Question bank
ISACA CDPSE
41 ISACA CDPSE questions with the correct answer and a written explanation, organised across 4 exam domains.
- 41 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Data Life Cycle Management
9 questions in this domain
- Question 1Single Choice
In the CDPSE framework, what is the primary purpose of creating and maintaining a data inventory?
- AStructured record of personal data, locations, purposes, and legal basesCorrect answer
- BDiagram of network connections and packet flows
- CList of software licenses and hardware assets
- DList of employee salaries and performance reviews
Why this is the answer
A data inventory is a structured record of personal data, including location, purposes, legal bases, retention, and data subject categories, enabling governance and compliance.
- Question 2Multiple Select
Which factors should drive the classification of personal data in a privacy context?
- APotential harm to the data subjectCorrect answer
- BProcessing context and regulatory impactCorrect answer
- COnly the organization's trade secret value
- DDatabase vendor's support tier
Why this is the answer
Classification in privacy must consider data subject harm, processing context, and regulatory impact. Trade secret value alone is not sufficient.
- Question 3Interactive
Review the data inventory entry in the code block. Which privacy-specific attribute is missing?
- ALawful basisCorrect answer
- BIP address
- CServer room location
- DDatabase version
Why this is the answer
A privacy data inventory must document lawful basis, not just system details such as owner, format, and location.
- Question 4Single Choice
Which foundational artifact visually represents the movement of personal data across systems, vendors, and jurisdictions?
- AData-flow mapCorrect answer
- BData inventory
- CClassification scheme
- DRetention schedule
Why this is the answer
A data-flow map traces movement from collection through sharing, storage, and destruction, including third parties and jurisdictions.
- Question 5Multiple Select
Which events should trigger an update to data inventories and data-flow maps?
- ADeployment of a new systemCorrect answer
- BAmendment of a third-party contractCorrect answer
- CAdoption of a new privacy regulationCorrect answer
- DReplacement of a network router
Why this is the answer
New systems, third-party changes, and regulatory updates change processing; inventory and flow maps must be revised to remain accurate.
- Question 6Interactive
Identify the foundational artifact represented in the code block.
- AData-flow mapCorrect answer
- BData inventory
- CData classification scheme
- DConsent log
Why this is the answer
The code block describes sources, destinations, and transfers, which are the defining properties of a data-flow map.
- Question 7Single Choice
What does the principle of collection limitation require an organization to do?
- ACollect only data needed for the stated purposeCorrect answer
- BCollect as much data as possible for later analytics
- CCollect data without documenting a lawful basis
- DCollect data after receiving an informal request
Why this is the answer
Collection limitation requires gathering only data that is adequate and necessary for the stated purpose; extra collection is prohibited.
- Question 8Multiple Select
Which methods are acceptable for secure disposal of personal data?
- ADegaussing magnetic tapesCorrect answer
- BPhysical shredding of disks and paperCorrect answer
- CCryptographic erasure of encrypted dataCorrect answer
- DMoving files to the recycle bin
Why this is the answer
Secure disposal includes degaussing, shredding, and cryptographic erasure when appropriate; recycle bins do not destroy data.
- Question 9Interactive
The code block shows a database operation. Which privacy life cycle control does it implement?
- AAutomated retention deletionCorrect answer
- BConsent withdrawal
- CCross-border transfer
- DData subject access
Why this is the answer
This SQL command deletes expired records that are not on legal hold, enforcing the retention and storage limitation principle.
Privacy Engineering
16 questions in this domain
- Question 10Single Choice
What does privacy by design require in solution development?
- ATreat privacy as an after-the-fact compliance activity
- BEmbed privacy controls into every development stageCorrect answer
- CApply privacy only during final acceptance testing
- DAdd privacy measures immediately after a breach
Why this is the answer
Privacy by design requires proactive, continuous embedding of privacy into every stage of solution development, not a final review.
- Question 11Multiple Select
Which practices are part of privacy by default? (Select all that apply.)
