ISACA Certified Data Privacy Solutions Engineer (CDPSE) practice questions

Domain coverage 3 domains

• Privacy Governance (34%)
• Privacy Architecture (36%)
• Data Lifecycle (30%)

Sample questions 23 of 229 shown

1. Q1

   Which of the following is the PRIMARY reason to complete a privacy impact assessment (PIA)?

   1. To comply with consumer regulatory requirements
   2. To establish privacy breach response procedures
   3. To classify personal data
   4. To understand privacy risks

   The PRIMARY reason to complete a Privacy Impact Assessment (PIA) is to understand privacy risks (D). A PIA is a systematic process to identify, assess, and mitigate privacy risks before implementing a new project or system. Understanding risks is the foundational purpose. While regulatory compliance (A) is important, it's not the primary purpose. Establishing breach response procedures (B) and classifying personal data (C) are components of privacy management but not the main purpose of a PIA.
2. Q2

   Before executive leadership approves a new data privacy policy, it is MOST important to ensure:

   1. a training program is developed.
   2. a privacy committee is established.
   3. a distribution methodology is identified.
   4. a legal review is conducted.

   Before executive leadership approves a new data privacy policy, it is MOST important to ensure a legal review is conducted (D). Legal review ensures the policy complies with applicable laws and regulations (e.g., GDPR, CCPA, PIPL). Without legal review, the policy may be non-compliant or unenforceable. Training program (A), privacy committee (B), and distribution methodology (C) are important but come after legal review.
3. Q3

   Which of the following is a responsibility of the audit function in helping an organization address privacy compliance requirements?

   1. Approving privacy impact assessments (PIAs)
   2. Validating the privacy framework
   3. Managing privacy notices provided to customers
   4. Establishing employee privacy rights and consent

   The audit function's responsibility in helping an organization address privacy compliance requirements is validating the privacy framework (B). The audit function provides independent assurance that the privacy framework is properly designed and operating effectively. Approving PIAs (A) is management's responsibility. Managing privacy notices (C) and establishing employee privacy rights (D) are also management responsibilities, not audit functions.
4. Q4

   An online retail company is trying to determine how to handle users’ data if they unsubscribe from marketing emails generated from the website. Which of the following is the BEST approach for handling personal data that has been restricted?

   1. Encrypt users’ information so it is inaccessible to the marketing department.
   2. Reference the privacy policy to see if the data is truly restricted.
   3. Remove users’ information and accounts from the system.
   4. Flag users’ email addresses to make sure they do not receive promotional information.

   The BEST approach for handling personal data that has been restricted (unsubscribe from marketing emails) is to remove users' information and accounts from the system (C). This ensures compliance with data minimization and storage limitation principles. Simply encrypting (A) or flagging (D) don't fully address the restriction. Referencing privacy policy (B) is a first step but not the complete solution.
5. Q5

   Which of the following should be done FIRST when developing an organization-wide strategy to address data privacy risk?

   1. Obtain executive support.
   2. Develop a data privacy policy.
   3. Gather privacy requirements from legal counsel.
   4. Create a comprehensive data inventory.

   When developing an organization-wide strategy to address data privacy risk, the FIRST step should be to obtain executive support (A). Without executive support, privacy initiatives lack authority, resources, and organizational buy-in. Executive support is foundational to establishing a privacy program. Developing privacy policy (B), gathering legal requirements (C), and creating data inventory (D) are important but come after securing executive support.
6. Q6

   Which of the following should be established FIRST before authorizing remote access to a data store containing personal data?

   1. Privacy policy
   2. Network security standard
   3. Multi-factor authentication
   4. Virtual private network (VPN)

   Before authorizing remote access to a data store containing personal data, a privacy policy (A) should be established FIRST. The privacy policy defines how personal data should be handled, protected, and accessed. Without a privacy policy, there's no framework for determining appropriate access controls. Network security standard (B), multi-factor authentication (C), and VPN (D) are technical controls that should be implemented in accordance with the privacy policy.
7. Q7

   Which of the following should be of GREATEST concern when an organization wants to store personal data in the cloud?

