Free CDPSE Practice Test

Multi-factor authentication (MFA) is the most effective control to mitigate the risk of compromised credentials. It requires users to provide two or more verification factors to gain access to a resource. Even if an attacker steals a password (one factor), they cannot gain access without the additional factor(s) (e.g., a code from a mobile app, a fingerprint). This directly addresses the risk of a single compromised credential being used for unauthorized remote access, making it superior to other listed controls for this specific threat.

A. Enable whole disk encryption on remote devices. This protects data at rest on the device's storage but does not prevent an attacker from using stolen credentials to log in and access data.
B. Purchase an endpoint detection and response (EDR) tool. EDR is a detective and responsive control for threats on the endpoint itself; it does not directly prevent the initial authentication with compromised credentials.
D. Deploy single sign-on with complex password requirements. While complex passwords help, they are still a single factor. SSO can increase risk by creating a single point of failure if those credentials are compromised.

1. ISACA, CDPSE Review Manual, 2020, Domain 2: Privacy Architecture, Section 2.5 Identity and Access Management (IAM), states that MFA is a key control for strengthening authentication.

2. National Institute of Standards and Technology (NIST), Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, June 2017, Section 5.1.1 Memorized Secrets, highlights the vulnerabilities of passwords and advocates for multi-factor authenticators.

A privacy risk assessment is the most effective method to distinguish between different types of risk. This systematic process identifies potential privacy threats and vulnerabilities, analyzes their likelihood and impact, and evaluates the resulting risk. During this analysis, risks are categorized based on their nature. A compliance risk relates to the organization's failure to adhere to legal, statutory, or regulatory requirements. A privacy risk, more broadly, relates to the potential for harm or adverse effects on individuals whose data is being processed. The assessment process explicitly examines both aspects.

A. Perform a privacy risk audit: An audit primarily validates whether existing controls are effective and compliant with policies or regulations, rather than distinguishing the nature of inherent risks.
C. Validate a privacy risk attestation: An attestation is a formal declaration of compliance. Validating it is a verification activity, not a process for identifying and categorizing different risk types.
D. Conduct a privacy risk remediation exercise: Remediation is the action taken to mitigate identified risks; it occurs after the risk has already been assessed and understood.

1. ISACA, CDPSE Review Manual, 2020, Domain 1: Privacy Governance, Section 1.5.1 Privacy Risk Management, pp. 52-53. (Details the process of a privacy risk assessment for identifying and evaluating privacy risks).

2. National Institute of Standards and Technology (NIST). (2020). NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0. Section 2.3 Risk Management and the Privacy Framework. https://doi.org/10.6028/NIST.CSWP.1.0 (Describes how enterprise risk management processes are used to identify, assess, and respond to privacy risks).

Role-based access control (RBAC) is the best and most widely adopted method for managing permissions for groups of users, such as IT staff. RBAC assigns access rights to defined roles (e.g., 'Database Administrator', 'System Analyst') rather than to individual employees. Staff members are then assigned to the appropriate roles. This approach enforces the principle of least privilege, simplifies access management and reviews, reduces administrative overhead, and improves security by ensuring permissions are consistent and tied to job functions.

A. Mandatory access control (MAC) is too rigid for most corporate environments, as it is centrally controlled by the system based on security labels, not business roles.
B. Network segmentation is a network-level control that isolates systems; it does not manage individual user permissions to data within those systems.
C. A "dedicated access system" is a vague term for a tool. RBAC is the underlying management model or framework, which is the superior answer.

1. ISACA, CDPSE Review Manual, 2020, Domain 3: Data Protection, Section 3.3 Identity and Access Management. This section explicitly identifies RBAC as a key mechanism for enforcing access policies based on roles and responsibilities.

2. National Institute of Standards and Technology (NIST), Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, 2020, Control Family: Access Control (AC), Control: AC-2(3). This standard details RBAC as a primary method for implementing access control policies.

A robust data breach response is fundamentally dependent on quickly understanding the scope of the incident. This requires an up-to-date inventory of affected individuals and systems. Knowing which systems are compromised is essential for containment and eradication, while identifying affected individuals is critical for assessing the impact and fulfilling legal notification obligations. Without this information, a response would be uncoordinated and ineffective, failing to mitigate harm or meet regulatory requirements.

