Which system hardening technique involves removing or disabling software components that are not required for the system's function?

Disabling unnecessary services and ports

A large e-commerce company is redesigning its order management system. The system will handle payment card data and personal customer information. The privacy engineer is leading a threat modeling workshop. The team has identified that a malicious insider with database access could modify order records to hide fraudulent transactions. Which threat modeling approach would best help the team systematically address this risk?

Use a penetration test to see if an external attacker can exploit the database.

Apply STRIDE and focus on the tampering and repudiation categories, then implement audit logging and integrity controls.

Implement a database firewall to block all SQL injection attempts.

Rely on the database's native encryption to protect data at rest.

Which authorization model is best suited for environments that require fine-grained access decisions based on dynamic attributes like time of day or location?

Discretionary Access Control (DAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

What is the purpose of key rotation in cryptographic key management?

To eliminate the need for key storage

To make the encryption algorithm faster

To simplify the key management process

To limit the amount of data encrypted with a single key

Certified Data Privacy Solutions Engineer

Domain 4Objective 2

Security and Access Controls CDPSE Practice Questions (Page 8)

Part of the Privacy Engineering domain, which accounts for 39% of the CDPSE exam.

48questions here

10free pages

16concepts

39%of the exam

Questions 36–40

36foundation · easy
Which system hardening technique involves removing or disabling software components that are not required for the system's function?
Select an answer first
37expert · hard
A large e-commerce company is redesigning its order management system. The system will handle payment card data and personal customer information. The privacy engineer is leading a threat modeling workshop. The team has identified that a malicious insider with database access could modify order records to hide fraudulent transactions. Which threat modeling approach would best help the team systematically address this risk?
Select an answer first
38foundation · easy
Which authorization model is best suited for environments that require fine-grained access decisions based on dynamic attributes like time of day or location?
Select an answer first
39foundation · easy
In the context of IAM, which term refers to the process of verifying that a user is who they claim to be?
Select an answer first
40foundation · easy
What is the purpose of key rotation in cryptographic key management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CDPSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CDPSE” is a trademark of its owner, used for identification only.

Security and Access Controls CDPSE Practice Questions (Page 8)

Questions 36–40

Which system hardening technique involves removing or disabling software components that are not required for the system's function?

Which authorization model is best suited for environments that require fine-grained access decisions based on dynamic attributes like time of day or location?

In the context of IAM, which term refers to the process of verifying that a user is who they claim to be?

What is the purpose of key rotation in cryptographic key management?

Keep studying — Privacy Engineering