IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 131:

  You are a wine collector who uses the web to do research about your hobby. You navigate to a news site and an ad for wine pops up. What kind of advertising is this?

  A. Remnant.
  B. Behavioral.
  C. Contextual.
  D. Demographic.
  B. Behavioral.

  ---

  Explanation/Reference:

  The type of advertising in this scenario is Behavioral advertising.

  Behavioral advertising is a type of online advertising that targets users based on their online behavior, such as their browsing history, search queries, and other actions taken online. It involves the use of cookies and other tracking technologies to collect data on users' behavior and interests, and then deliver targeted ads to them.

  In this scenario, the ad for wine that popped up on the news site was likely delivered based on the user's browsing history and search queries related to wine collecting, indicating that the advertising was behaviorally targeted to the user's interests and online behavior.

  Reference: https://neilpatel.com/blog/behavioral-advertising/

• Question 132:

  Which is NOT a suitable method for assuring the quality of data collected by a third-party company?

  A. Verifying the accuracy of the data by contacting users.
  B. Validating the company's data collection procedures.
  C. Introducing erroneous data to see if its detected.
  D. Tracking changes to data through auditing.
  C. Introducing erroneous data to see if its detected.

  ---

  Explanation/Reference:

  Introducing erroneous data to see if it's detected is not a suitable method for assuring the quality of data collected by a third-party company1. This method could compromise the integrity and reliability of the data and cause confusion or harm to the users or the business1. The other options are suitable methods for assuring the quality of data collected by a third-party company1. Verifying the accuracy of the data by contacting users can help identify and correct any errors or inconsistencies in the data1. Validating the company's data collection procedures can help ensure that they follow best practices and standards for collecting, storing, and processing personal information1. Tracking changes to data through auditing can help monitor and document any modifications or deletions made to the data1.

  https://www.isaca.org/resources/news-and-trends/industry-news/2021/data-minimization-a-practical-approach

• Question 133:

  SCENARIO

  Please use the following to answer the next question:

  Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as

  so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental

  transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley

  Motors emailed a copy of the final receipt to the address on file.

  Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number,

  occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and

  transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a

  written letter regarding the infraction to collect the fine.

  After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.

  How can Finley Motors reduce the risk associated with transferring Chuck's personal information to AMP Payment Resources?

  A. By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer.
  B. By requesting AMP Payment Resources delete unnecessary datasets and only utilize what is necessary to process the violation notice.
  C. By obfuscating the minimum necessary data to process the violation notice and require AMP Payment Resources to secure store the personal information.
  D. By transferring all information to separate datafiles and requiring AMP Payment Resources to combine the datasets during processing of the violation notice.
  A. By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer.

  ---

  Explanation/Reference:

  To reduce the risk associated with transferring Chuck's personal information to AMP Payment Resources, Finley Motors could take several steps. One such step would be option A: By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer.By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer, Finley Motors can help reduce the risk associated with transferring Chuck's personal information. This can help ensure that only necessary data is shared and that any unnecessary or sensitive data is protected.

• Question 134:

  One year cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent such an attack.

  Which of the following would best explain why the retailer's consumer data was still exfiltrated?

  A. The newly installed malware prevention system conflicted with the legacy malware prevention system.
  B. The detection software alerted the retailer's security operations center as designed, but the information security personnel failed to act upon the alerts in a timely manner.
  C. The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by advanced threat actors who then entered the retailer's system.
  D. The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.
  B. The detection software alerted the retailer's security operations center as designed, but the information security personnel failed to act upon the alerts in a timely manner.

• Question 135:

  SCENARIO

  Please use the following to answer the next question:

  Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to

  recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

  The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended

  treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to

  review along with the health record. The patient may also delegate access to the app.

  LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user

  related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide

  consent.

  What is the best way to minimize the risk of an exposure violation through the use of the app?

  A. Prevent the downloading of photos stored in the app.
  B. Dissociate the patient health data from the personal data.
  C. Exclude the collection of personal information from the health record.
  D. Create a policy to prevent combining data with external data sources.
  B. Dissociate the patient health data from the personal data.

  ---

  Explanation/Reference:

  By dissociating patient health data from personal data, Light Blue Health can help reduce the risk of an exposure violation. This can help prevent sensitive health information from being linked to an individual's identity and reduce the potential harm that could result from a privacy breach.

• Question 136:

  Which of the following technologies presents the most challenges to organizations when obtaining and demonstrating valid consent from individuals?

  A. Chatbots.
  B. Speech recognition.
  C. Internet of Things (IoT).
  D. Robotic Process Automation (RPA).
  C. Internet of Things (IoT).

• Question 137:

  An organization is developing a mobile app-based game with children as the target audience. What is the most important requirement when following a code of practice to protect the privacy and wellbeing of the expected users?

  A. Transparency and consent using prominent and clear language.
  B. Default settings with a primary focus on the best interests of the user.
  C. Simple tools that allow users to report concerns and exercise their rights.
  D. Parental controls that will allow monitoring of the users' activities on the app.
  B. Default settings with a primary focus on the best interests of the user.

• Question 138:

  What is the main benefit of using dummy data during software testing?

  A. The data comes in a format convenient for testing.
  B. Statistical disclosure controls are applied to the data.
  C. The data enables the suppression of particular values in a set.
  D. Developers do not need special privacy training to test the software.
  C. The data enables the suppression of particular values in a set.

  ---

  Explanation/Reference:

  Dummy data allows testers to create controlled scenarios by intentionally including or excluding specific values, ensuring comprehensive test coverage without compromising sensitive information. It helps protect privacy and maintain data security during testing.

• Question 139:

  What term describes two re-identifiable data sets that both come from the same unidentified individual?

  A. Pseudonymous data.
  B. Anonymous data.
  C. Aggregated data.
  D. Imprecise data.
  A. Pseudonymous data.

  ---

  Explanation/Reference:

  Reference: https://ico.org.uk/media/1061/anonymisation-code.pdf

• Question 140:

  Granting data subjects the right to have data corrected, amended, or deleted describes?

  A. Use limitation.
  B. Accountability.
  C. A security safeguard
  D. Individual participation
  D. Individual participation

  ---

  Explanation/Reference:

  Reference: https://www.ncbi.nlm.nih.gov/books/NBK236546/

  Granting data subjects the right to have data corrected, amended, or deleted describes individual participation1. As explained above, the individual participation principle gives individuals certain rights over their personal data held by a data controller1. One of these rights is to challenge data relating to them and, if the challenge is successful, to have the data erased, rectified, completed or amended1. The other options are not principles that describe granting data subjects this right.