Below are five CDPSE practice questions worked all the way through. Each gives you the stem, the options, the answer, the reasoning, and then the part most question banks rush: a paragraph on every wrong option naming the misconception it was written to catch. If you only read the correct answers you will learn roughly a quarter of what a question has to teach.
The five are spread across all four domains, with two drawn from Privacy Engineering because that domain is 39% of the paper on its own. The weights are Privacy Governance 20, Privacy Risk Management and Compliance 18, Data Life Cycle Management 23, and Privacy Engineering 39, from the Examination Content Outline effective 2025. On a 120-question paper that is roughly 47 engineering items against 24, 22 and 28 for the others.
The CDPSE answer is usually the one you can build
CDPSE sits at a junction that no other ISACA exam occupies. A single question can touch privacy law, software architecture, and data governance at the same time, and that changes what "best" means in the stem. Over and over, the credited answer is the one an engineer could go and implement on Monday, while the legally purest option sits in the list as a distractor.
That is ISACA testing a privacy technologist rather than a privacy counsel. A lawful basis is necessary, and it is not a control. Once you see the pattern you stop reaching for the option that sounds most like a regulation and start asking which option changes the system.
The exception is sequencing, which question two demonstrates. When a stem asks what to do FIRST and the plan crosses jurisdictions, the legal assessment wins, because it decides whether the engineering work is worth doing at all.
Question 1: accountability for personal data, and who holds it
An organization collects personal data from customers. Who is ultimately accountable for protecting it?
A. The data processor
B. The data owner
C. The data custodian
D. The data protection officer
Answer: B, the data owner.
The data owner is the party that decides the purpose and the means of processing, which in regulatory language makes them the controller. That decision right is what accountability attaches to. Owners delegate the work to processors, custodians, and a DPO, but answerability does not travel with the task. That is the most reliable rule in the governance domain.
Option A tests whether you have confused a heavily regulated role with an accountable one. Processors carry real duties, including contractual ones, but they act on the controller's documented instructions and cannot be the final answer to a question that says ULTIMATELY.
Option C is the "who does the work" trap. A custodian runs storage, backup, replication, and access provisioning day to day. Doing the protecting is not the same as owning the decision about what protection is required.
Option D is the trap pattern worth naming, because CDPSE uses it more than once: the most privacy-sounding job title in the list. A DPO advises, monitors compliance, and talks to regulators. The role is deliberately independent and advisory, and making the DPO accountable would undermine the independence the role exists to provide.
Question 2: the migration that crosses jurisdictions
An organization plans to migrate data from an on-premises system to a cloud solution hosted across more than one jurisdiction. What should be done FIRST?
A. Verify that data loss prevention alerts are configured and active in the cloud environment
B. Apply encryption to all data during the migration process
C. Conduct a penetration test of the target cloud environment
D. Assess the organization's privacy and legal exposure related to the planned migration
Answer: D, assess privacy and legal exposure.
Multi-jurisdiction hosting raises a prior question: may this data be there at all. Transfer rules, local processing obligations, subprocessor chains, and the provider's own contractual safeguards all have to be established before anything moves, because the assessment can come back saying no. Every other option assumes the migration is permitted.
Option A is a detective control on an arrangement whose legality has not been settled. Useful later, irrelevant to what comes first.
Option B is the most common wrong answer in this family, and it is the encryption reflex. Encryption in transit is a genuine safeguard and you will almost certainly implement it. It protects data on the way somewhere. It says nothing about whether the destination is a place the data may lawfully rest.
Option C spends money testing the security posture of an environment that might turn out to be off limits. Note what the three wrong options have in common: they are all good practice, and all three are answers to a later question. Sequencing items are not asking which control is strongest, they are asking which step makes the other steps meaningful.
Question 3: proving a dataset is really anonymized
A data engineer is sharing a database with an external party and wants to demonstrate that the data has been anonymized. Which scenario is a correct example of true anonymization?
A. The data is encrypted, and a decryption key is required to re-identify individuals
B. Key identifier fields are hidden and can be unmasked by authorized users
C. Names and addresses are removed, and all other fields remain unchanged
D. The data is transformed using irreversible techniques, such that re-identification is no longer possible
Answer: D, irreversible transformation.
Anonymization is defined by irreversibility, not by effort. Aggregation, generalization, noise addition, and synthesis get you there. The consequence is large, because genuinely anonymous data falls outside the scope of most privacy law, which is why the bar sits where it does.
Option A is the strongest-sounding control in the list, and it is pseudonymization. A key exists. Someone holds it. Reversibility is the whole point of encryption, so it can never satisfy a definition built on irreversibility.
Option B fails the same test one layer up. An authorized user can unmask the fields, which means the original values are still sitting there. That is access control wearing anonymization's clothes.
Option C is the misconception this question really exists for. Stripping names and addresses removes direct identifiers and leaves the quasi-identifiers untouched, and combinations like date of birth, ZIP code, and gender have been re-identifying people in public datasets for decades. "We took the names off" is not a privacy claim.
Question 4: privacy protection in AI model training
Which approach BEST embeds privacy protection into the training of an artificial intelligence model?
A. Using de-identified data drawn from real personal records
B. Obtaining informed consent from individuals before using their data for training
C. Using synthetic data generated to mimic real-world patterns
D. Displaying a privacy notice to users before they log in to the AI-powered application
Answer: C, synthetic data.
Synthetic data is generated to reproduce the statistical shape of a real dataset without containing any real record. No personal data enters the training pipeline, so the re-identification risk is removed at source rather than reduced. That distinction, removing risk against reducing it, decides a lot of Privacy Engineering items.
