IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 111:

  A company configures its information system to have the following capabilities:

  1.

  Allow for selective disclosure of attributes to certain parties, but not to others.

  2.

  Allow for information to be altered or deleted as needed.

  These capabilities help to achieve which privacy engineering objective?

  A. Anthropomorphism
  B. Confidentiality.
  C. Disassociability.
  D. Manageability.
  C. Disassociability.

• Question 112:

  What is the main reason the Do Not Track (DNT) header is not acknowledged by more companies?

  A. Most web browsers incorporate the DNT feature.
  B. The financial penalties for violating DNT guidelines are too high.
  C. There is a lack of consensus about what the DNT header should mean.
  D. It has been difficult to solve the technological challenges surrounding DNT.
  C. There is a lack of consensus about what the DNT header should mean.
  D. It has been difficult to solve the technological challenges surrounding DNT.

• Question 113:

  Which of the following occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed?

  A. Express consent.
  B. Implied consent.
  C. Informed notice.
  D. Authorized notice.
  A. Express consent.

  ---

  Explanation/Reference:

  Express consent occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed. https://niccs.cisa.gov/education-training/catalog/international-association-privacy-professionals-iapp/certified-1

• Question 114:

  Which of the following is an example of an appropriation harm?

  A. A friend takes and uploads your pictures to a social media website.
  B. A hacker gains access to your email account and reads your messages.
  C. A government agency uses cameras to monitor your movements in a public area.
  D. An unauthorized individual obtains access to your personal information and uses it for medical fraud.
  A. A friend takes and uploads your pictures to a social media website.

• Question 115:

  Which privacy engineering objective proposed by the US National Institute of Science and Technology (NIST) decreases privacy risk by ensuring that connections between individuals and their personal data are reduced?

  A. Disassoc lability
  B. Manageability
  C. Minimization
  D. Predictability
  A. Disassoc lability

• Question 116:

  Which of the following would be an example of an "objective" privacy harm to an individual?

  A. Receiving spam following the sale an of email address.
  B. Negative feelings derived from government surveillance.
  C. Social media profile views indicating unexpected interest in a person.
  D. Inaccuracies in personal data.
  D. Inaccuracies in personal data.

  ---

  Explanation/Reference:

  Inaccuracies in personal data would be an example of an "objective" privacy harm to an individual. This is because inaccuracies in personal data can lead to incorrect decisions being made about an individual, which can have negative consequences for the individual.

• Question 117:

  Which of the following does NOT illustrate the `respect to user privacy' principle?

  A. Implementing privacy elements within the user interface that facilitate the use of technology by any visually-challenged users.
  B. Enabling Data Subject Access Request (DSARs) that provide rights for correction, deletion, amendment and rectification of personal information.
  C. Developing a consent management self-service portal that enables the data subjects to review the details of consent provided to an organization.
  D. Filing breach notification paperwork with data protection authorities which detail the impact to data subjects.
  D. Filing breach notification paperwork with data protection authorities which detail the impact to data subjects.

• Question 118:

  In jurisdictions where children are legally protected online, privacy controls should be implemented in each of the following situations EXCEPT?

  A. A virtual jigsaw puzzle game marketed for ages 5-9 displays pieces of the puzzle on a handheld screen. Once the child completes a certain level, it flashes a message about new themes released that day.
  B. A child logs in to a system to use an interactive toy that copies the child's behavior through gestures and kid-friendly sounds.
  C. A math tutoring service commissioned an advertisement on a bulletin board inside a school. The service makes it simple for children to reach out to tutors by entering a through a QR-code through their school account.
  D. A note-taking application converts hard copies of kids' class notes into audio books in seconds and stores a copy in the cloud in the students' account.
  C. A math tutoring service commissioned an advertisement on a bulletin board inside a school. The service makes it simple for children to reach out to tutors by entering a through a QR-code through their school account.

• Question 119:

  Which of the following would be the most appropriate solution for preventing privacy violations related to information exposure through an error message?

  A. Configuring the environment to use shorter error messages.
  B. Handing exceptions internally and not displaying errors to the user.
  C. Creating default error pages or error messages which do not include variable data.
  D. Logging the session name and necessary parameters once the error occurs to enable trouble shooting.
  C. Creating default error pages or error messages which do not include variable data.

• Question 120:

  Between November 30th and December 2nd, 2013, cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent against such an attack.

  Which of the following would best explain why the retailer's consumer data was still exfiltrated?

  A. The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.
  B. The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.
  C. The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailer's system.
  D. The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.
  A. The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.