- AMost protective configuration automatically enabledCorrect answer
- BDefault opt-out for non-essential processingCorrect answer
- CRequiring users to manually adjust many settings
- DShort data retention periods by defaultCorrect answer
Why this is the answer
Privacy by default means the most protective settings are already active, including opt-out defaults and limited retention.
- Question 12Interactive
Review the configuration. Which change makes it privacy protective by default?
- ASet data_sharing to False and retention_days to 30Correct answer
- BSet data_sharing to True and retention_days to 3650
- CSet opt_in_required to False and data_sharing to True
- DSet retention_days to 3650 and location_access to Always
Why this is the answer
Privacy by default requires minimizing sharing, limiting retention, and requiring opt-in for non-essential processing.
- Question 13Single Choice
What is the main difference between privacy by design and security?
- ASecurity ensures privacy automatically
- BSecurity is necessary but not sufficient for privacyCorrect answer
- CSecurity and privacy are identical
- DSecurity removes the need for privacy controls
Why this is the answer
Security protects confidentiality, but privacy also requires minimization, purpose limitation, and lawful processing.
- Question 14Multiple Select
Which outputs are created during privacy requirements elicitation? (Select all that apply.)
- APersonal data stream inventoryCorrect answer
- BLegal bases for processingCorrect answer
- CData subject rights and retention obligationsCorrect answer
- DMarketing campaign design
Why this is the answer
Privacy requirements elicitation captures data streams, legal bases, rights, transfer restrictions, and retention obligations.
- Question 15Interactive
A service needs only an age range. Which field is excessive?
- Afull_name
- Bexact_date_of_birthCorrect answer
- Cage_band
- Dall fields
Why this is the answer
Collecting exact date of birth is excessive when only an age range is needed for the declared purpose.
- Question 16Single Choice
When should a data protection impact assessment begin?
- AOnly after deployment
- BEarly and evolve with designCorrect answer
- CAfter a regulator complaint
- DAt final acceptance testing only
Why this is the answer
A DPIA is a decision-making method that begins early and evolves with the system design.
- Question 17Multiple Select
Which controls help enforce data minimization? (Select all that apply.)
- AField-level access controlsCorrect answer
- BSchema validationCorrect answer
- CAlerting on over-collectionCorrect answer
- DUnlimited data retention
Why this is the answer
Schema validation, field-level access, and alerting help limit collection to only necessary personal data.
- Question 18Interactive
Which query demonstrates purpose limitation?
- AQuery 1
- BQuery 2
- CQuery 3Correct answer
- DNone
Why this is the answer
Query 3 limits access by declared purpose and consent, directly supporting purpose limitation.
- Question 19Single Choice
What is the joiner-mover-leaver lifecycle used for?
- AIdentity lifecycle managementCorrect answer
- BFirewall management
- CPatch management
- DConsent management
Why this is the answer
Identity lifecycle management covers creating, updating, and deleting identities as people join, move, or leave.
- Question 20Multiple Select
Which components are part of a privacy-aware identity and access architecture? (Select all that apply.)
- AIdentity lifecycle managementCorrect answer
- BAuthorization policy enforcementCorrect answer
- CPurpose limitation enforcementCorrect answer
- DNetwork topology mapping
Why this is the answer
Privacy-aware architectures include lifecycle management, authorization, and purpose limitation as a single control system.
- Question 21Interactive
Given this account state, which action best reduces privacy risk?
- ADisable the account automaticallyCorrect answer
- BRotate the password
- CKeep the account active
- DAdd the account to more roles
Why this is the answer
Automated de-provisioning prevents orphaned accounts from accessing personal data after a contractor leaves.
- Question 22Single Choice
A nurse can view a patient record only if assigned to that ward. This is an example of what?
- AAuthentication
- BAuthorizationCorrect answer
- CEncryption
- DTokenization
Why this is the answer
Authorization determines what an authenticated identity is allowed to do with a specific resource.
- Question 23Multiple Select
Which statements about RBAC and ABAC are true? (Select all that apply.)
