or the wrong way.

  8. Question 8

    Which privacy-enhancing technology allows an analysis to be performed on data without revealing the individual records to the analyst?

    1. APrinting each record on paper and giving the analyst a copy, so the records are not on screen
    2. BPlain text storage with access logs, which show who looked at each record and when
    3. CSharing the complete database with the analyst under a non-disclosure agreement only
    4. DDifferential privacy, which adds calibrated noise so individual contributions cannot be inferred
    Show answer and explanation
    Correct answer: D

    Differential privacy adds calibrated noise so individual contributions cannot be inferred from results. Logs, NDAs alone and printed copies do not prevent the analyst from seeing records.

Privacy Risk Management and Compliance (8 questions)

  1. Question 9

    A privacy risk assessment finds a high likelihood of harm to customers from a new feature. What is the appropriate response?

    1. AReduce the risk with controls that lower its likelihood or impact, and document any residual risk for approval
    2. BAccept the risk without review, since the feature is commercially important to the company's plans
    3. CLaunch the feature first, and assess the risk only after customers have reported harm from the feature
    4. DHide the assessment result from the product team, so that the launch date is not affected by the findings
    Show answer and explanation
    Correct answer: A

    Reducing the risk with controls and documenting residual risk for approval is the appropriate response. Accepting without review, launching first and hiding findings each ignore the risk.

  2. Question 10

    Which principle requires that personal data be used only for the purpose for which it was collected?

    1. AData portability, which allows the individual to move their data to another service provider
    2. BPurpose limitation, which restricts processing to the specified and compatible purposes
    3. CRight to erasure, which allows the individual to request that their data be deleted on request
    4. DData minimisation, which limits the amount of data collected to what is needed for the task
    Show answer and explanation
    Correct answer: B

    Purpose limitation restricts processing to the specified purposes. Portability, erasure and minimisation are different principles.

  3. Question 11

    A regulation requires that individuals can obtain a copy of their personal data in a commonly used format. Which right does this describe?

    1. AThe right to rectification, which lets the individual correct inaccurate personal data held
    2. BThe right to object, which lets the individual stop processing for direct marketing purposes
    3. CThe right to restrict processing, which pauses use of the data while a dispute is resolved
    4. DThe right of access, which lets the individual obtain a copy of their personal data
    Show answer and explanation
    Correct answer: D

    The right of access allows individuals to obtain a copy of their data. Objection, restriction and rectification are different rights.

  4. Question 12

    A business wants to transfer personal data to a service provider in another country. What should be in place before the transfer?

    1. AA contract with appropriate data protection terms and a transfer mechanism that the law recognises
    2. BA verbal assurance from the provider's sales team that the data will be handled carefully
    3. CA notice on the company's website saying that data may be sent abroad, with no further steps
    4. DNothing, since the provider is a large company and large companies always protect personal data
    Show answer and explanation
    Correct answer: A

    A contract with data protection terms and a legally recognised transfer mechanism are required. Verbal assurances, website notices alone and assumptions about company size do not meet the requirement.

  5. Question 13

    A privacy incident report reveals that a vendor processed data without a contract. Which action should come first?

    1. AKeep the vendor processing as it is, since the vendor has been reliable for a long time
    2. BSuspend the vendor's processing of personal data and assess the exposure, while putting a contract in place
    3. CIgnore the report, because the lack of a contract is a procurement matter and not a privacy matter
    4. DPublish the vendor's name in the press, to pressure it into signing the contract quickly
    Show answer and explanation
    Correct answer: B

    Suspending processing and assessing exposure, with a contract put in place, stops the unlawful processing. Continuing, ignoring and publicising the vendor are not appropriate first actions.

  6. Question 14

    Which two activities check that privacy controls are operating as designed? (Choose two.)

    1. APeriodic privacy audits and control testing, with findings tracked to remediation
    2. BA press release announcing the company's commitment to privacy, issued after the policy is approved
    3. CA customer satisfaction survey asking whether customers feel their data is safe, sent once a year
    4. DA review of access logs against the approved access rules, with exceptions investigated
    5. EA list of privacy tools purchased by the procurement team during the financial year
    Show answer and explanation
    Correct answer: A, D

    Periodic audits and reviews of access logs against approved rules check that controls operate. A press release, a satisfaction survey and a tool list do not test controls.

  7. Question 15

    Which two activities are part of a data breach response process? (Choose two.)

