IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 151:

  Which is NOT a drawback to using a biometric recognition system?

  A. It can require more maintenance and support.
  B. It can be more expensive than other systems
  C. It has limited compatibility across systems.
  D. It is difficult for people to use.
  D. It is difficult for people to use.

• Question 152:

  A sensitive biometrics authentication system is particularly susceptible to?

  A. False positives.
  B. False negatives.
  C. Slow recognition speeds.
  D. Theft of finely individualized personal data.
  B. False negatives.

  ---

  Explanation/Reference:

  Reference: https://link.springer.com/article/10.1007/s41403-017-0026-8

• Question 153:

  What is the main reason a company relies on implied consent instead of explicit consent from a user to process her data?

  A. The implied consent model provides the user with more detailed data collection information.
  B. To secure explicit consent, a user's website browsing would be significantly disrupted.
  C. An explicit consent model is more expensive to implement.
  D. Regulators prefer the implied consent model.
  B. To secure explicit consent, a user's website browsing would be significantly disrupted.

  ---

  Explanation/Reference:

  The main reason a company relies on implied consent instead of explicit consent from a user to process their data is typically due to the concern that securing explicit consent might significantly disrupt the user's website browsing experience. Implied consent assumes that users agree to certain data processing practices by continuing to use a website or service, without requiring them to actively provide explicit consent for each specific action. While explicit consent provides more transparency and control to users, it can indeed be more cumbersome to implement and may lead to interruptions in the user experience. However, companies must strike a balance between user privacy and operational efficiency while adhering to relevant regulations.

• Question 154:

  When analyzing user data, how is differential privacy applied?

  A. By injecting noise into aggregated datasets.
  B. By assessing differences between datasets.
  C. By applying asymmetric encryption to datasets.
  D. By removing personal identifiers from datasets.
  A. By injecting noise into aggregated datasets.

• Question 155:

  SCENARIO

  Please use the following to answer the next question:

  Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

  The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.

  LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) for the new Light Blue Health application currently in development. Which of the following best describes a risk that is likely to result in a privacy breach?

  A. Limiting access to the app to authorized personnel.
  B. Including non-transparent policies, terms and conditions in the app.
  C. Insufficiently deleting personal data after an account reaches its retention period.
  D. Not encrypting the health record when it is transferred to the Light Blue Health servers.
  D. Not encrypting the health record when it is transferred to the Light Blue Health servers.

  ---

  Explanation/Reference:

  Not encrypting health records when they are transferred to Light Blue Health servers can leave sensitive personal information vulnerable to interception and unauthorized access. This could result in a privacy breach if an attacker were able to access this unencrypted data.

• Question 156:

  Which of the following provides a mechanism that allows an end-user to use a single sign- on (SSO) for multiple services?

  A. The Open ID Federation.
  B. PCI Data Security Standards Council
  C. International Organization for Standardization.
  D. Personal Information Protection and Electronic Documents Act.
  A. The Open ID Federation.

• Question 157:

  SCENARIO

  Please use the following to answer the next question:

  Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

  The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.

  LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.

  What is the best way to minimize the potential harms from a data breach?

  A. Dissociate the patient health data from the personal data
  B. Employ Multi-Factor Authentication (MFA) to access the app
  C. Exclude the collection of personal information from the health record
  D. Ensure that all files collected by the app and stored on the device are password-protected
  A. Dissociate the patient health data from the personal data

• Question 158:

  How should the sharing of information within an organization be documented?

  A. With a binding contract.
  B. With a data flow diagram.
  C. With a disclosure statement.
  D. With a memorandum of agreement.
  B. With a data flow diagram.

  ---

  Explanation/Reference:

  A data flow diagram (DFD) is an effective tool for documenting how information is shared within an organization. It visually represents the flow of data between processes, data stores, and entities, making it easier to understand and manage the internal sharing of information.

• Question 159:

  A healthcare provider would like to data mine information for research purposes however the Chief Privacy Officer is concerned medical data of individuals may be disclosed overcome the concern, which is the preferred technique for protecting such data while still allowing for analysis?

  A. Access Control
  B. Encryption
  C. Isolation
  D. Perturbation
  D. Perturbation

  ---

  Explanation/Reference:

  perturbation would be a preferred technique for protecting medical data while still allowing for analysis. Perturbation involves adding noise or randomness to data in order to preserve privacy while still allowing for statistical analysis.

• Question 160:

  Which technique is most likely to facilitate the deletion of every instance of data associated with a deleted user account from every data store held by an organization?

  A. Auditing the code which deletes user accounts.
  B. Building a standardized and documented retention program for user data deletion.
  C. Monitoring each data store for presence of data associated with the deleted user account.
  D. Training engineering teams on the importance of deleting user accounts their associated data from all data stores when requested.
  C. Monitoring each data store for presence of data associated with the deleted user account.