CDPSE Technical Privacy Controls 3

Question 1

A web application encodes user-submitted data before rendering it in the browser. Which privacy-relevant attack does this primarily prevent?

Accepted Answer

Cross-site scripting (XSS)

Answer

Output encoding prevents XSS by ensuring user-supplied content is treated as data rather than executable script, protecting session cookies and personal data from theft.

Question 2

Which TLS configuration setting most directly reduces the risk of exposing personal data if a server's long-term private key is later compromised?

Accepted Answer

Perfect Forward Secrecy (PFS)

Answer

Perfect Forward Secrecy uses ephemeral session keys so that compromising the server's private key cannot decrypt previously recorded sessions.

Question 3

An organization implements a Content Security Policy (CSP) header. Which privacy threat does this primarily mitigate?

Accepted Answer

Third-party tracking scripts loading unauthorized resources

Answer

CSP restricts which sources can load scripts and resources, preventing unauthorized third-party trackers or data-exfiltration scripts from executing.

Question 4

A CDPSE candidate is reviewing an API that returns full user objects including SSN and date of birth even when only the username is needed. Which privacy principle is violated?

Accepted Answer

Data minimization

Answer

Returning more personal data than the consuming application needs violates data minimization, which requires collecting and exposing only data adequate and relevant for the specified purpose.

Question 5

What is the technical function of a 'salt' when hashing passwords for storage?

Accepted Answer

It is a random value prepended to the password before hashing to defeat precomputed rainbow tables

Answer

A salt is a unique random value added to each password before hashing, ensuring identical passwords produce different hashes and rendering precomputed rainbow tables useless.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Technical Privacy Controls 3