   1. The organization’s potential legal liabilities related to the data
   2. The data recovery capabilities of the storage provider
   3. The data security policies and practices of the storage provider
   4. Any vulnerabilities identified in the cloud system

   The GREATEST concern when storing personal data in the cloud is the organization's potential legal liabilities related to the data (A). Cloud storage involves data residency, jurisdictional issues, and compliance with various privacy laws. Legal liabilities can result in fines, penalties, and reputational damage. Data recovery capabilities (B), security policies (C), and vulnerabilities (D) are important but secondary to legal compliance.
8. Q8

   Which of the following helps define data retention time is a stream-fed data lake that includes personal data?

   1. Information security assessments
   2. Privacy impact assessments (PIAs)
   3. Data privacy standards
   4. Data lake configuration

   Privacy Impact Assessments (PIAs) help define data retention time in a stream-fed data lake that includes personal data (B). PIAs assess privacy risks and help determine appropriate retention periods based on legal requirements, business needs, and privacy principles. Information security assessments (A) focus on security, not privacy. Data privacy standards (C) provide guidelines but PIAs are more specific. Data lake configuration (D) is technical, not privacy-focused.
9. Q9

   As part of a major data discovery initiative to identify personal data across the organization, the project team has identified the proliferation of personal data held as unstructured data as a major risk. What should be done FIRST to address this situation?

   1. Identify sensitive unstructured data at the point of creation.
   2. Classify sensitive unstructured data.
   3. Identify who has access to sensitive unstructured data.
   4. Assign an owner to sensitive unstructured data.

   When personal data is held as unstructured data (a major risk), the FIRST step to address this situation is to identify who has access to sensitive unstructured data (C). Understanding access is critical for assessing privacy risk and implementing appropriate controls. Without knowing who has access, you can't properly protect the data. Identifying data at creation (A), classifying (B), and assigning owners (D) are subsequent steps after understanding access.
10. Q10

    Which of the following should be done FIRST to establish privacy by design when developing a contact-tracing application?

    1. Conduct a privacy impact assessment (PIA).
    2. Conduct a development environment review.
    3. Identify privacy controls for the application.
    4. Identify differential privacy techniques.

    To establish privacy by design when developing a contact-tracing application, the FIRST step is to conduct a Privacy Impact Assessment (PIA) (A). A PIA systematically identifies and addresses privacy risks from the beginning of the development process. This ensures privacy is built into the design rather than added later. Development environment review (B), identifying privacy controls (C), and differential privacy techniques (D) are important but come after the PIA.
11. Q11

    A software development organization with remote personnel has implemented a third-party virtualized workspace to allow the teams to collaborate. Which of the following should be of GREATEST concern?

    1. The third-party workspace is hosted in a highly regulated jurisdiction.
    2. Personal data could potentially be exfiltrated through the virtual workspace.
    3. The organization’s products are classified as intellectual property.
    4. There is a lack of privacy awareness and training among remote personnel.

    The GREATEST concern when a software development organization with remote personnel uses a third-party virtualized workspace is the lack of privacy awareness and training among remote personnel (D). Human error and lack of awareness are primary causes of privacy breaches. Without proper training, personnel may inadvertently expose personal data through the virtual workspace. Highly regulated jurisdiction (A) and data exfiltration risk (B) are concerns but secondary to human factors. Intellectual property classification (C) is not directly privacy-related.
12. Q12

    Which of the following is MOST important when designing application programming interfaces (APIs) that enable mobile device applications to access personal data?

    1. The user’s ability to select, filter, and transform data before it is shared
    2. Umbrella consent for multiple applications by the same developer
    3. User consent to share personal data
    4. Unlimited retention of personal data by third parties

    When designing APIs that enable mobile device applications to access personal data, user consent to share personal data (C) is MOST important. Consent is a fundamental privacy principle - users should have control over their personal data. Without proper consent, data sharing may violate privacy laws. User ability to select/filter data (A) is important but secondary to consent. Umbrella consent (B) is generally not compliant with privacy regulations. Unlimited retention (D) violates storage limitation principles.
13. Q13

    A migration of personal data involving a data source with outdated documentation has been approved by senior management. Which of the following should be done NEXT?

