Data Infrastructure and Technology CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A manufacturing company has a legacy on-premises system that controls production machinery and stores employee records. The system is running on an outdated operating system that is no longer patched. The privacy team is planning to migrate the employee records to a modern cloud HR system, but the production system must remain operational. What is the most important consideration for the migration?

   • AMigrate the employee records but also migrate the production system to the cloud to ensure consistency.
   • BEnsure that the employee records are completely removed from the legacy system after migration to avoid ongoing privacy risk.
   • CKeep the legacy system running as-is to avoid disrupting production, and focus only on the new cloud system.
   • DDisconnect the legacy system from the network to prevent unauthorized access, even if it disrupts production.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A software company runs a multi-tenant application on a single physical server using virtual machines (VMs) for each customer. A privacy auditor is reviewing the architecture to assess data isolation. The auditor notes that the hypervisor is properly patched and each VM has its own operating system. What additional control is most important to ensure customer data remains isolated?

   • AConfigure network segmentation and firewall rules so that VMs cannot communicate with each other unless explicitly required.
   • BUse the same operating system image for all VMs to simplify patching and reduce configuration drift.
   • CEnsure each VM has a unique hostname and IP address to prevent network confusion.
   • DStore all customer data in a single shared database and rely on application-level access controls.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A sales team uses company-issued smartphones to access customer relationship management (CRM) data. A salesperson loses their phone at an airport. The phone is protected by a PIN, but the CRM app stores customer data locally on the device. What is the most immediate risk to customer privacy?

   • AThe CRM data stored locally on the device could be accessed if the device is compromised or the PIN is bypassed.
   • BThe CRM app could be uninstalled and reinstalled on another device to access the data.
   • CThe phone's PIN can be easily guessed, allowing unauthorized access to the CRM data.
   • DThe phone's cellular connection could be intercepted to access the CRM data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A bank is developing a new API that will allow mobile app users to view their transaction history. The API will be accessed by the bank's own mobile app and by a third-party budgeting app that users can link. The privacy team wants to ensure that the third-party app can only access the data it needs. Which approach best achieves this?

   • ARequire the third-party app to use the user's bank login credentials to access the API.
   • BIssue a single API key to the third-party app that grants access to all endpoints.
   • CAllow the third-party app to access the API only during business hours.
   • DUse OAuth 2.0 with scopes so that the third-party app can only request access to specific data, such as transaction history, and not other account details.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which cloud deployment model is characterized by infrastructure that is shared by several organizations with common interests, such as a group of hospitals?

   • APrivate cloud
   • BCommunity cloud
   • CHybrid cloud
   • DPublic cloud
   Reveal Solution Discussion Select an answer first