    1. AAssess the scope and the likelihood of harm to affected individuals
    2. BDelay any assessment until the board meets next, so that the report is complete when it is made
    3. CNotify the regulator and affected individuals where the law requires it, within the required time
    4. DDelete all logs of the incident immediately, so that the company's reputation is protected
    5. EPublish the names of the affected individuals on the company's public website, to show transparency
    Show answer and explanation
    Correct answer: A, C

    Assessing scope and harm, and notifying regulators and individuals within legal timelines are core breach response steps. Delayed assessment, deleted logs and publishing names are all harmful.

  8. Question 16

    A privacy impact assessment is needed for a system that will process sensitive personal data at large scale. When should it be carried out?

    1. AAt the end of the system's life, when it is being retired, to record the lessons learned
    2. BOnly after a complaint has been made by a user of the system, as a response to the complaint
    3. COnce, when the system is first purchased, and never again even when its use changes significantly
    4. DBefore processing begins, and again when the purpose, scope or technology changes materially
    Show answer and explanation
    Correct answer: D

    A privacy impact assessment should happen before processing starts and be refreshed when purpose, scope or technology changes. Complaints, a single purchase-time review and end-of-life review each come too late or too rarely.

Data Lifecycle Management (7 questions)

  1. Question 17

    Which principle should guide how long personal data is kept?

    1. AKeep personal data for exactly ten years, regardless of the purpose for which it was collected
    2. BKeep all personal data indefinitely, in case it becomes useful for an unknown purpose later
    3. CRetain personal data only as long as needed for the stated purpose, then securely delete it
    4. DDelete personal data on the day it is collected, even when the purpose requires it for years
    Show answer and explanation
    Correct answer: C

    Retention should match the stated purpose, followed by secure deletion. Indefinite retention, a fixed period regardless of purpose and immediate deletion each break the principle.

  2. Question 18

    Which control reduces the privacy risk of a dataset used for analytics?

    1. ACopy the dataset to a personal laptop for each analyst, so that analysis can be done offline at home
    2. BShare the raw dataset with every analyst, so that each can identify the individuals in the records
    3. CPublish the raw dataset openly, so that independent researchers can check the company's analysis
    4. DPseudonymise or aggregate the data so that individuals are not identifiable in the analysis outputs
    Show answer and explanation
    Correct answer: D

    Pseudonymisation or aggregation reduces identifiability in analytics outputs. Shared raw data, public publication and personal laptop copies each increase risk.

  3. Question 19

    A customer asks to have their personal data deleted. The data is also held in backups. What should the organisation do?

    1. ARefuse the request, since backups can never be changed or deleted once they have been created
    2. BDelete the live data, and ensure backups are deleted or restored without that data within the backup cycle
    3. CDelete the live data and leave the backups unchanged, with no record of the request kept anywhere
    4. DKeep the data in the live systems as well, since the backups are the only record the company holds
    Show answer and explanation
    Correct answer: B

    The organisation should delete live data and ensure backups are deleted or restored without it within the backup cycle. Refusing, leaving backups unchanged without a record, and keeping live data each fail the request.

  4. Question 20

    Which data classification approach helps protect personal data appropriately?

    1. AGive all data the same protection level, so that the team never needs to make a classification decision
    2. BClassify data by sensitivity and apply controls that match each classification level
    3. CLeave data unclassified, since classifying data takes time away from the development of new features
    4. DClassify data by the number of people who use the system, rather than by the sensitivity of the data
    Show answer and explanation
    Correct answer: B

    Classifying by sensitivity and applying matching controls protects personal data proportionately. Uniform protection, no classification and classifying by user count do not.

  5. Question 21

    Which control protects personal data in a database from being read by staff who do not need it for their work?

    1. AAn open read permission for all staff, so that nobody is blocked from finding the information they need
    2. BShared database credentials that every employee uses, so that access is simple to manage each day
    3. CRole-based access control with least privilege, and column-level restrictions for sensitive fields
    4. DA printed copy of the database kept on every desk, so that the data is never read from the system
    Show answer and explanation
    Correct answer: C

    Role-based least privilege with column restrictions limits access to what each role needs. Shared credentials, open permissions and printed copies each expose data.

  6. Question 22

    Which two controls help ensure personal data is accurate over its lifecycle? (Choose two.)

    1. AValidate data at entry, and provide individuals a way to correct inaccurate information
    2. BAccept any data entered by staff without checks, since the staff always enter it correctly
    3. CKeep the data in many copies that are never synchronised, so that errors are easy to spot
    4. DIgnore correction requests, since accurate data is the responsibility of the individual alone
    5. EDelete all data each time it is updated, so that only the latest data version exists in the system
    Show answer and explanation
    Correct answer: A, D

    Validating at entry and offering correction routes keep data accurate. Unchecked entry, unsynchronised copies, ignored corrections and deleting history each undermine accuracy.

