IAPP IAPP Certifications CIPT Questions & Answers

• Question 161:

  Users of a web-based email service have their accounts breached through compromised login credentials. Which possible consequences of the breach illustrate the two categories of Calo's Harm Dimensions?

  A. Financial loss and blackmail.

  B. Financial loss and solicitation.

  C. Identity theft and embarrassment.

  D. Identity theft and the leaking of information.

  Correct Answer: C

  Extracts from The boundaries of privacy harms: "Objective harms can also occur when such information is used to commit a crime, such as identity theft or murder."; "The subjective category of privacy harm is the perception of unwanted observation. This category describes unwelcome mental states--anxiety, for instance, or embarrassment--that accompany the belief that one is or will be watched or monitored. "

• Question 162:

  Truncating the last octet of an IP address because it is NOT needed is an example of which privacy principle?

  A. Use Limitation

  B. Data Minimization

  C. Purpose Limitation

  D. Security Safeguards

  Correct Answer: B

  truncating the last octet of an IP address because it is not needed is an example of data minimization. Data minimization is a privacy principle that involves collecting and processing only the minimum amount of personal data necessary for a specific purpose.

• Question 163:

  SCENARIO

  Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.

  You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.

  Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system?

  A. Asymmetric Encryption

  B. Symmetric Encryption

  C. Obfuscation

  D. Hashing

  Correct Answer: B

  To protect patient credit card information in the records system at Berry Country Regional Medical Center, an appropriate cryptographic standard to use would be option B: Symmetric Encryption. Symmetric encryption uses a single secret key to encrypt and decrypt data. It is a fast and efficient method of encryption that can provide strong protection for sensitive data such as credit card information when implemented correctly.

• Question 164:

  Value sensitive design focuses on which of the following?

  A. Quality and benefit.

  B. Ethics and morality.

  C. Confidentiality and integrity.

  D. Consent and human rights.

  Correct Answer: B

  Value sensitive design (VSD) is a theoretically grounded approach to the design of technology that accounts for human values in a principled and comprehensive manner1. It brings human values to the forefront of the technical design process2.

• Question 165:

  Which of the following CANNOT be effectively determined during a code audit?

  A. Whether access control logic is recommended in all cases.

  B. Whether data is being incorrectly shared with a third-party.

  C. Whether consent is durably recorded in the case of a server crash.

  D. Whether the differential privacy implementation correctly anonymizes data.

  Correct Answer: D

• Question 166:

  Which of the following are the mandatory pieces of information to be included in the documentation of records of processing activities for an organization that processes personal data on behalf of another organization?

  A. Copies of the consent forms from each data subject.

  B. Time limits for erasure of different categories of data.

  C. Contact details of the processor and Data Protection Offer (DPO).

  D. Descriptions of the processing activities and relevant data subjects.

  Correct Answer: D

• Question 167:

  Which concept related to privacy choice is demonstrated by highlighting and bolding the "accept" button on a cookies notice while maintaining standard text format for other options?

  A. Illuminating

  B. Nudging

  C. Suppression

  D. Tagging

  Correct Answer: B

  highlighting and bolding the "accept" button on a cookies notice while maintaining standard text format for other options is an example of nudging. Nudging is a concept related to privacy choice that involves subtly influencing individuals' decisions through the design of choice architecture.

• Question 168:

  Which of the following functionalities can meet some of the General Data Protection Regulation's (GDPR's) Data Portability requirements for a social networking app designed for users in the EU?

  A. Allow users to modify the data they provided the app.

  B. Allow users to delete the content they provided the app.

  C. Allow users to download the content they have provided the app.

  D. Allow users to get a time-stamped list of what they have provided the app.

  Correct Answer: C

• Question 169:

  Between November 30th and December 2nd, 2013, cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent against such an attack.

  Which of the following would best explain why the retailer's consumer data was still exfiltrated?

  A. The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.

  B. The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.

  C. The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailer's system.

  D. The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.

  Correct Answer: A

• Question 170:

  What has been identified as a significant privacy concern with chatbots?

  A. Most chatbot providers do not agree to code audits

  B. Chatbots can easily verify the identity of the contact.

  C. Users' conversations with chatbots are not encrypted in transit.

  D. Chatbot technology providers may be able to read chatbot conversations with users.

  Correct Answer: D

  Reference: https://resources.infosecinstitute.com/privacy-concerns-emotional-chatbots/