A. Lessons learned are for improving future responses, not a mandatory component for managing the current incident.
B. Data obfuscation is a preventative control to reduce the risk of a breach, not a component of the response itself.
C. An inventory of previously impacted individuals is irrelevant to a new breach affecting a potentially different group of people.

1. ISACA, CDPSE Review Manual, 2020, Chapter 3, Section: Data Breach Incident Response, "The incident response plan should include procedures for...identifying the scope of the breach, including the systems and data affected and the individuals whose data was compromised."

2. NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide, 2012, Section 3.2.4, p. 38, "Knowing which networks, systems, and applications are affected helps the team to determine the scope of the incident."

3. ISACA, Responding to a Targeted Cyberattack, 2016, Section: Containment, "The first step in containing an incident is to identify all affected systems."

Data minimization is a core privacy principle stating that personal data collected and processed should be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. A key component of this principle is "storage limitation," which dictates that data should not be kept in a form that permits identification of data subjects for longer than is necessary for the purposes for which the personal data are processed. Therefore, applying the principle of data minimization directly addresses the issue of data being retained beyond its intended and legally permissible lifespan by requiring its timely deletion or anonymization.

B. Data anonymization is a technique to remove identifiers, but it does not address the retention period. Anonymized data can still be kept indefinitely.
C. Data security involves protecting data from unauthorized access. It does not define how long data should be kept.
D. Data normalization is a database design technique to reduce redundancy and is unrelated to data retention policies.

1. ISACA, CDPSE Review Manual, 2020, Domain 1: Privacy Governance, Section 1.5 Privacy Principles. This section explicitly links data minimization with the principle of storage limitation.

2. General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, Article 5(1)(c) and 5(1)(e). Article 5(1)(c) defines data minimization, and 5(1)(e) defines the "storage limitation" principle.

3. NIST, NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0, January 16, 2020, Section 2.2 Core: Disseminate (P-DS). This section includes subcategories like P-DS-5, which addresses data minimization and retention policies.

The best approach is to flag the user's email address on a suppression list. This directly honors the user's request to stop receiving marketing communications. It also prevents the user from being inadvertently re-added to marketing lists in the future if their data is re-imported from another source. This method respects the right to object to processing for direct marketing purposes while allowing the organization to retain the data for other legitimate reasons, such as transaction history or legal compliance, if applicable. This is a standard industry practice for managing marketing consent.

A. Encrypting data protects its confidentiality but does not prevent it from being used for marketing, failing to honor the user's request.
B. The privacy policy should guide the process, but the action itself is what's required. This option describes a verification step, not the handling approach.
C. Completely removing the user's information may violate other legal or business requirements for data retention and fails to prevent their re-addition to marketing lists.

1. ISACA. (2020). CDPSE Review Manual. Domain 2: Data Lifecycle, Section 2.5 Data Destruction. The manual discusses the importance of proper data handling at the end of its life cycle, including suppression for marketing purposes as a valid alternative to complete deletion when other business needs exist.

2. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). Section 3.3.3, "Minimization of PII," discusses collecting and retaining only necessary PII. For opt-outs, retaining an email on a suppression list is a minimal, necessary action to ensure compliance with the request.

3. General Data Protection Regulation (GDPR). Article 21, "Right to object." Paragraph 3 states, "Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." A suppression list is the technical mechanism to ensure this.

The question describes pseudonymization, a technique often conflated with anonymization. In pseudonymization, direct identifiers are replaced with pseudonyms, but a separate "key" or mapping table is maintained that allows for re-identification. The single most critical control to ensure this technique is effective is to store this key separately and securely from the pseudonymized data. If an attacker accesses the data and the key together, the protection is completely negated, and the data is easily re-identified. This architectural separation is fundamental to the security of the process.

B. Multi-factor authentication is a general access control, not a specific consideration for the integrity of the pseudonymization technique itself.
C. Key complexity is important for security, but the physical or logical separation of the key from the data is a more fundamental and critical control.
D. Data loss prevention (DLP) is a control to prevent data exfiltration, not a measure to ensure the de-identification technique itself remains effective.

1. General Data Protection Regulation (GDPR), Article 4(5). Defines pseudonymization as processing personal data so it can no longer be attributed to a specific data subject without the use of "additional information," provided that such additional information is "kept separately."

2. ISACA, CDPSE Review Manual, (2020), Domain 3: Data Lifecycle, Section 3.4 Data Protection. The manual emphasizes that for pseudonymization to be effective, the means for re-identification (the key) must be held separately under different controls.

