ISACA CDPSE Practice Test

Answer choices

1. A. Choose privacy products and controls first, then map their capabilities to framework categories for reporting, under this approach.
2. B. Define the target privacy outcomes and gap priorities first, then select controls and technologies that support those outcomes, as configured.
3. C. Standardize one technical implementation across subsidiaries and permit local variation only for documented legal exceptions, as the selected response to the described condition.
4. D. Treat alignment to a recognized privacy framework as evidence that applicable legal obligations are satisfied, under the proposed approach.

Wrong-answer review

• A. Choose privacy products and controls first, then map their capabilities to framework categories for reporting, under this approach.: This choice is insufficient in the stated context. Product mapping can document coverage, but it reverses the risk- and outcome-driven logic of framework use. Although “Choose privacy products and controls first, then map their capabilities to framework categories for reporting” may have value elsewhere, the governing test here is using a privacy framework to describe current and target outcomes, prioritize gaps, and integrate privacy risk with enterprise governance rather than treating the framework as a compliance checklist.
• C. Standardize one technical implementation across subsidiaries and permit local variation only for documented legal exceptions, as the selected response to the described condition.: The scenario does not support option C as the best answer. A baseline can help governance, but implementation also needs to reflect risk, technology, processing, and business context. “Standardize one technical implementation across subsidiaries and permit local variation only for documented legal exceptions” is secondary to the requirement to address using a privacy framework to describe current and target outcomes, prioritize gaps, and integrate privacy risk with enterprise governance rather than treating the framework as a compliance checklist.
• D. Treat alignment to a recognized privacy framework as evidence that applicable legal obligations are satisfied, under the proposed approach.: Option D addresses a neighboring concern rather than the primary one. Frameworks organize risk management but are not automatic legal safe harbors. The scenario turns on using a privacy framework to describe current and target outcomes, prioritize gaps, and integrate privacy risk with enterprise governance rather than treating the framework as a compliance checklist, which “Treat alignment to a recognized privacy framework as evidence that applicable legal obligations are satisfied” does not resolve.

Answer choices

1. A. Use the organization’s cybersecurity likelihood and impact matrix for privacy risks so both programs can be compared directly, under the stated decision criteria.
2. B. Rate impact primarily through regulatory, litigation, and brand consequences to the organization, then note individual harms qualitatively, in context.
3. C. Prioritize controls based on the highest technical vulnerability scores before separately documenting the underlying processing risk, as the selected response to the described condition.
4. D. Frame the business objective and map the proposed data processing before prioritizing risks and selecting controls, under the described privacy risk management and compliance (18%) criteria.

Answer choices

1. A. Define data-quality criteria for external enrichment, including provenance, recency, match confidence, and remediation or rejection thresholds, for the stated implementation and support requirements.
2. B. Validate format and required fields at ingestion, then rely on source-system owners to correct semantic inaccuracies later, for the stated requirement.
3. C. Correct inaccurate values in the reporting layer first while a backlog is created to address upstream causes, for the described technical objective and its associated operational control requirements, for this task.
4. D. Overwrite conflicting values with the highest-ranked reference source so downstream systems receive one consistent answer, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.

Answer choices

1. A. Use high-assurance identity proofing for every privacy request to minimize the chance of disclosure to an impostor, for the described technical objective and its associated operational control requirements.
2. B. Search the authoritative system of record first and treat processor or archive searches as exception handling when the requester identifies a gap, for the specified implementation requirement.
3. C. Correct the master record promptly and rely on normal synchronization schedules to update downstream systems, for the described technical objective and its associated operational control requirements, under this approach.
4. D. Determine which data falls within the applicable portability right and provide that data in the required usable format without automatically including unrelated internal inferences.

Answer choices

1. A. Collect detailed audit events but rely on incident-driven review instead of continuous alerting for privacy-relevant anomalies, for consideration.
2. B. Permit privileged administrators to manage both the monitored service and its audit-retention configuration to simplify support, under this approach.
3. C. Protect log integrity and restrict alteration so privileged activity remains independently auditable, for the described technical objective and its associated operational control requirements.
4. D. Retain detailed logs on the same schedule as the primary business records so investigations have consistent historical coverage, for the stated scenario.

Answer choices

1. A. Use the existing cyber threat model and add personal-data assets so privacy and security teams can maintain one threat register, for the described technical objective and its associated operational control requirements, in context.
2. B. Prioritize privacy vulnerabilities using exploitability and technical exposure, then assess individual consequences during remediation planning, within the documented scope, ownership, and validation boundaries.
3. C. Identify overbroad API disclosure as a data-minimization and access-control weakness and redesign the response around purpose-necessary fields, within the documented operational, security, ownership, and validation requirements.
4. D. Reduce the privacy-risk rating when strong encryption and access controls make unauthorized disclosure unlikely, as the selected response to the described condition.

Answer choices

1. A. Encrypt the transfer end to end while sending the recipient the full available record to simplify reconciliation, for the specified implementation requirement.
2. B. Use a standard transfer or processing template without validating whether its mechanism and clauses match the actual jurisdictions and roles, in the described situation.
3. C. Use a strong confidentiality agreement and security schedule as the primary control while leaving processing purposes and return/deletion terms general, as the selected response to the described condition.
4. D. Do not follow the expanded disclosure until the controller validates the new purpose, recipient, contractual authorization, and any required safeguards, under the stated decision criteria.

Answer choices

1. A. Design the collection around aggregate or otherwise disassociated occupancy signals instead of persistent employee-level tracking, within the defined security and accountability boundaries.
2. B. Expand the privacy notice to describe the optional processing in more detail while retaining the same default behavior, for consideration.
3. C. Obtain a single onboarding consent covering all optional purposes and retain it as the user’s preference until withdrawal, within this context.
4. D. Strengthen encryption and access controls while leaving the purpose, collection scope, and default settings unchanged, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. Bring the shadow cloud assets into governance, identify the data and owner, and remediate or remove unauthorized copies, under organization-wide implementation-governance requirements.
2. B. Use annual owner questionnaires as the authoritative inventory and reconcile only high-risk findings with technical discovery, in context.
3. C. Exclude ephemeral compute from the personal-data asset inventory when no persistent volume is attached, within the documented operational, security, ownership, and validation requirements.
4. D. Track deployed models and model owners but keep training-data lineage in the separate data-governance catalog, within the described operational context.

Answer choices

1. A. Report a single enterprise average for each KPI and investigate material outliers outside the executive dashboard, for the described technical objective.
2. B. Pair completion data with behavior and outcome metrics, investigate the adverse trend, and adjust training or controls based on root cause, under this approach.
3. C. Track program outcomes against historical trends without explicit thresholds because risk tolerance changes over time, as the selected approach for the stated technical and business outcome.
4. D. Use confirmed regulatory findings as the primary lagging outcome measure and treat internal control indicators as operational detail, as the proposed privacy risk management and compliance (18%) approach.