Free CDPSE Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CDPSE Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under the GDPR definition, when can an online identifier constitute personal data?

   1. A. When it relates to a person identifiable directly or indirectly.
   2. B. When it contains the person's full legal name in readable form.
   3. C. When it has been verified against a government identity record.
   4. D. When it identifies a person without reference to any other data.

   Answer: A

   Explanation: Article 4(1) refers to someone who can be identified "directly or indirectly" and expressly includes "an online identifier". A readable name, government verification, or identification from the identifier alone is unnecessary.

   Reference: General Data Protection Regulation (Regulation (EU) 2016/679) — Article 4(1)

2. 2A service processes data exactly as designed and has no cybersecurity incident, but its inferences cause individuals to feel surveilled. Under NIST Privacy Framework 1.0, how should this be treated?

   1. A. As a privacy concern only after a confidentiality breach occurs.
   2. B. As an operational concern that falls outside privacy risk assessment.
   3. C. As a potential privacy risk arising from intended data processing.
   4. D. As a privacy concern only if the service violates a specific law.

   Answer: C

   Explanation: Section 1.2.1 explains that "privacy risks can also arise by means unrelated to cybersecurity incidents". Intended processing can adversely affect people; a security incident or proven legal violation is unnecessary.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Section 1.2.1, page 3

3. 3A privacy engineer needs to show how personal data move through collection, transformation, disclosure, and disposal across system components. Which artifact described in NIST SP 800-53 CM-13 fits this need?

   1. A. A data dictionary defining the meanings and formats of individual fields.
   2. B. A database schema showing tables, keys, and structural relationships.
   3. C. A network topology diagram showing communication links among hosts.
   4. D. A data-action map linking processing, data elements, and components.

   Answer: D

   Explanation: CM-13 requires a "map of system data actions", including processed data elements, involved components, and owners or operators. A dictionary defines fields, a schema defines database structure, and a network topology describes links; none by itself supplies the required life-cycle processing map.

   Reference: Security and Privacy Controls for Information Systems and Organizations — CM-13, pages 113–114

4. 4A privacy engineer is reviewing a Software as a Service offering under NIST SP 800-145. Which management arrangement characterizes SaaS?

   1. A. The consumer manages guest operating systems and installs arbitrary software.
   2. B. The consumer uses provider applications with limited user-specific configuration.
   3. C. The consumer manages the provider's physical servers and datacenter network.
   4. D. The consumer deploys its own applications onto a provider-managed platform.

   Answer: B

   Explanation: The SaaS definition provides use of "the provider’s applications running on a cloud infrastructure" with possible "limited userspecific application configuration settings". Managing guest operating systems characterizes IaaS; deploying consumer applications characterizes PaaS.

   Reference: The NIST Definition of Cloud Computing — Section 2, Service Models, SaaS, page 2

5. 5A company stores personal data without altering or analysing it. How does the GDPR classify this activity?

   1. A. As processing only if the records are subsequently disclosed.
   2. B. As processing because storage is a listed processing operation.
   3. C. As processing only if an automated decision uses the records.
   4. D. As processing only if the records are combined with new data.

   Answer: B

   Explanation: Article 4(2) includes "collection, recording, organisation, structuring, storage" within processing. Storage itself qualifies; disclosure, automated decisions, and combination are unnecessary.

   Reference: General Data Protection Regulation (Regulation (EU) 2016/679) — Article 4(2)

6. 6A privacy risk assessment identifies embarrassment and customer abandonment. How does NIST Privacy Framework 1.0 distinguish their typical impacts?

   1. A. Both are direct impacts on individuals, rather than resulting impacts on an organization.
   2. B. Embarrassment directly affects organizations; customer abandonment directly affects individuals.
   3. C. Both are direct impacts on organizations, rather than direct impacts on individuals.
   4. D. Embarrassment directly affects individuals; customer abandonment is a resulting organizational impact.

   Answer: D

   Explanation: Section 1.2.1 states that individuals "experience the direct impact of problems" and describes organizational "revenue loss arising from customer abandonment". The framework connects these levels rather than treating them as interchangeable.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Section 1.2.1 and Figure 3, page 4

7. 7Personal data are migrated from an internal database to a different processing platform. Under an organization's adoption of NIST SP 800-53 CM-12, what inventory-related update is needed?

   1. A. Document the changed locations where the information is processed and stored.
   2. B. Keep the original information locations until the old servers are sold.
   3. C. Record only the new platform's purchase date in the asset ledger.
   4. D. Remove the information from the inventory because it has been migrated.

   Answer: A

   Explanation: CM-12(c) requires organizations to "Document changes to the location" where information is processed and stored. Migration changes information location, which a purchase entry or removal from inventory does not accurately represent.

   Reference: Security and Privacy Controls for Information Systems and Organizations — CM-12(c), page 113

8. 8Under NIST SP 800-145's Platform as a Service model, which layer does the consumer control when reviewing responsibility for a personal-data application?

   1. A. The provider's physical network and server hardware.
   2. B. The provider's operating system and storage infrastructure.
   3. C. The deployed application and possibly hosting configuration.
   4. D. The provider's datacenter facilities and physical access system.

   Answer: C

   Explanation: PaaS gives the consumer "control over the deployed applications and possibly configuration settings for the application-hosting environment". The underlying network, servers, operating systems, and storage remain outside the consumer’s management.

   Reference: The NIST Definition of Cloud Computing — Section 2, Service Models, PaaS, pages 2–3

9. 9A GDPR-covered service relies on consent for optional processing. Which mechanism provides the affirmative indication required by the definition of consent?

   1. A. Treating an unanswered request as agreement after seven days.
   2. B. Treating a preselected box as agreement unless it is cleared.
   3. C. Asking the informed user to select an initially unticked box.
   4. D. Inferring agreement from failure to read an available notice.

   Answer: C

   Explanation: Article 4(11) requires an indication "by a statement or by a clear affirmative action". Selecting an initially unticked box supplies that action, assuming consent is also freely given, specific and informed. Silence and preselection do not.

   Reference: General Data Protection Regulation (Regulation (EU) 2016/679) — Article 4(11)

10. 10According to NIST Privacy Framework 1.0's glossary, risk is typically a function of which two factors?

    1. A. The likelihood of an event and its adverse impact.
    2. B. The likelihood of an event and the number of vulnerabilities.
    3. C. The adverse impact of an event and the number of exposed records.
    4. D. The likelihood of an event and the number of installed controls.

    Answer: A

    Explanation: The glossary defines risk as typically a function of "the adverse impacts" and "the likelihood of occurrence". Vulnerabilities, exposed records, and controls can inform analysis but do not replace the likelihood-and-impact pair.

    Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix B, Risk, page 30