    1. Review data flow post migration.
    2. Ensure appropriate data classification.
    3. Engage an external auditor to review the source data.
    4. Check the documentation version history for anomalies.

    After a migration of personal data involving a data source with outdated documentation has been approved, the NEXT step should be to review data flow post migration (A). This verifies that data was accurately and completely migrated, and that privacy controls are still effective. This is part of post-migration validation. Ensuring appropriate data classification (B) should be done before migration. Engaging external auditor (C) and checking documentation version history (D) may be helpful but are not the immediate next step.
14. Q14

    Which of the following is the PRIMARY objective of privacy incident response?

    1. To ensure data subjects impacted by privacy incidents are notified.
    2. To reduce privacy risk to the lowest possible level
    3. To mitigate the impact of privacy incidents
    4. To optimize the costs associated with privacy incidents

    The PRIMARY objective of privacy incident response is to mitigate the impact of privacy incidents (C). Privacy incidents (e.g., data breaches, unauthorized access) can cause harm to data subjects and the organization. The primary goal is to minimize this harm through timely detection, containment, and remediation. Notifying data subjects (A) is important but is part of mitigation. Reducing risk to lowest level (B) is unrealistic. Optimizing costs (D) is not the primary objective.
15. Q15

    An organization wants to ensure that endpoints are protected in line with the privacy policy. Which of the following should be the FIRST consideration?

    1. Detecting malicious access through endpoints
    2. Implementing network traffic filtering on endpoint devices
    3. Managing remote access and control
    4. Hardening the operating systems of endpoint devices

    When ensuring endpoints are protected in line with the privacy policy, the FIRST consideration should be hardening the operating systems of endpoint devices (D). OS hardening reduces the attack surface and prevents unauthorized access to personal data on endpoints. This is foundational to endpoint security. Detecting malicious access (A), network traffic filtering (B), and managing remote access (C) are important but come after OS hardening.
16. Q16

    When evaluating cloud-based services for backup, which of the following is MOST important to consider from a privacy regulation standpoint?

    1. Data classification labeling
    2. Data residing in another country
    3. Volume of data stored
    4. Privacy training for backup users

    When evaluating cloud-based services for backup, data residing in another country (B) is MOST important from a privacy regulation standpoint. Cross-border data transfers are heavily regulated (e.g., GDPR restricts transfers outside EU). Data residency affects compliance requirements, legal obligations, and data subject rights. Data classification (A), volume of data (C), and privacy training (D) are important but secondary to data residency compliance.
17. Q17

    An organization has a policy requiring the encryption of personal data if transmitted through email. Which of the following is the BEST control to ensure the effectiveness of this policy?

    1. Provide periodic user awareness training on data encryption.
    2. Implement a data loss prevention (DLP) tool.
    3. Conduct regular control self-assessments (CSAs).
    4. Enforce annual attestation to policy compliance.

    The BEST control to ensure the effectiveness of a policy requiring encryption of personal data transmitted through email is to implement a Data Loss Prevention (DLP) tool (B). DLP tools can automatically detect, monitor, and block unauthorized transmission of personal data, ensuring encryption policies are enforced. User awareness training (A) is important but relies on human compliance. Control self-assessments (C) and policy compliance attestation (D) are detective/confiming, not preventive.
18. Q18

    Which of the following is MOST important to include when defining an organization’s privacy requirements as part of a privacy program plan?

    1. Data classification process
    2. Privacy management governance
    3. Privacy protection infrastructure
    4. Lessons learned documentation

    When defining an organization's privacy requirements as part of a privacy program plan, privacy management governance (B) is MOST important to include. Governance defines the framework, roles, responsibilities, and accountability for privacy management. Without proper governance, privacy requirements lack ownership and enforcement. Data classification process (A), privacy protection infrastructure (C), and lessons learned (D) are components but secondary to governance.
19. Q19

    Which of the following is the BEST way to explain the difference between data privacy and data security?

