IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 141:

  Which of the following can be used to bypass even the best physical and logical security mechanisms to gain access to a system?

  A. Phishing emails.
  B. Denial of service.
  C. Brute-force attacks.
  D. Social engineering.
  D. Social engineering.

  ---

  Explanation/Reference:

  social engineering can be used to bypass even the best physical and logical security mechanisms to gain access to a system. Social engineering involves manipulating individuals into revealing sensitive information or performing actions that compromise security.

• Question 142:

  Under the Family Educational Rights and Privacy Act (FERPA), releasing personally identifiable information from a student's educational record requires written permission from the parent or eligible student in order for information to be?

  A. Released to a prospective employer.
  B. Released to schools to which a student is transferring.
  C. Released to specific individuals for audit or evaluation purposes.
  D. Released in response to a judicial order or lawfully ordered subpoena.
  A. Released to a prospective employer.

  ---

  Explanation/Reference:

  Reference: https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

• Question 143:

  The increase in remote working has resulted in greater use of videoconferencing by companies. When assessing the privacy risk from implementing and enabling recording functionality of video conferencing software, which of the following would a privacy technologist most likely require of the software?

  A. That encryption is used for storage of the video recording data.
  B. That the meeting recording can only be accessed by the attendees.
  C. That there is a noticeable indication to all attendees when recording is active.
  D. That the geographical location of the attendees is logged for compliance purposes.
  C. That there is a noticeable indication to all attendees when recording is active.

• Question 144:

  Which of the following entities would most likely be exempt from complying with the General Data Protection Regulation (GDPR)?

  A. A South American company that regularly collects European customers' personal data.
  B. A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.
  C. A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.
  D. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.
  D. A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

• Question 145:

  Which of the following methods does NOT contribute to keeping the data confidential?

  A. Differential privacy.
  B. Homomorphic encryption.
  C. K-anonymity.
  D. Referential integrity.
  D. Referential integrity.

  ---

  Explanation/Reference:

  referential integrity does not contribute to keeping the data confidential.

• Question 146:

  What was the first privacy framework to be developed?

  A. OECD Privacy Principles.
  B. Generally Accepted Privacy Principles.
  C. Code of Fair Information Practice Principles (FIPPs).
  D. The Asia-Pacific Economic Cooperation (APEC) Privacy Framework.
  C. Code of Fair Information Practice Principles (FIPPs).

  ---

  Explanation/Reference:

  The first privacy framework to be developed was the Code of Fair Information Practice Principles (FIPPs)3. The FIPPs were proposed by a US government advisory committee in 1973 as a set of guidelines for protecting personal data in automated systems3. The FIPPs influenced many subsequent privacy frameworks and laws around the world, such as the OECD Privacy Principles (1980), the EU Data Protection Directive (1995), and the APEC Privacy Framework (2004)3.

• Question 147:

  A company is looking to adopt new technology which the privacy technologist on the project believes may be unethical from a privacy standpoint. How should the privacy technologist respond?

  A. Stop the project by exercising veto rights.
  B. Implement privacy technical measures to help mitigate the identified privacy risks.
  C. Advise the project team about legal mechanisms it could adopt to manage the ethical considerations.
  D. Perform an audit of privacy controls post implementation to show leadership how unethical the project actually was.
  B. Implement privacy technical measures to help mitigate the identified privacy risks.

• Question 148:

  SCENARIO

  Please use the following to answer the next questions:

  Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub. This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:

  1.

  "I consent to receive notifications and infection alerts";

  2.

  "I consent to receive information on additional features or services, and new products";

  3.

  "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";

  4.

  "I consent to share my data for medical research purposes"; and

  5.

  "I consent to share my data with healthcare providers affiliated to the company".

  For each choice, an ON* or OFF tab is available The default setting is ON for all

  Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:

  1.

  Step 1 A photo of the user's face is taken.

  2.

  Step 2 The user measures their temperature and adds the reading in the app

  3.

  Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms

  4.

  Step 4 The user is asked to answer questions on known symptoms

  5.

  Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).)

  The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.

  A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles

  The location data collected and displayed on the map should be changed for which of the following reasons?

  A. The blurriness does not allow users to know how close they are to an infected person
  B. The radius used for location data exceeds official social distancing rules
  C. The location data has not been pseudonymized
  D. The location data is loo precise
  D. The location data is loo precise

  ---

  Explanation/Reference:

  Location data that is too precise can reveal sensitive information about an individual's movements and activities. This could raise privacy concerns if this detailed location data is shared with third parties or used for purposes other than contact tracing. Pseudonymizing location data (option C) could also help protect user privacy but may not address concerns about overly precise location data.

• Question 149:

  A privacy engineer advises that multifactor authentication be used to log into a system containing personal data. Which of the following would be acceptable?

  A. Fingerprint scanning and then iris scanning.
  B. Facial recognition and then entering a PIN.
  C. Plugging in a smart card and then verifying a code sent to a mobile device.
  D. Entering a password and then answering a security question tied to the person.
  C. Plugging in a smart card and then verifying a code sent to a mobile device.

• Question 150:

  Which of the following is an example of the privacy risks associated with the Internet of Things (loT)?

  A. A group of hackers infiltrate a power grid and cause a major blackout.
  B. An insurance company raises a person's rates based on driving habits gathered from a connected car.
  C. A website stores a cookie on a user's hard drive so the website can recognize the user on subsequent visits.
  D. A water district fines an individual after a meter reading reveals excess water use during drought conditions.
  B. An insurance company raises a person's rates based on driving habits gathered from a connected car.