Option A is the runner-up and the closest call on the page. De-identification is a real privacy-by-design technique and on a different stem it would be credited. Here it loses because residual re-identification risk survives, and it grows as datasets grow and as auxiliary data becomes available to whoever has the model.
Option B is the question's whole reason for existing, and it is the pattern from the opening section in its purest form. Consent is a lawful basis. It makes the processing legal and it changes nothing about the technical risk of training a model on real people's records. Legal control, not engineering control, and the stem asked how to embed protection into the training.
Option D is a scope trap. The notice reaches users of the application, who are not necessarily the people whose data trained the model. Transparency to one population does not touch how another population's data enters the pipeline.
Question 5: keeping published records from being linked back
Which privacy-enhancing technology is MOST effective at ensuring that individual records in a published dataset cannot be linked back to specific people?
A. Differential privacy
B. Secure multiparty computation
C. Pseudonymization
D. Data masking
Answer: A, differential privacy.
Two phrases in the stem do the work: "published dataset" and "linked back". Differential privacy adds calibrated statistical noise so that the output reveals a negligible amount about any individual record, and the protection is mathematical, holding regardless of what auxiliary data an attacker already has. Every other option here is defeated by a sufficiently determined linkage attack.
Option B is the right answer to a different question. Secure multiparty computation lets several parties jointly compute over inputs none of them reveals to the others. It is about confidentiality during computation, not about what an adversary can infer from something you have already published.
Option C leaves the mapping in existence somewhere, and the quasi-identifiers in the released records are untouched, so re-linkage remains available through exactly the route question three described.
Option D obscures particular fields while the rest of the row stays intact. Same failure, narrower scope. If you answered C or D here and also answered C on question three, you have found a real gap rather than two unlucky guesses, and it is worth an evening of reading rather than a shrug.
Where candidates actually lose CDPSE marks
Privacy Engineering, and not by a small margin. It is 47 or so items out of 120, every item counts the same toward your total correct, and domain-level feedback on your score report is informational only, so there is no way to offset a weak engineering performance with a strong governance one.
The reason it catches people is background. CDPSE attracts privacy program managers, compliance leads, and lawyers, and questions four and five above are not really privacy questions for that reader, they are systems questions with privacy vocabulary. If a stem naming differential privacy, secure multiparty computation, and pseudonymization feels like a list of interchangeable good things, the largest domain on the paper is going to be a problem. The fix is unglamorous: learn what each technique actually does to the data, because the exam discriminates between them constantly. Our CDPSE study guide splits Privacy Engineering across three chapters for that reason, and includes two full-length practice exams with every answer explained.
The opposite failure is rarer. Engineers arriving from a security role underrate Privacy Governance, treating accountability and roles as filler, and question one is how that gets punished.
Score your practice by the reason, not the number
A practice score tells you almost nothing on its own. What is worth recording is why each wrong answer was wrong, sorted into three buckets: you did not know the content, you knew it but misread the qualifier, or you knew it and picked the second-best option. Those are three different problems and only the first one is fixed by more reading.
Qualifier misses are the cheapest to fix. FIRST, BEST, MOST, and GREATEST are doing real work in CDPSE stems, and question two flips from an encryption answer to a legal-assessment answer purely on the word FIRST. Second-best misses are the expensive ones, and they usually mean your mental ranking of controls is off, as in question four where de-identification is genuinely good and synthetic data is genuinely better.
Do this against a bank that explains its answers, and pace yourself against the real format: 120 questions in 3.5 hours is 210 minutes, near enough 105 seconds per question. The 12-week CDPSE study plan sets out when to start practice questions, and how hard the CDPSE exam is covers the scoring. For the syllabus behind these five questions, see the four CDPSE domains explained, and for the credential itself, what the CDPSE certification is.
FAQ
How many practice questions should you do before sitting the CDPSE?
There is no threshold that means anything on its own, and a candidate who works 300 questions properly is better prepared than one who skims 1,000. A reasonable working target is two full 120-question timed sittings plus enough topic-level practice to cover all four domains, with Privacy Engineering getting the largest share because it is 39% of the paper.
Are CDPSE practice questions the same as the real exam questions?
No. ISACA does not release live items, so every practice question you see anywhere is written to the Examination Content Outline rather than drawn from the item bank. What good practice questions reproduce is the reasoning style, the qualifiers, and the distractor patterns, which is the transferable part.
What does a CDPSE practice score predict about passing?
Less than you would like. The real exam is scored on a 200 to 800 scale with 450 to pass, and that scale is not a percentage, so a practice percentage cannot be converted into a predicted scaled score. ISACA does not publish a CDPSE pass rate either. Use practice scores to find weak domains and misread qualifiers, not to forecast a result.
Why do CDPSE questions so often reject the legal option?
Because the credential certifies a privacy technologist. Consent, notice, and lawful basis appear constantly as distractors in questions that ask you to protect data, and they lose to a technical control because they establish permission rather than change the risk. When the stem asks about sequencing or legality instead, the same options become the right answer, as question two shows.
Do you need a privacy law background to answer these?
It helps for Privacy Governance and Privacy Risk Management and Compliance, which together are 38% of the paper. It is not sufficient, because the remaining 62% runs through data life cycle handling and engineering. Candidates from a legal or compliance background usually need to treat Privacy Engineering as new material rather than revision.
Looking for a plain-English CDPSE guide? ISACA CDPSE: Simply Certified Study Guide covers all four domains at their 20/18/23/39 weights, with two full-length practice exams, every answer explained.
Simply Certified is an independent publisher. CDPSE and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.