3. National Institute of Standards and Technology (NIST), NISTIR 8053, De-Identification of Personal Information, (2015), Section 2.2.2. Discusses de-identification techniques and highlights that the security of pseudonymization relies on the inability to access the mapping table (key).

The raw zone of a data lake is the ingestion layer where data lands in its original, unaltered format from various source systems. Because this data has not yet been processed, cleansed, or classified, it poses the highest risk of containing sensitive or personal information. To adhere to security and privacy principles like "secure by design," sensitive data must be protected at the earliest possible point. Therefore, applying encryption or tokenization in the raw zone is a critical control to prevent unauthorized access or data spillage before it propagates through the lake.

A. The trusted zone contains cleansed and curated data; protection should have been applied before data reached this stage.
B. The clean zone is similar to the trusted zone, where data has already undergone processing and should already be protected.
D. A temporal zone is a staging area; while security is important, the initial and most critical protection point is the raw zone.

1. ISACA, CDPSE Review Manual, 2020, Chapter 2, Section: Data Lifecycle, "Protection of data should be applied throughout the data life cycle, from creation to destruction. This includes applying controls at the point of ingestion into systems like data lakes."

2. AWS Whitepaper, Build a modern data architecture with AWS Lake House, 2021, p. 6, "The raw zone stores data in its original format...Data is encrypted and partitioned in the raw zone."

3. Microsoft Azure Documentation, Data lake zones and containers, 2023, "Raw data (or landing zone) - Data is ingested in its original, raw format...Data should be immutable and can be stored in its original format, such as JSON or .csv." This implies protection is paramount as the state is unknown.

From a privacy regulation standpoint, the geographical location of data is a primary concern. Using cloud services for backup often involves transferring data to data centers that may be in another country. This act constitutes a cross-border data transfer, which is strictly regulated by laws like the GDPR. The organization must ensure that the destination country provides an adequate level of data protection or that other legal mechanisms are in place. This is the most important initial consideration as it determines the fundamental legality of the service's use.

A. Data classification is an important internal control for applying protections but does not address the overarching legal and jurisdictional issues of data location.
C. The volume of data stored influences the level of risk and potential impact of a breach, but the location determines the applicable legal framework.
D. Privacy training is a necessary operational control for personnel but does not resolve the fundamental compliance challenge posed by cross-border data storage.

1. ISACA, CDPSE Review Manual, 1st Edition, Domain 2: Data Lifecycle, Task 2.5 (Manage data transfer), Knowledge Statement K2.5.1 (Knowledge of cross-border data transfer requirements and mechanisms).

2. Cloud Security Alliance (CSA). (2017). Code of Conduct for GDPR Compliance. Section 10, "Transfers of Personal Data," details the responsibilities of cloud providers and customers regarding the location of data and international transfers.

3. Stanford University. (2023). CS182: Ethics, Public Policy, and Technological Change Course Syllabus. The curriculum covers data governance models, including the legal implications of cross-border data flows under GDPR.

The term "cross-border data transfer" directly points to the geographical location of data processing and storage. The greatest regulatory concern, under frameworks like the GDPR, is whether the data is transferred to a jurisdiction with an "adequate" level of data protection. Storing data in a region with different and potentially weaker requirements can result in non-compliance, leading to severe legal and financial penalties. This jurisdictional issue is the most fundamental concern specific to cross-border scenarios.

A. The right to audit is a crucial contractual control for vendor oversight but is a general due diligence concern, not one specific to cross-border regulations.
B. Not anonymizing personal data is a general data protection failure, relevant regardless of whether the data transfer is cross-border or domestic.
C. The extent of provider access is a critical access control issue but does not directly address the specific legal requirements governing data movement between countries.

1. ISACA, CDPSE Review Manual, 1st Edition, Domain 2: Data Lifecycle, Task 2.5 (Manage data transfer), Knowledge Statement K2.5.1 (Knowledge of cross-border data transfer requirements and mechanisms).

2. General Data Protection Regulation (EU) 2016/679, Chapter V, "Transfers of personal data to third countries or international organisations," Articles 44-50. This chapter explicitly details the legal requirements for transferring data outside the EU.

3. Gellert, R. (2018). Understanding the 'risk-based approach' to data protection. International Data Privacy Law, 8(1), 3-16. https://doi.org/10.1093/idpl/ipx023 (Discusses risk assessment in the context of international transfers).