ISACA Certification
62 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The ISACA Data Privacy Solutions Engineer (CDPSE) certification validates professional expertise in ISACA technologies. This study guide covers all 62 practice questions from our CDPSE practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
What is the primary purpose of a Data Privacy Impact Assessment (DPIA)?
A DPIA is a systematic process designed to identify and evaluate privacy risks associated with high-risk processing activities, helping organizations mitigate potential harms to data subjects.
Under GDPR, which of the following is NOT a lawful basis for processing personal data?
GDPR requires one of six specific lawful bases (consent, contract, legal obligation, vital interests, public task, or legitimate interests). Processor convenience is not a lawful basis under any circumstances.
What is the maximum fine for Category A violations under GDPR?
GDPR Article 83 specifies that the highest category of violations (Category A) can result in fines up to €20 million or 4% of annual global turnover, whichever is higher.
In the context of California Consumer Privacy Act (CCPA), what does the 'right to delete' entitle a consumer to request?
The CCPA grants consumers the right to request deletion of personal information collected, though businesses may retain data necessary for legal compliance, fraud prevention, or security purposes.
Which principle requires that personal data should only be collected for specified, explicit, and legitimate purposes?
Purpose limitation is a core data protection principle that restricts the use of personal data to the purposes for which it was originally collected and disclosed to the data subject.
What is a key distinction between Privacy by Design and Privacy by Default?
Privacy by Design integrates privacy into system architecture and processes, while Privacy by Default ensures that the most privacy-protective settings are enabled automatically without requiring user intervention.
Under HIPAA, what is the primary purpose of the Security Rule?
HIPAA's Security Rule sets standards for administrative, physical, and technical safeguards required to protect the confidentiality, integrity, and availability of ePHI in healthcare systems.
Which of the following best describes the concept of 'data minimization'?
Data minimization requires organizations to collect and process only the minimum amount of personal data necessary to achieve the stated purpose, balancing utility with privacy protection.
In a Data Processing Agreement (DPA), who is typically responsible for ensuring data security measures are implemented?
A DPA typically obligates the processor to implement appropriate technical and organizational security measures based on the controller's specifications and risk assessment requirements.
What is the primary difference between anonymization and pseudonymization?
Anonymized data cannot identify individuals even with additional information, while pseudonymized data requires a key or additional information to re-identify individuals, making anonymization the stronger form of de-identification.
Which regulation specifically addresses privacy rights for residents of Brazil?
LGPD is Brazil's comprehensive data protection law that applies to organizations processing personal data of Brazilian residents, similar in scope to GDPR but with jurisdiction-specific requirements.
In designing a privacy-compliant system, which element is most critical for establishing trust with data subjects?
Trust is built through transparency—clear disclosure of data practices, accessible privacy policies, and meaningful control options enable data subjects to make informed decisions about their information.
What is the significance of the 'right to be forgotten' under GDPR Article 17?
The right to be forgotten grants individuals the right to request deletion of their personal data when it's no longer necessary for its original purpose or when consent is withdrawn, though exceptions exist for legal obligations and legitimate business interests.
Which approach to data governance emphasizes the need to document data lineage and establish clear ownership?
Effective data governance requires clear documentation of data lineage, defined ownership structures, stewardship roles, and accountability mechanisms to ensure proper handling and enable regulatory compliance.
Under what circumstances must a Data Protection Impact Assessment (DPIA) be mandatory?
GDPR Article 35 mandates DPIAs for high-risk processing including large-scale processing of special categories of data, automated decision-making with legal effects, and systematic monitoring of public spaces.
What is the primary goal of implementing encryption in a data privacy solution?
Encryption transforms data into an unreadable format that can only be accessed with proper cryptographic keys, providing a critical safeguard against unauthorized disclosure and data breaches.
In the context of vendor risk management for privacy, which factor is most important when evaluating a third-party processor?
Effective vendor evaluation requires thorough assessment of demonstrated security practices, contractual protections, audit history, and ability to meet specific data protection requirements rather than relying on reputation or cost alone.
What does the concept of 'data portability' enable individuals to do under GDPR?
The right to data portability (Article 20, GDPR) allows individuals to obtain and reuse their personal data across different services by receiving it in machine-readable format, facilitating switching between service providers.
When implementing a privacy-preserving analytics solution, which technique allows analysis without exposing individual records?
Differential privacy adds controlled noise to query results, enabling statistical analysis and insights while mathematically guaranteeing that individual records cannot be re-identified, balancing utility with privacy protection.
What is the primary purpose of conducting regular privacy compliance audits?
Privacy audits systematically assess compliance with regulations, evaluate the effectiveness of privacy controls, identify vulnerabilities, and recommend improvements to maintain ongoing compliance and reduce risk.
In a healthcare setting, which of the following best represents a violation of the minimum necessary standard under HIPAA?
The minimum necessary principle requires accessing and using only the specific health information needed for the particular task; accessing broader records than necessary violates this standard and increases privacy risk.