- ARBAC assigns permissions based on static job rolesCorrect answer
- BABAC can evaluate purpose and consent as attributesCorrect answer
- CABAC is less flexible than RBAC
- DRBAC always enforces least privilege
Why this is the answer
RBAC is role-based, while ABAC supports dynamic attributes such as purpose and consent for finer-grained control.
- Question 24Interactive
Given the policy, when is access denied?
- APurpose is marketing and consent is falseCorrect answer
- BPurpose is treatment and consent is true
- CPurpose is marketing and consent is true
- DPurpose is service improvement
Why this is the answer
The policy denies access when the declared purpose is marketing and the recorded consent status is false.
- Question 25Single Choice
What does purpose-based access control add to ABAC?
- APurposeCorrect answer
- BPassword
- CEncryption key
- DPhysical location
Why this is the answer
PBAC makes purpose a central decision component, ensuring processing matches lawful purpose and expectations.
Privacy Governance
8 questions in this domain
- Question 26Single Choice
Which statement best defines risk appetite in privacy governance?
- AThe broad-level amount of risk the enterprise is willing to accept while pursuing objectivesCorrect answer
- BA quantitative limit applied to every individual data processing activity
- CThe total legal liability an organization has accumulated in the past year
- DA mandatory regulatory requirement to disclose all data processing to regulators
Why this is the answer
Risk appetite is the broad amount of risk an organization accepts; risk tolerance sets measurable deviations from that appetite.
- Question 27Multiple Select
Which two actions support aligning privacy strategy with enterprise mission?
- AMap privacy objectives to the enterprise's strategic goalsCorrect answer
- BApply the strictest privacy controls to every department regardless of risk appetite
- CGain executive sponsorship and board approval for the privacy strategyCorrect answer
- DKeep privacy strategy separate from business strategy to avoid conflicts
Why this is the answer
Privacy alignment requires mapping objectives to mission and obtaining executive sponsorship. Over-restrictive or isolated strategies contradict risk appetite and integration.
- Question 28Interactive
Examine the decision logic in the code block. Which governance principle does it apply?
- AAligning processing decisions with the enterprise risk appetiteCorrect answer
- BEliminating the need for executive oversight
- CSubstituting human judgment with automated decisions
- DApplying identical controls to all projects
Why this is the answer
The logic maps risk appetite to strategy. It allows processing with safeguards, restricted processing, or board escalation, reflecting appetite-based governance.
- Question 29Single Choice
Who is ultimately accountable for approving the enterprise privacy strategy and risk appetite?
- AData Protection Officer
- BBoard of DirectorsCorrect answer
- CIT Security Director
- DBusiness Unit Manager
Why this is the answer
The board owns risk appetite and approves the privacy strategy. The DPO advises; senior management authorizes.
- Question 30Multiple Select
Which two role-to-responsibility pairings are correct under CDPSE privacy governance?
- ABoard of Directors – sets risk appetite and oversees strategyCorrect answer
- BDPO – makes unilateral business decisions on all data processing
- CLegal Counsel – provides consultative interpretation of privacy lawCorrect answer
- DSecurity Team – has final accountability for legal compliance
Why this is the answer
Board sets strategy and risk appetite; legal is consulted for law. DPO advises, and security implements technical controls, not legal accountability.
- Question 31Interactive
The code block shows a RACI matrix for privacy governance. Which two entries are NOT aligned with CDPSE guidance?
- ABoard is listed as informedCorrect answer
- BDPO is listed as accountable for privacy compliance
- CProduct Manager is listed as accountable for overall legal complianceCorrect answer
- DLegal is listed as consulted
Why this is the answer
The board should approve and oversee strategy, not merely be informed, and legal compliance accountability cannot sit with a product manager.
- Question 32Single Choice
Which statement best describes the DPO's role in decision-making?
