IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 101:

  SCENARIO

  Please use the following to answer the next questions:

  Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub. This is accessible through the `Settings' icon from any app page then clicking `My Preferences', and selecting `Information Sharing and Consent' where the following choices are displayed:

  1.

  "I consent to receive notifications and infection alerts";

  2.

  "I consent to receive information on additional features or services and new products";

  3.

  "I consent to sharing only my risk result and location information for exposure and contact tracing purposes";

  4.

  "I consent to share my data for medical research purposes"; and

  5.

  "I consent to share my data with healthcare providers affiliated to the company".

  For each choice, an `ON' or `OFF' tab is available The default setting is `ON' for all. Users purchase a virus screening service for US$29.99 for themselves or others using the app. The virus screening service works as follows:

  1.

  Step 1: A photo of the user's face is taken

  2.

  Step 2: The user measures their temperature and adds the reading in the app

  3.

  Step 3: The user is asked to read sentences so that a voice analysis can detect symptoms

  4.

  Step 4: The user is asked to answer questions on known symptoms

  5.

  Step 5: The user can input information on family members (name, date of birth, citizenship, home address, phone number, email and relationship).

  The results are displayed as one of the following risk status "Low", "Medium" or "High". If the user is deemed at "Medium" or "High" risk an alert may be sent to other users, and the user is invited to seek a medical consultation and diagnostic from a healthcare provider.

  A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in close proximity of an infected person. If a user has come in contact with another individual classified as `medium' or `high' risk, an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual. Location is collected using the phone's GPS functionality, whether the app is in use or not however the exact location of the user is "blurred' for privacy reasons. Users can only see on the map circles with a 12-feet radius (approximately 4 meters wide), which is double the recommended distance for social distancing.

  Which of the following pieces of information collected is the LEAST likely to be justified for the purposes of the app?

  A. Relationship of family member.
  B. Home address.
  C. Date of birth.
  D. Citizenship.
  D. Citizenship.

• Question 102:

  When deploying a consumer gadget that incorporates speech recognition, where is the speech generally best processed, from a privacy by design perspective?

  A. Within the subject's jurisdiction
  B. On the remote server
  C. On the local device
  D. In the cloud
  C. On the local device

• Question 103:

  Which of the following CANNOT be effectively determined during a code audit?

  A. Whether access control logic is recommended in all cases.
  B. Whether data is being incorrectly shared with a third-party.
  C. Whether consent is durably recorded in the case of a server crash.
  D. Whether the differential privacy implementation correctly anonymizes data.
  D. Whether the differential privacy implementation correctly anonymizes data.

• Question 104:

  One difference between privacy threat modeling and information security threat modeling is?

  A. Privacy threat modeling looks at threats to the individual while security threat modeling looks at threats to the organization.
  B. Security threat modeling is required by regulations such as the HIPAA Privacy Rule, but privacy threat modeling is not.
  C. Privacy threat modeling does not consider technical defects such as software vulnerabilities.
  D. Privacy threat modeling must consider insider threats, but security threat modeling does not.
  A. Privacy threat modeling looks at threats to the individual while security threat modeling looks at threats to the organization.

• Question 105:

  SCENARIO

  WebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to

  WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker. The CEO of WebTracker, Mr. Bond, would like to

  assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating

  any internal data processing activity, such as HR or Payroll.

  This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome -- a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources

  to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.

  To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.

  The results of this initial work include the following notes:

  There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome. You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in

  the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure. There are data flows representing personal data being collected from the internal employees of WebTracker, including an

  interface from the HR system. Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.

  All the WebTracker and SmartHome customers are based in USA and Canada.

  Which of the following issues is most likely to require an investigation by the Chief Privacy Officer (CPO) of WebTracker?

  A. Data flows use encryption for data at rest, as defined by the IT manager.
  B. AmaZure sends newsletter to WebTracker customers, as approved by the Marketing Manager.
  C. Employees' personal data are being stored in a cloud HR system, as approved by the HR Manager.
  D. File Integrity Monitoring is being deployed in SQL servers, as indicated by the IT Architect Manager.
  B. AmaZure sends newsletter to WebTracker customers, as approved by the Marketing Manager.

  ---

  Explanation/Reference:

  Sending marketing communications such as newsletters to customers involves processing their personal data. It is important for WebTracker's CPO to investigate whether this processing is being done in compliance with applicable data protection laws and regulations. This may include verifying that customers have given their consent to receive these communications or that another lawful basis for processing their personal data exists.

• Question 106:

  What is the main benefit of using a private cloud?

  A. The ability to use a backup system for personal files.
  B. The ability to outsource data support to a third party.
  C. The ability to restrict data access to employees and contractors.
  D. The ability to cut costs for storing, maintaining, and accessing data.
  C. The ability to restrict data access to employees and contractors.

• Question 107:

  Properly configured databases and well-written website codes are the best protection against what online threat?

  A. Pharming.
  B. SQL injection.
  C. Malware execution.
  D. System modification.
  B. SQL injection.

  ---

  Explanation/Reference:

  Properly configured databases and well-written website code are essential protections against SQL injection attacks. SQL injection occurs when an attacker exploits a security vulnerability arising from improper input validation in code for web applications that interact with databases. By injecting malicious SQL statements into an entry field for execution, an attacker can read, modify, or delete data that they are not normally able to access. Ensuring that database queries are securely written and that databases are configured to reject malicious inputs is critical to defending against this type of security threat.

• Question 108:

  Which of the following statements best describes the relationship between privacy and security?

  A. Security systems can be used to enforce compliance with privacy policies.
  B. Privacy and security are independent; organizations must decide which should by emphasized.
  C. Privacy restricts access to personal information; security regulates how information should be used.
  D. Privacy protects data from being viewed during collection and security governs how collected data should be shared.
  C. Privacy restricts access to personal information; security regulates how information should be used.

• Question 109:

  Which of these actions is NOT generally part of the responsibility of an IT or software engineer?

  A. Providing feedback on privacy policies.
  B. Implementing multi-factor authentication.
  C. Certifying compliance with security and privacy law.
  D. Building privacy controls into the organization's IT systems or software.
  C. Certifying compliance with security and privacy law.

• Question 110:

  SCENARIO

  Looking back at your first two years as the Director of Personal Information Protection and Compliance for the St. Anne's Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on-hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.

  You recall a recent visit to the Records Storage Section in the basement of the old hospital next to the modern facility, where you noticed paper records sitting in crates labeled by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. On the back shelves of the section sat data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the records storage section, you noticed a man leaving whom you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.

  You quickly realize that you need a plan of action on the maintenance, secure storage and disposal of data.

  Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system at St. Anne's Regional Medical Center?

  A. Symmetric Encryption
  B. Tokenization
  C. Obfuscation
  D. Certificates
  B. Tokenization

  ---

  Explanation/Reference:

  For protecting patient credit card information in the records system at St. Anne's Regional Medical Center, tokenization is the most appropriate cryptographic standard. Tokenization involves replacing sensitive data elements, such as credit card numbers, with non-sensitive equivalents, referred to as tokens, which have no exploitable value. These tokens can then be used in the database and applications without bringing actual credit card details into the environment, thereby significantly reducing the risk of sensitive data breaches.

  Tokenization is particularly effective for payment card data because it allows the system to function normally using tokens instead of real card numbers, ensuring that the data remains secure even if the system is compromised. This approach also helps in complying with payment card industry data security standards (PCI DSS), which strongly emphasize protecting cardholder data.