ISACA CDPSE Practice Test

Answer choices

1. A. Search the authoritative system of record first and treat processor or archive searches as exception handling when the requester identifies a gap.
2. B. Correct the master record promptly and rely on normal synchronization schedules to update downstream systems.
3. C. Use high-assurance identity proofing for every privacy request to minimize the chance of disclosure to an impostor.
4. D. Use the data inventory and processor relationships to search all relevant processing locations, then review the response for applicable limits before disclosure.

Wrong-answer review

• A. Search the authoritative system of record first and treat processor or archive searches as exception handling when the requester identifies a gap.: This option is not the most defensible choice. A system of record is a useful starting point, but rights fulfillment must cover in-scope data across the actual processing ecosystem. “Search the authoritative system of record first and treat processor or archive searches as exception handling when the requester identifies a gap” fails to resolve the part of the scenario governed by operationalizing rights with identity assurance, scope determination, data discovery, exemptions, response tracking, and propagation across relevant systems.
• B. Correct the master record promptly and rely on normal synchronization schedules to update downstream systems.: Option B is a reasonable adjacent action, but not the controlling one. Master-data correction is useful but may not fulfill rectification if downstream processing continues using inaccurate data. These facts are resolved by operationalizing rights with identity assurance, scope determination, data discovery, exemptions, response tracking, and propagation across relevant systems, which this choice does not accomplish.
• C. Use high-assurance identity proofing for every privacy request to minimize the chance of disclosure to an impostor.: This choice is insufficient in the stated context. Identity verification is necessary, but assurance should be proportionate so it does not create unnecessary collection or barriers to exercising rights. Although “Use high-assurance identity proofing for every privacy request to minimize the chance of disclosure to an impostor” may have value elsewhere, the governing test here is operationalizing rights with identity assurance, scope determination, data discovery, exemptions, response tracking, and propagation across relevant systems.

Answer choices

1. A. Select the control that produces the largest theoretical risk reduction even if it materially impairs the approved business objective.
2. B. Change or avoid the vendor unless the risk can be reduced to an approved level through enforceable terms and verified controls.
3. C. Accept the residual risk at the project level when expected business value exceeds estimated organizational loss.
4. D. Transfer operational responsibility to a processor through contract and treat the remaining risk as owned by the vendor.

Answer choices

1. A. Use the full source dataset for model development and apply aggregation only to the final reports released to users.
2. B. De-identify direct identifiers before analysis and rely on contractual controls for remaining quasi-identifiers.
3. C. Evaluate the differential-privacy mechanism formally, including parameters and repeated-query composition, rather than treating arbitrary noise as a privacy guarantee.
4. D. Restrict model access to a small analytics team while retaining the same features, labels, retention, and secondary-use scope.

Answer choices

1. A. Treat successful deployment reporting as remediation evidence and verify only systems where scanning later detects the vulnerability again.
2. B. Prioritize patches by age within each severity band so the process remains predictable and auditable.
3. C. Harden approved images at build time and use image versioning as the main evidence that running systems remain compliant.
4. D. Establish secure configuration baselines and monitor drift so hardening remains effective after deployment.

Answer choices

1. A. Obtain a single onboarding consent covering all optional purposes and retain it as the user’s preference until withdrawal.
2. B. Provide purpose-specific choices so an individual can permit one optional processing activity without being forced to permit the others.
3. C. Complete a PIA immediately before release while leaving privacy requirements outside the earlier design and development gates.
4. D. Strengthen encryption and access controls while leaving the purpose, collection scope, and default settings unchanged.

Answer choices

1. A. Prioritize privacy vulnerabilities using exploitability and technical exposure, then assess individual consequences during remediation planning.
2. B. Reduce the privacy-risk rating when strong encryption and access controls make unauthorized disclosure unlikely.
3. C. Use the existing cyber threat model and add personal-data assets so privacy and security teams can maintain one threat register.
4. D. Identify the broken object-level authorization as a vulnerability that can enable unauthorized disclosure and prioritize corrective access control.

Answer choices

1. A. Keep the current collection scope but pseudonymize or encrypt the data before downstream use.
2. B. Keep the current data scope but shorten retention and tighten access to reduce exposure.
3. C. Keep the current fields and frequency but obtain more explicit notice or consent for the processing.
4. D. Redesign logging to exclude or redact request-body personal data when those fields are unnecessary for the monitoring purpose.

Answer choices

1. A. Choose the PET with the strongest theoretical privacy guarantee and adapt the business computation around its limitations.
2. B. Keep raw data local through federated learning and treat the architecture as sufficient without analyzing information leakage from model updates.
3. C. Evaluate the synthetic-data generation method for memorization and reidentification risk before treating outputs as safe for broader use.
4. D. Add calibrated-looking statistical noise to outputs but do not define or account for a formal privacy parameter across repeated releases.

Answer choices

1. A. Report a single enterprise average for each KPI and investigate material outliers outside the executive dashboard.
2. B. Use confirmed regulatory findings as the primary lagging outcome measure and treat internal control indicators as operational detail.
3. C. Report risk-weighted overdue vendor findings and trend them against thresholds rather than treating review completion as the outcome.
4. D. Emphasize completion and volume metrics because they are consistently measurable across business units.

Answer choices

1. A. Inventory authoritative applications and databases first, treating logs, exports, and integration paths as supporting technical detail.
2. B. Reconcile owner attestations with technical discovery and investigate discrepancies rather than treating either source as automatically complete.
3. C. Reconcile the inventory annually and require projects to report only material new systems between cycles.
4. D. Map the primary business dataflow and rely on infrastructure diagrams for replicas, backups, and observability paths.