Free practice sample
Fifteen original CDPSE practice questions, unlocked with no signup and instant scoring. The sample draws proportionally across all four domains of the exam content outline in force since June 2, 2025 — so the mix you see here is weighted the way the real exam is, with Privacy Engineering carrying the largest share rather than governance reading.
CDPSE is a build-it credential, and its hard questions show it. The exam rarely asks what a privacy principle means; it asks which control actually implements it in the system described — whether pseudonymisation is sufficient when the re-identification key stays in the same environment, whether a secondary analytics use is compatible with the purpose the data was collected for, whether consent captured at one layer survives the pipeline that copies the record downstream. Four answers will each be defensible in isolation; one of them holds up against the data flow as written. These questions are built to that standard, and every explanation names the winning answer and the near-miss it beats.
Outline restructured. ISACA’s current CDPSE Exam Content Outline took effect June 2, 2025, moving the exam from three domains to four: risk management and compliance was split out on its own, and the technical material was consolidated into a single Privacy Engineering domain now worth 39%. If your study materials still show three domains, they predate this exam.
Frequently asked questions about CDPSE
How many questions are on the actual CDPSE exam?
120 questions in a 3.5-hour window. Confirm current logistics on isaca.org when you book, since ISACA sets the format and may change it.
What score do I need to pass CDPSE?
ISACA reports CDPSE results on a scaled range of 200–800, with 450 required to pass. That conversion does not map linearly to a raw percentage, so 450 is not “56%”. Certifym sets its practice pass mark at 65% as an honest raw-score equivalent of where 450 tends to land. Because every practice set is stratified to the official weights, clearing it means you performed across all four domains rather than getting lucky in the heavy one.
Which domains should I spend the most time on?
Privacy Engineering at 39% is the exam’s centre of gravity — on its own it is close to two-fifths of your scored questions, and with Data Life Cycle Management at 23% the two technical domains account for 62% between them. Privacy Risk Management and Compliance is the lightest at 18%, and Privacy Governance sits at 20%. Study time that follows the reading you enjoy rather than the weights tends to land in the wrong half of the blueprint.
What changed when the outline was restructured on June 2, 2025?
ISACA moved CDPSE from three domains to four. Privacy Risk Management and Compliance was split out as a domain in its own right, and the technical content — infrastructure, SDLC, APIs, encryption, monitoring, consent technology, privacy-enhancing technologies, and AI/ML privacy considerations — was consolidated into a single Privacy Engineering domain carrying 39%. Any question bank or course still organised around three domains is written against a retired outline.
Is CDPSE a legal certification or a technical one?
Technical. Where legal-track privacy credentials prove you can interpret a regulation, CDPSE proves you can implement it — designing privacy into pipelines and platforms, selecting controls and privacy-enhancing technologies, governing data through its life cycle, and assessing the privacy risk of what the organisation actually runs. ISACA positions it as the technical counterpart to the compliance-side privacy credentials, and sets an experience requirement of three or more years; it suits privacy engineers, security architects moving into privacy, and IT professionals who own the systems where personal data lives. Verify the current eligibility rules at isaca.org.
Which privacy frameworks and standards show up on the exam?
The outline names privacy frameworks such as the NIST Privacy Framework and ISO 27701 under Privacy Risk Management and Compliance, and expects threat modelling through a privacy lens — LINDDUN rather than only STRIDE. Data Life Cycle Management reaches into defensible destruction, from media sanitisation per NIST SP 800-88 to cryptographic erasure in multi-tenant clouds. You are not asked to recite these documents; you are asked to pick the control or artifact they would point you to for the scenario in front of you.
How is this free sample different from the full Certifym bank?
The sample is a fixed 15-question set spread across the four domains at blueprint proportions. The full Certifym bank runs original CDPSE questions as full-length, 120-question timed simulations weighted exactly to the official blueprint — 24 questions on governance, 21 on risk and compliance, 28 on the data life cycle, and 47 on privacy engineering — on the same 3.5-hour clock as the real exam, with study mode and domain drills alongside. None of the paid-bank items appear in this sample.
Is Certifym affiliated with ISACA?
No. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISACA. All questions and explanations on this site are original content produced by Certifym and are not sourced from actual ISACA exam questions.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISACA. CDPSE® and ISACA® are registered trademarks of ISACA, used here only to identify the certification these study materials are intended for. The CDPSE Exam Content Outline and its domain structure are the property of ISACA; download the current outline directly from isaca.org.
All practice questions, answers, and explanations on this page are original content produced by Certifym Exam Services, LLC. They are not actual ISACA examination questions and are not represented as such. Exam format, domain weights, and eligibility criteria are set by ISACA and may change; verify current details at isaca.org before scheduling.