Which of the following best describes the relationship between privacy and cybersecurity in a comprehensive data protection strategy?
While distinct disciplines, privacy and cybersecurity are interdependent—privacy governance establishes requirements and principles, while cybersecurity provides the technical controls needed to enforce and maintain privacy protections.
What is a key consideration when designing consent mechanisms for digital privacy compliance?
GDPR requires affirmative, granular consent that is freely given without coercion or pre-selection; users must explicitly opt-in to each processing purpose, and consent cannot be inferred from inaction or bundled with service terms.
In which scenario would a Data Controller likely need to appoint a Data Protection Officer (DPO)?
GDPR Article 37 requires DPO appointment for public sector organizations and private organizations whose core activities involve large-scale or systematic monitoring, processing of sensitive data, or data requiring regular supervision.
What is the primary objective of implementing role-based access control (RBAC) in a privacy-compliant system?
RBAC implements the principle of least privilege by restricting data access to individuals whose job roles require it, reducing the attack surface and limiting potential harm from compromised accounts or insider threats.
Which regulation primarily focuses on the protection of personal data in the European Union and applies extraterritorially to organizations worldwide?
The General Data Protection Regulation (GDPR) is the EU's comprehensive data protection law that applies to any organization processing personal data of EU residents, regardless of where the organization is located.
In the context of data privacy, what is the primary purpose of a Data Processing Agreement (DPA)?
A DPA is a legally binding contract that clarifies the relationship between a data controller and data processor, specifying how personal data must be handled and protected.
What does the principle of 'data minimization' require organizations to do?
Data minimization is a core GDPR principle requiring organizations to collect only what is necessary, avoid collecting excessive data, and not retain data longer than needed.
Under GDPR, what is the maximum fine that can be imposed for the most severe violations?
GDPR imposes tiered penalties, with the highest tier being €20 million or 4% of annual global revenue (whichever is higher) for violations of core principles and rights.
Which of the following best describes the concept of 'Privacy by Design'?
Privacy by Design is a foundational principle requiring organizations to implement data protection measures proactively throughout the entire lifecycle of a product or service, not as an afterthought.
What is the primary difference between a data controller and a data processor under GDPR?
Under GDPR, the controller decides why and how personal data is processed, while the processor acts on the controller's instructions and handles the actual processing activities.
In the California Consumer Privacy Act (CCPA), what right allows consumers to request that a business delete personal information collected from them?
The CCPA's Right to Delete enables California residents to request deletion of personal information collected from them, subject to certain exceptions.
What is the primary objective of a Data Protection Impact Assessment (DPIA)?
A DPIA is a systematic process to evaluate the potential privacy and security risks of a new processing activity and determine appropriate safeguards before implementation.
Which of the following is NOT a lawful basis for processing personal data under GDPR Article 6?
Under GDPR, legitimate marketing purposes alone do not constitute a lawful basis without explicit consent or another valid basis. Organizations must have one of the six lawful bases from Article 6.
What is the primary requirement for obtaining valid consent under GDPR?
Valid GDPR consent must be freely given, specific, informed, and obtained through an affirmative action (opt-in), not pre-ticked boxes or silence.
Under the GDPR, within what timeframe must an organization respond to a data subject access request?
GDPR requires organizations to respond to access requests within one month, which can be extended by two additional months for complex or numerous requests.
Which framework is commonly used to assess an organization's privacy maturity and identify gaps in data protection controls?
Privacy maturity models help organizations evaluate their current state of privacy practices and identify areas for improvement, typically through staged levels of capability.
What is the primary purpose of pseudonymization in data privacy solutions?
Pseudonymization reduces the ability to identify individuals by replacing identifiers with pseudonyms, reducing privacy risk while allowing data to be processed for statistical purposes.
Which of the following is a key requirement under HIPAA for protecting patient health information?
HIPAA requires a comprehensive approach with administrative, physical, and technical safeguards to protect PHI, rather than relying on a single method.
In the context of privacy solutions, what is 'data residency'?
Data residency refers to regulatory or contractual requirements that personal data must be stored, processed, or maintained within certain geographic locations or countries.
What does the principle of 'accountability' require organizations to demonstrate under GDPR?
Accountability under GDPR requires organizations to implement measures and maintain documentation proving they comply with data protection principles, not just claiming compliance.
Which regulation specifically addresses the protection of payment card data and is enforced by major credit card brands?
The Payment Card Industry Data Security Standard (PCI DSS) establishes requirements for organizations that handle credit card information to prevent fraud and data breaches.
What is a 'privacy notice' or 'privacy policy' primarily designed to communicate?
A privacy policy transparently informs individuals how their personal data is handled, what rights they have, and how they can exercise those rights.
In the context of data privacy, what does 'lawful basis' mean under GDPR Article 6?
GDPR identifies six lawful bases (consent, contract, legal obligation, vital interests, public task, and legitimate interests) that must exist for personal data processing to be legal.
