IAPP IAPP Certifications CIPT Questions & Answers

• Question 121:

  What is the most effective first step to take to operationalize Privacy by Design principles in new product development and projects?

  A. Implementing a mandatory privacy review and legal approval process.

  B. Obtain leadership buy-in for a mandatory privacy review and approval process.

  C. Set up an online Privacy Impact Assessment tool to facilitate Privacy by Design compliance.

  D. Conduct annual Privacy by Design training and refreshers for all impacted personnel.

  Correct Answer: B

  This is the most effective first step to operationalize Privacy by Design principles in new product development and projects. It is important to obtain leadership buy-in for a mandatory privacy review and approval process to ensure that privacy is a priority throughout the organization.

• Question 122:

  What is the main benefit of using a private cloud?

  A. The ability to use a backup system for personal files.

  B. The ability to outsource data support to a third party.

  C. The ability to restrict data access to employees and contractors.

  D. The ability to cut costs for storing, maintaining, and accessing data.

  Correct Answer: C

• Question 123:

  SCENARIO

  Please use the following to answer the next questions:

  Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub. This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:

  1.

  "I consent to receive notifications and infection alerts";

  2.

  "I consent to receive information on additional features or services, and new products";

  3.

  "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";

  4.

  "I consent to share my data for medical research purposes"; and

  5.

  "I consent to share my data with healthcare providers affiliated to the company".

  For each choice, an ON* or OFF tab is available The default setting is ON for all

  Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:

  1.

  Step 1 A photo of the user's face is taken.

  2.

  Step 2 The user measures their temperature and adds the reading in the app

  3.

  Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms

  4.

  Step 4 The user is asked to answer questions on known symptoms

  5.

  Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).)

  The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.

  A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles

  The location data collected and displayed on the map should be changed for which of the following reasons?

  A. The blurriness does not allow users to know how close they are to an infected person

  B. The radius used for location data exceeds official social distancing rules

  C. The location data has not been pseudonymized

  D. The location data is loo precise

  Correct Answer: D

  Location data that is too precise can reveal sensitive information about an individual's movements and activities. This could raise privacy concerns if this detailed location data is shared with third parties or used for purposes other than contact tracing. Pseudonymizing location data (option C) could also help protect user privacy but may not address concerns about overly precise location data.

• Question 124:

  What has been found to undermine the public key infrastructure system?

  A. Man-in-the-middle attacks.

  B. Inability to track abandoned keys.

  C. Disreputable certificate authorities.

  D. Browsers missing a copy of the certificate authority's public key.

  Correct Answer: C

• Question 125:

  Which is the most accurate type of biometrics?

  A. DNA

  B. Voiceprint.

  C. Fingerprint.

  D. Facial recognition.

  Correct Answer: A

  Reference: https://www.bayometric.com/biometrics-face-finger-iris-palm-voice/

• Question 126:

  What is the main function of the Amnesic Incognito Live System or TAILS device?

  A. It allows the user to run a self-contained computer from a USB device.

  B. It accesses systems with a credential that leaves no discernable tracks.

  C. It encrypts data stored on any computer on a network.

  D. It causes a system to suspend its security protocols.

  Correct Answer: B

  It accesses systems with a credential that leaves no discernable tracks. TAILS is designed to provide anonymous and private internet usage by running from a USB device without leaving traces on the host system. It routes internet traffic through the Tor network, ensuring privacy and security for users who need to browse or communicate without revealing their identity or leaving digital footprints. TAILS does not suspend security protocols; instead, it enhances security by minimizing exposure and maintaining anonymity.

  Reference: https://www.wired.co.uk/article/tails-operating-software

• Question 127:

  SCENARIO

  Tom looked forward to starting his new position with a U.S --based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below. Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as-a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.

  Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.

  Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and West Company networks.

  Which statement is correct about addressing New Company stakeholders' expectations for privacy?

  A. New Company should expect consumers to read the company's privacy policy.

  B. New Company should manage stakeholder expectations for privacy even when the stakeholders` data is not held by New Company.

  C. New Company would best meet consumer expectations for privacy by adhering to legal requirements.

  D. New Company's commitment to stakeholders ends when the stakeholders' data leaves New Company.

  Correct Answer: C

  Adhering to legal requirements for data protection and privacy is an important way for New Company to meet its stakeholders' expectations for privacy. This includes complying with applicable data protection laws and regulations and implementing appropriate measures to protect personal data.

• Question 128:

  Which of the following is considered a client-side IT risk?

  A. Security policies focus solely on internal corporate obligations.

  B. An organization increases the number of applications on its server.

  C. An employee stores his personal information on his company laptop.

  D. IDs used to avoid the use of personal data map to personal data in another database.

  Correct Answer: C

  An employee stores his personal information on his company laptop. This is considered a client-side IT risk because it involves the actions of an employee who has control over the use of their individual device. Client-side IT risk refers to the potential threats that arise from devices or applications that are used by end-users or customers3. An employee storing his personal information on his company laptop is an example of client-side IT risk, as it exposes sensitive data to unauthorized access, theft or loss. The other options are examples of server-side IT risk, which involves threats that originate from systems or networks that host applications or services3.

• Question 129:

  Which of the following best describes the basic concept of "Privacy by Design?"

  A. The adoption of privacy enhancing technologies.

  B. The integration of a privacy program with all lines of business.

  C. The implementation of privacy protection through system architecture.

  D. The introduction of business process to identify and assess privacy gaps.

  Correct Answer: C

  the basic concept of "Privacy by Design" is the implementation of privacy protection through system architecture.

• Question 130:

  What is the main privacy threat posed by Radio Frequency Identification (RFID)?

  A. RFID can be utilized to track people or consumer products

  B. RFID can be utilized to gam unauthorized access to an individual's device

  C. RFID can be utilized to spoof identification details

  D. RFID can be utilized to read information from a device without the user's knowledge

  Correct Answer: A

  the main privacy threat posed by Radio Frequency Identification (RFID) is that it can be utilized to track people or consumer products. RFID technology allows for wireless communication between tags and readers, which can be used to track the location and movement of tagged items.