Build practical privacy engineering judgment with 120 original questions from Cloudpuz Academy. This independent CDPSE preparation course provides two different 60-question tests. Each question has four choices, one best answer, explanations for every option and a reference for further study. All scenarios are hypothetical and independently authored. No recalled examination questions or copied official question bank is used.

The governance questions connect processing purposes, individual choices, notices and documented responsibilities to the behavior of a service. Explore vendor boundaries, subprocessor changes, verified requests, correction propagation, incidents and evidence. Legal duties are framed in terms of applicable requirements and the conditions stated in a scenario. The course does not assume that one deadline or lawful basis applies universally across countries or services.

The risk and compliance questions examine privacy consequences that can arise even when a system is secure and functioning as designed. Practice assessment timing, scope changes, residual exposure, evidence quality, authorized acceptance and useful metrics. Distinguish a completed checklist from effective controls and recognize how incomplete sampling, missing denominators or outdated assurance can mislead a decision.

The data lifecycle section follows information through collection, use, derivation, disclosure, retention and destruction. Scenarios cover dataflow visibility, field minimization, accuracy in context, downstream copies, purpose tags, archives, backups and deletion retries. Additional questions explore transfer records, release granularity, training-data provenance, migration reconciliation and asset-specific sanitization evidence.

The engineering section addresses object and property authorization, tenant isolation, export delivery, schemas and negative permission tests. Evaluate diagnostic logging, redaction placement and access separation. Compare pseudonymization with stronger de-identification claims, assess quasi-identifiers and synthetic data, and practice basic differential privacy reasoning. Questions on cryptographic storage distinguish encryption from authorization, examine key handling and identify the limitations of hashing predictable inputs.

Further engineering scenarios cover safe test data, privacy acceptance criteria, third-party SDK permissions, design review and release changes. Follow choice state through caches and workers, consider protective failure behavior, and assess cloud configuration, endpoint persistence and legacy mediation. The emphasis is on the control required by the facts in the scenario, rather than memorizing product names.

Each test includes 12 privacy governance questions, 11 privacy risk management and compliance questions, 14 data lifecycle questions and 23 privacy engineering questions. Across the course, the totals are 24, 22, 28 and 46, approximating the current official outline weights of 20, 18, 23 and 39 percent with whole questions. Each practice test allows 105 minutes, proportional to the official 120-question, 210-minute format in the ISACA candidate guide checked on 1 November 2026. The 70 percent setting is a study target. The official examination uses a scaled passing score of 450 on a 200-to-800 scale; this practice percentage is not a conversion of that score.

An author editorial review strengthened distractors and checked scenario assumptions. Four numerical examples were checked, and all 120 exported questions, answer keys and 480 option explanations were compared with the source. Local lexical screening found no exact or high-similarity matches in the available collection. These checks do not prove uniqueness across the internet and are not an independent expert audit. Read each explanation, identify the decisive facts and use the references to revisit unfamiliar concepts.

Basic familiarity with applications, data processing and access controls is recommended. This course contains practice questions, without video instruction, an exam voucher or accredited training. Check current eligibility and experience requirements directly with ISACA. The material is educational and does not provide jurisdiction-specific legal advice or a guarantee of privacy compliance. Cloudpuz Academy is independent and is not affiliated with, accredited by or endorsed by ISACA, NIST or OWASP. Referenced names identify study topics and supporting resources. Completion does not award or guarantee certification.