ISACA CDPSE Practice Test

CDPSE practice test: what's covered

• Privacy Governance
• Privacy Architecture
• Data Lifecycle
• Privacy by Design
• De-identification
• Technical Controls

Free CDPSE sample questions

1. An organization is launching its first formal privacy program. The engineering lead wants the program documents structured so that high-level intent flows down into enforceable technical rules. Which artifact should sit at the TOP of this hierarchy and set the organization's overall privacy intent?

   • A. The privacy policy approved by senior management
   • B. A firewall ACL baseline
   • C. A data retention schedule for the CRM database
   • D. A consent banner configuration file
   Show answer

   Correct: A. Governance documents are hierarchical: the senior-management-approved privacy policy states intent, then standards/procedures/baselines implement it. Retention schedules, ACLs and consent configs are downstream implementation artifacts, not the top-level statement of intent.

2. A privacy engineer is asked who should be ACCOUNTABLE for deciding the purposes and means of processing personal data under GDPR, and therefore for the privacy program's direction. Which role bears this accountability?

   • A. The data controller
   • B. The data processor
   • C. The system administrator
   • D. The end user / data subject
   Show answer

   Correct: A. The controller determines the purposes and means of processing and is accountable under GDPR Article 5(2). The processor only acts on the controller's documented instructions; admins and data subjects do not set processing purposes.

3. Before a new analytics feature that uses customer behavioural data goes live, the privacy team must determine whether it could create high risk to individuals' rights and freedoms. Which assessment is the PRIMARY tool to make that determination?

   • A. A Data Protection Impact Assessment (DPIA)
   • B. A penetration test of the analytics API
   • C. A SOC 2 Type II audit
   • D. A business continuity tabletop exercise
   Show answer

   Correct: A. A DPIA (a form of privacy impact assessment) systematically identifies and minimizes privacy risk before high-risk processing begins. Pen tests assess security weaknesses, SOC 2 evaluates controls broadly, and BC exercises address availability — none specifically assess privacy risk to individuals.

4. A product team wants to embed privacy controls during system design rather than retrofitting them after release. They ask the privacy engineer which principle requires privacy to be a default condition with no action needed by the user to be protected. Which principle is this?

   • A. Privacy by default
   • B. Defense in depth
   • C. Least functionality
   • D. Separation of duties
   Show answer

   Correct: A. Privacy by default means the most privacy-protective settings apply automatically without the user having to act. Privacy by design is the broader proactive-embedding concept; the others are general security principles, not privacy defaults.

5. A company is onboarding a marketing SaaS vendor that will receive customer email addresses to send campaigns. As the privacy engineer reviewing third-party risk, which contractual instrument MUST be in place to bind the vendor to process the data only on documented instructions?

   • A. A Data Processing Agreement (DPA)
   • B. A non-disclosure agreement only
   • C. A master service-level agreement for uptime
   • D. An end-user license agreement
   Show answer

   Correct: A. A DPA (GDPR Article 28) binds a processor to act only on the controller's documented instructions and sets security, subprocessor and breach obligations. An NDA protects confidentiality and an SLA covers availability, but neither establishes processor processing terms.

Last updated: 2026-10-19

CDPSE practice test FAQ

Related practice tests

• ISACA CGEIT practice test
• ISACA CISA practice test
• ISACA CISM practice test
• ISACA CRISC practice test