- AThe DPO has veto power over all high-risk processing activities
- BThe DPO provides independent advice and escalation but cannot unilaterally block lawful business decisionsCorrect answer
- CThe DPO must follow CEO instructions even if they require unlawful processing
- DThe DPO replaces the board in setting risk appetite
Why this is the answer
DPO is independent and advisory. The controller may proceed if legally permissible, but the DPO must escalate and report.
- Question 33Multiple Select
Which two responsibilities are typical of a privacy steering committee?
- AReviewing high-risk cross-functional privacy issuesCorrect answer
- BApproving every routine data subject request individually
- CIncluding privacy, legal, security, and business representativesCorrect answer
- DReplacing the board's strategic oversight role
Why this is the answer
A steering committee handles high-risk, cross-functional issues and includes key stakeholder functions. Routine DSARs and board oversight are outside its purpose.
Privacy Risk Management and Compliance
8 questions in this domain
- Question 34Single Choice
In privacy risk management, what is the primary focus of a privacy risk assessment when personal data is processed?
- AHarm to data subjects' rights and freedomsCorrect answer
- BHarm to the organization's profit
- CDamage to brand reputation only
- DLoss of vendor contract value
Why this is the answer
A privacy risk assessment focuses on likelihood and severity of harm to individuals, including loss of control, discrimination, or intrusion.
- Question 35Multiple Select
Which elements are typically included in a data flow map used for a privacy risk assessment? Select all that apply.
- AData subjectsCorrect answer
- BRetention periodsCorrect answer
- CData categoriesCorrect answer
- DOrganizational chart
Why this is the answer
A data flow map records data subjects, data categories, processing systems, retention periods, and technical and organizational controls.
- Question 36Interactive
Review the DPIA decision record shown in the code block. Which processing activity is an example of the documented trigger?
- ASystematic monitoring of a public areaCorrect answer
- BAny processing with consent
- COccasional manual record keeping
- DFully outsourced payroll processing
Why this is the answer
The DPIA trigger is processing likely to result in high risk; systematic monitoring of publicly accessible areas is an Article 35(3) example.
- Question 37Single Choice
What distinguishes a data protection impact assessment from a general privacy impact assessment under data protection law?
- ARequired for high-risk processing and has mandatory contentCorrect answer
- BOptional for all projects
- CFocuses only on security incidents
- DRequires the regulator to approve every product
Why this is the answer
A DPIA is legally required for high-risk processing and includes mandatory content, while a general PIA is flexible and internally driven.
- Question 38Multiple Select
Which steps are mandatory or expected when performing a DPIA? Select all that apply.
- AInvolve the data protection officerCorrect answer
- BConsult data subjects when feasibleCorrect answer
- CConsult supervisory authority if high residual risk remainsCorrect answer
- DObtain consent from every data subject
Why this is the answer
A DPIA requires DPO involvement, feasible data subject consultation, and supervisory authority consultation when high residual risk remains.
- Question 39Interactive
Given the risk register entry in the code block, what is the required next action before the processing can begin?
- AConsult the supervisory authorityCorrect answer
- BAccept the residual risk without review
- CRemove the risk register entry
- DDisable all technical controls
Why this is the answer
If residual risk is high, the controller must consult the supervisory authority before processing begins; risk acceptance alone does not override the law.
- Question 40Single Choice
Why is a third-party inventory essential before an organization can assess vendor privacy risk effectively?
- AIt identifies which vendors process personal dataCorrect answer
- BIt replaces the need for contracts
- CIt guarantees full legal compliance
- DIt removes the need for monitoring
Why this is the answer
The inventory reveals which third parties process personal data, what data is shared, and where blind spots may exist.
- Question 41Multiple Select
Which provisions should a data processing agreement include to safeguard personal data shared with a processor? Select all that apply.
- AInstructions for processingCorrect answer
- BData subject rights supportCorrect answer
- CSubprocessor notification conditionsCorrect answer
- DThe processor's salary structure
Why this is the answer
A DPA must define processing instructions, data subject rights support, and subprocessor governance to protect personal data.
Frequently asked questions
Everything about the ISACA CDPSE question bank and how to use it.