IAPP IAPP Certifications CIPT Questions & Answers

• Question 91:

  In day to day interactions with technology, consumers are presented with privacy choices. Which of the following best represents the Privacy by Design (PbD) methodology of letting the user choose a non-zero-sum choice?

  A. Using images, words, and contexts to elicit positive feelings that result in proactive behavior, thus eliminating negativity and biases.

  B. Providing plain-language design choices that elicit privacy-related responses, helping users avoid errors and minimize the negative consequences of errors when they do occur.

  C. Displaying the percentage of users that chose a particular option, thus enabling the user to choose the most preferred option.

  D. Using contexts, antecedent events, and other priming concepts to assist the user in making a better privacy choice.

  Correct Answer: B

• Question 92:

  Which of the following activities would be considered the best method for an organization to achieve the privacy principle of data quality'?

  A. Clash customer information with information from a data broker

  B. Build a system with user access controls and approval workflows to edit customer data

  C. Set a privacy notice covering the purpose for collection of a customer's data

  D. Provide a customer with a copy of their data in a machine-readable format

  Correct Answer: B

  building a system with user access controls and approval workflows to edit customer data would be considered the best method for an organization to achieve the privacy principle of data quality.

• Question 93:

  What is the term for information provided to a social network by a member?

  A. Profile data.

  B. Declared data.

  C. Personal choice data.

  D. Identifier information.

  Correct Answer: B

• Question 94:

  Which of the following is NOT a valid basis for data retention?

  A. Size of the data.

  B. Type of the data.

  C. Location of the data.

  D. Last time the data was accessed.

  Correct Answer: A

  The size of the data is not a valid basis for determining data retention policies. Data retention should be guided by more substantial criteria such as the type of the data (which can determine its sensitivity and legal retention requirements), the location of the data (which can be relevant due to varying legal jurisdictions and regulations), and the last time the data was accessed (which can help in assessing the data's ongoing relevance and necessity). The mere size of the data does not typically provide sufficient grounds for making decisions about whether to retain or dispose of data, as size does not inherently reflect the importance, sensitivity, or legal requirements associated with the data.

• Question 95:

  Which of the following is one of the fundamental principles of information security?

  A. Accountability.

  B. Accessibility.

  C. Confidentiality.

  D. Connectivity.

  Correct Answer: C

  confidentiality is one of the fundamental principles of information security. Confidentiality refers to protecting information from unauthorized access and disclosure.

• Question 96:

  SCENARIO

  Please use the following to answer the next question:

  Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to

  recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

  The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended

  treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to

  review along with the health record. The patient may also delegate access to the app.

  LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user

  related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide

  consent.

  What is the best way to minimize the risk of an exposure violation through the use of the app?

  A. Prevent the downloading of photos stored in the app.

  B. Dissociate the patient health data from the personal data.

  C. Exclude the collection of personal information from the health record.

  D. Create a policy to prevent combining data with external data sources.

  Correct Answer: B

  By dissociating patient health data from personal data, Light Blue Health can help reduce the risk of an exposure violation. This can help prevent sensitive health information from being linked to an individual's identity and reduce the potential harm that could result from a privacy breach.

• Question 97:

  Which of the following can be used to bypass even the best physical and logical security mechanisms to gain access to a system?

  A. Phishing emails.

  B. Denial of service.

  C. Brute-force attacks.

  D. Social engineering.

  Correct Answer: D

  social engineering can be used to bypass even the best physical and logical security mechanisms to gain access to a system. Social engineering involves manipulating individuals into revealing sensitive information or performing actions that compromise security.

• Question 98:

  What is an Access Control List?

  A. A list of steps necessary for an individual to access a resource.

  B. A list that indicates the type of permission granted to each individual.

  C. A list showing the resources that an individual has permission to access.

  D. A list of individuals who have had their access privileges to a resource revoked.

  Correct Answer: B

• Question 99:

  What Privacy by Design (PbD) element should include a de-identification or deletion plan?

  A. Categorization.

  B. Remediation.

  C. Retention.

  D. Security

  Correct Answer: C

• Question 100:

  Ivan is a nurse for a home healthcare service provider in the US. The company has implemented a mobile application which Ivan uses to record a patient's vital statistics and access a patient's health care records during home visits. During one visitj^van is unable to access the health care application to record the patient's vitals. He instead records the information on his mobile phone's note-taking application to enter the data in the health care application the next time it is accessible. What would be the best course of action by the IT department to ensure the data is protected on his device?

  A. Provide all healthcare employees with mandatory annual security awareness training with a focus on the health information protection.

  B. Complete a SWOT analysis exercise on the mobile application to identify what caused the application to be inaccessible and remediate any issues.

  C. Adopt mobile platform standards to ensure that only mobile devices that support encryption capabilities are used.

  D. Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.

  Correct Answer: D

  the best course of action by the IT department to ensure the data is protected on Ivan's device is to implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.