  7. Question 23

    Which control prevents personal data from being used outside the purposes for which it was collected, inside a data platform?

    1. AA single shared account for every analysis, so that the purpose is never recorded in the system
    2. BOpen access for all analysts, so that the data can be used flexibly for any new question that arises
    3. CPurpose-based access controls that check each request against the approved purposes for the data
    4. DCopying the data into an unrestricted sandbox for every team, so that each team can explore it freely
    Show answer and explanation
    Correct answer: C

    Purpose-based access controls enforce use within approved purposes. Open access, shared accounts and unrestricted sandboxes each allow use beyond purpose.

Privacy Governance (7 questions)

  1. Question 24

    A company is launching a new app that collects location data. Which governance step should come FIRST?

    1. ADesign the app's home screen and the colour scheme that the marketing team has proposed
    2. BChoose the database vendor that will store the location records for the first year of service
    3. CComplete a privacy impact assessment that defines the purpose, data needed and legal basis
    4. DStart collecting the location data, and document the purpose once the data volume is known
    Show answer and explanation
    Correct answer: C

    A privacy impact assessment defines the purpose, data needs and legal basis before collection, which governs every later decision. Vendor choice, interface design and collecting first each come before the purpose is defined.

  2. Question 25

    Which role is most appropriate to own the privacy programme's policy and be accountable for its compliance?

    1. AA designated privacy officer with the authority and resources to enforce the programme
    2. BThe newest developer on the product team, who knows the code best and has time to spare
    3. CThe marketing director, who controls how customer data is described to the public and customers
    4. DThe external auditor, who reviews the programme once every three years on a fixed schedule
    Show answer and explanation
    Correct answer: A

    A designated privacy officer with authority and resources is accountable for the programme. A developer, a marketing director and an external auditor do not hold that accountability.

  3. Question 26

    Which artefact records the personal data processing activities of an organisation as required by many privacy laws?

    1. AA list of the company's office keys and the staff members who hold a key to each entrance
    2. BA records of processing activities, listing purposes, categories of data, recipients and retention
    3. CA list of the company's social media followers, grouped by the country in which they live
    4. DA list of the software licences purchased during the financial year by each department
    Show answer and explanation
    Correct answer: B

    Records of processing activities list purposes, data categories, recipients and retention, as required by many laws. Keys, followers and licences are unrelated.

  4. Question 27

    An organisation wants staff to understand their privacy responsibilities. Which activity best achieves lasting change?

    1. AAn email with the privacy policy attached, sent to all staff once a year as the only reminder
    2. BA single slide deck shown once during onboarding and then never repeated for any staff member
    3. CA poster in the staff kitchen that lists the privacy laws, with no training sessions at any time
    4. DRole-based privacy training that is refreshed regularly and reinforced with practical scenarios
    Show answer and explanation
    Correct answer: D

    Role-based training refreshed regularly and reinforced with scenarios changes behaviour. A single session, a poster and an annual email do not.

  5. Question 28

    Which metric best shows whether the privacy programme is working over time?

    1. AThe total pages of the privacy handbook, which is a measure of how thorough the team has been
    2. BThe number of privacy policy documents published on the intranet during the financial year
    3. CThe number of training courses offered each year, regardless of the staff who attended them
    4. DThe rate of privacy incidents and the time taken to resolve them, trended over periods
    Show answer and explanation
    Correct answer: D

    Incident rates and resolution times, trended over time, show programme effectiveness. Document counts, course counts and handbook pages measure activity, not outcomes.

  6. Question 29

    Which two elements should a privacy notice include? (Choose two.)

    1. AThe purposes for which personal data is processed, and the legal basis for each purpose
    2. BThe name of the designer who chose the colours used on the company's website and app
    3. CThe categories of recipients who receive the data, including any third-party processors
    4. DThe number of employees in the company's office, which shows the scale of the operation
    5. EThe brand of the server hardware used in the company's data centre, for transparency
    Show answer and explanation
    Correct answer: A, C

    A privacy notice states the purposes and legal bases and the recipients of data. Designer names, office size and hardware brands are not required content.

  7. Question 30

    Which principle requires an organisation to consider privacy from the start of a system's design, not as an afterthought?

    1. APrivacy as an add-on, which adds controls to a finished system when a complaint is received
    2. BPrivacy by default, which only sets the most protective options after the system is released
    3. CPrivacy by design, which builds privacy protections into systems from the outset
    4. DPrivacy by exception, which applies protections only to the data that a regulator names
    Show answer and explanation
    Correct answer: C

    Privacy by design builds protections in from the start. Privacy by default concerns default settings, while add-on and exception-based approaches leave privacy as an afterthought.