Which of the following best describes 'data subject rights' under GDPR?
GDPR grants individuals comprehensive rights over their personal data, including the right to access, correct, delete, restrict processing, object, and port their data.
What is the primary goal of implementing role-based access control (RBAC) in a privacy-focused data system?
RBAC implements the principle of least privilege, ensuring employees access only the data required for their role, thereby reducing exposure and privacy risks.
Under GDPR, when must organizations report a personal data breach to supervisory authorities?
GDPR mandates breach notification to authorities within 72 hours of discovery, unless a risk assessment determines the breach poses low risk to individuals' rights.
What is the primary advantage of using encryption as a privacy-enhancing technology?
Encryption transforms readable data into unreadable ciphertext using cryptographic keys, protecting confidentiality if data is compromised, though it must be part of a comprehensive security strategy.
Which of the following is a key consideration when designing a data retention policy compliant with GDPR?
GDPR's storage limitation principle requires data to be kept only as long as necessary; retention policies must align with lawful purposes and include deletion timelines.
What is the primary purpose of conducting regular privacy audits in an organization?
Privacy audits systematically evaluate whether an organization's privacy controls are functioning effectively and complying with applicable regulations and internal policies.
Under GDPR, what must organizations include in a Data Protection Impact Assessment when processing poses high privacy risks?
When a DPIA identifies risks that cannot be adequately mitigated, GDPR requires organizations to consult with the supervisory authority before proceeding with the processing.
Which principle requires that personal data be handled in a manner that ensures appropriate security, including protection against unauthorized processing?
The integrity and confidentiality principle under GDPR requires organizations to implement appropriate technical and organizational measures to protect personal data from unauthorized processing, damage, and loss.
When implementing a Data Protection Impact Assessment (DPIA), which of the following is the PRIMARY purpose of documenting processing activities?
A DPIA's primary purpose is to identify and mitigate privacy risks prospectively by mapping data flows, processing activities, and potential impacts before a system goes live. This enables organizations to design privacy controls into systems from the outset.
Which encryption approach is MOST appropriate when an organization needs to search encrypted healthcare data without decrypting it first?
Homomorphic encryption allows computations to be performed directly on encrypted data, returning encrypted results that decrypt to the correct answer. This is ideal for searching or analyzing sensitive data without exposure, though it has performance trade-offs.
Under GDPR, what is the lawful basis that requires organizations to balance their legitimate interests against data subjects' rights and freedoms?
Legitimate interests as a lawful basis requires a three-part balancing test: identifying the organization's interest, determining its necessity, and weighing it against data subjects' rights. This basis is flexible but demands careful justification and impact assessment.
Which of the following best describes the relationship between pseudonymization and anonymization in privacy engineering?
Pseudonymization replaces identifiers with pseudonyms, reducing direct identifiability but remaining reversible with a key. Anonymization is irreversible removal of identifiers such that re-identification is not reasonably feasible. GDPR treats pseudonymized data as still requiring protection.
In designing a consent management platform (CMP), which architectural principle is MOST critical to prevent consent inflation or unauthorized scope expansion?
Immutable audit logs with cryptographic verification ensure that all consent modifications are recorded and cannot be tampered with, providing proof of what consent was given and when. This prevents scope creep and supports regulatory accountability.
Which California Consumer Privacy Act (CCPA) requirement is MOST likely to conflict with traditional marketing attribution practices?
CCPA's deletion right (with narrow exceptions) conflicts with retention practices needed for marketing attribution, fraud detection, and legal compliance. Organizations must balance immediate deletion requests against legitimate business and legal needs, often requiring data minimization redesign.
When implementing Privacy by Design principles in a cloud infrastructure, what is the PRIMARY advantage of using differential privacy techniques?
Differential privacy adds calibrated noise to datasets, allowing accurate aggregate statistics while mathematically guaranteeing that the presence or absence of any individual's record cannot be reliably inferred. This balances utility with privacy protection.
Which of the following is a PRIMARY distinction between HIPAA and GDPR in their approach to sensitive health data?
GDPR generally prohibits processing special categories of data (including health) unless explicit consent is given or specific exceptions apply. HIPAA's treatment rule allows covered entities to process health data for treatment, payment, and operations without explicit authorization, reflecting different regulatory philosophies.
In a multi-party data sharing arrangement, which technical approach BEST ensures that participating organizations can audit their own data usage without exposing other parties' data?
Federated learning combined with secure multi-party computation allows organizations to train models or perform analytics collaboratively without sharing raw data. Each party computes locally, shares only encrypted gradients or results, and can audit their own contribution independently.
What is the key compliance challenge when an organization must comply with both GDPR's right to portability and CCPA's right to know?
GDPR's Article 20 requires data in a structured, commonly-used, machine-readable format suitable for portability, while CCPA requires a more flexible format but both impose tight timelines. Organizations serving both jurisdictions must design disclosure systems that satisfy both requirements' different specifications.
You've reviewed all 62 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free