    1. Data privacy protects users from unauthorized disclosure, while data security prevents compromise.
    2. Data privacy protects the data subjects, while data security is about protecting critical assets.
    3. Data privacy is about data segmentation, while data security prevents unauthorized access.
    4. Data privacy stems from regulatory requirements, while data security focuses on consumer rights.

    The BEST way to explain the difference between data privacy and data security is that data privacy protects the data subjects, while data security is about protecting critical assets (B). Data privacy focuses on the rights of individuals whose data is collected (data subjects), ensuring their data is handled according to their expectations and legal requirements. Data security focuses on protecting data from unauthorized access, use, disclosure, disruption, modification, or destruction - regardless of who the data subject is.
20. Q20

    Which of the following should trigger a review of an organization's privacy policy?

    1. Backup procedures for customer data are changed.
    2. Data loss prevention (DLP) incidents increase.
    3. An emerging technology will be implemented.
    4. The privacy steering committee adopts a new charter.

    A privacy steering committee adopting a new charter (D) should trigger a review of an organization's privacy policy. The privacy steering committee is responsible for overseeing privacy strategy and policy. A new charter may change privacy objectives, scope, or approach, necessitating policy updates. Backup procedure changes (A), DLP incident increases (B), and emerging technology implementation (C) may trigger policy review but are not as comprehensive as a steering committee charter change.
21. Q21

    A web-based payment service is adding a requirement for biometric authentication. Which risk factor is BEST mitigated by this practice?

    1. User validation failures when reconnecting after lost sessions
    2. Zero-day attacks and exploits
    3. Identity spoofing by unauthorized users
    4. Legal liability from the misuse of accounts

    Adding biometric authentication to a web-based payment service BEST mitigates the risk of identity spoofing by unauthorized users (C). Biometric authentication provides strong proof of identity that is difficult to fake or steal (unlike passwords). This directly addresses the risk of unauthorized users impersonating legitimate users. User validation failures (A), zero-day attacks (B), and legal liability (D) are not directly mitigated by biometric authentication.
22. Q22

    Which of the following should be the FIRST consideration when selecting a data sanitization method?

    1. Risk tolerance
    2. Implementation cost
    3. Industry standards
    4. Storage type

    The FIRST consideration when selecting a data sanitization method should be the storage type (D). Different storage types (magnetic disk, SSD, flash memory, optical media) require different sanitization methods to ensure complete data removal. What works for HDD may not work for SSD. Risk tolerance (A), implementation cost (B), and industry standards (C) are important but secondary to matching the method to the storage type.
23. Q23

    Which of the following is the MOST critical action for an organization prior to tracking user activity in its applications?

    1. Providing notification to users of the organization’s privacy policies
    2. Establishing a data classification scheme
    3. Identifying and validating users’ countries of residence
    4. Requesting users to read and accept the organization's privacy notice

    The MOST critical action for an organization prior to tracking user activity in its applications is requesting users to read and accept the organization's privacy notice (D). This ensures transparency and obtains informed consent before data collection begins. This is a fundamental privacy principle. Providing notification (A), establishing data classification (B), and identifying user countries (C) are important but come after obtaining user consent/acceptance.

Answer all 229 questions with instant feedback →

Reader reviews 164 ratings

• The CDPSE explanations are detailed and educational. I learned more from reviewing wrong answers than from any book.

  ★★★★★★ Rachel S.

• My colleague recommended this for CDPSE and I’m glad I listened. Passed on my first go after two weeks of solid study.

  ★★★★★ Logan T.

• The CDPSE explanations are gold. I learned almost as much from reviewing wrong answers as from the correct ones.

  ★★★★★★ Julian M.

• Straight to the point. No filler, just good CDPSE practice questions with clear explanations. Exactly what I needed.

  ★★★★★★ Paisley K.

• I bought access for the CDPSE exam as a gift for my brother. He passed on his first try and said the questions were spot-on.

  ★★★★★★ Cameron J.

• Good range of difficulty levels in the CDPSE bank. Easy questions build confidence, hard ones prepare you for the real thing.

  ★★★★★★ Avery K.

Frequently asked questions

Free study resources

Community-verified analysis of 31 questions from real test-taker discussions — 12 deep analyses and 20 FAQs.

More ISACA exams