CDPSE Technical Privacy Controls 4

Question 1

Which network architecture pattern isolates services that process personal data, limiting lateral movement if one component is compromised?

Accepted Answer

Network segmentation with micro-perimeters

Answer

Network segmentation (including micro-segmentation) confines personal data flows to specific zones, reducing the blast radius of a breach.

Question 2

A Zero Trust Architecture (ZTA) requires that every request be authenticated and authorized regardless of network location. Which privacy benefit does this directly provide?

Accepted Answer

It prevents over-privileged lateral access to personal data stores after initial perimeter breach

Answer

ZTA's continuous verification principle means that even an attacker who gains internal network access must still authenticate and be authorized before reaching personal data.

Question 3

An engineer is configuring logging for a system that processes health records. Which of the following is the MOST important privacy consideration for log files?

Accepted Answer

PII should be redacted or tokenized in logs unless explicitly required for the audit purpose

Answer

Logs frequently become secondary repositories of PII; redacting or tokenizing sensitive fields limits exposure while preserving operational and audit value.

Question 4

What does 'data residency' control ensure in cloud deployments involving personal data?

Accepted Answer

Personal data is stored and processed only within specified geographic boundaries

Answer

Data residency controls enforce that personal data remains within a defined jurisdiction to satisfy legal and regulatory requirements such as GDPR adequacy decisions.

Question 5

A privacy engineer is evaluating a vendor's cloud storage service. Which cryptographic control gives the organization the STRONGEST assurance that the vendor cannot access stored personal data?

Accepted Answer

Customer-managed keys stored in an external Hardware Security Module (HSM) the vendor cannot access

Answer

Holding encryption keys in an external HSM that the vendor cannot access ensures that even with full access to ciphertext, the vendor cannot decrypt personal data.

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE - Certified Data Privacy Solutions Engineer Practice Test

CDPSE Technical Privacy Controls 4