IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 181:

  Which of the following techniques describes the use of encryption where encryption keys are divided into parts that can then be used to recover a full encryption key?

  A. Homomorphic encryption.
  B. Asymmetric cryptography.
  C. Cryptographic hashing.
  D. Secret sharing.
  D. Secret sharing.

  ---

  Explanation/Reference:

  the technique that describes the use of encryption where encryption keys are divided into parts that can then be used to recover a full encryption key is called secret sharing.

• Question 182:

  An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls.

  Before implementation, a privacy technologist should conduct which of the following?

  A. A Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.
  B. A privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.
  C. A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.
  D. A security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.
  C. A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.

• Question 183:

  SCENARIO Carol was a U.S.-based glassmaker who sold her work at art festivals. She kept things simple by only accepting cash and personal checks. As business grew, Carol couldn't keep up with demand, and traveling to festivals became burdensome. Carol opened a small boutique and hired Sam to run it while she worked in the studio. Sam was a natural salesperson, and business

  doubled. Carol told Sam, "I don't know what you are doing, but keep doing it!"

  But months later, the gift shop was in chaos. Carol realized that Sam needed help so she hired Jane, who had business expertise and could handle the back-office tasks. Sam would continue to focus on sales. Carol gave Jane a few weeks to get acquainted with the artisan craft business, and then scheduled a meeting for the three of them to discuss Jane's first impressions. At the meeting, Carol could not wait to hear Jane's thoughts, but she was unprepared for what Jane had to say. "Carol, I know that he doesn't realize it, but some of Sam's efforts to increase sales have put you in a vulnerable position. You are

  not protecting customers' personal information like you should."

  Sam said, "I am protecting our information. I keep it in the safe with our bank deposit. It's only a list of customers' names, addresses and phone numbers that I get from their checks before I deposit them. I contact them when you finish a piece

  that I think they would like. That's the only information I have! The only other thing I do is post photos and information about your work on the photo sharing site that I use with family and friends. I provide my email address and people send me

  their information if they want to see more of your work. Posting online really helps sales, Carol. In fact, the only complaint I hear is about having to come into the shop to make a purchase."

  Carol replied, "Jane, that doesn't sound so bad. Could you just fix things and help us to post even more online?"

  `I can," said Jane. "But it's not quite that simple. I need to set up a new program to make sure that we follow the best practices in data management. And I am concerned for our customers. They should be able to manage how we use their

  personal information. We also should develop a social media strategy."

  Sam and Jane worked hard during the following year. One of the decisions they made was to contract with an outside vendor to manage online sales. At the end of the year, Carol shared some exciting news. "Sam and Jane, you have done

  such a great job that one of the biggest names in the glass business wants to buy us out! And Jane, they want to talk to you about merging all of our customer and vendor information with theirs beforehand."

  When initially collecting personal information from customers, what should Jane be guided by?

  A. Onward transfer rules.
  B. Digital rights management.
  C. Data minimization principles.
  D. Vendor management principles
  C. Data minimization principles.

  ---

  Explanation/Reference:

  When initially collecting personal information from customers, Jane should be guided by data minimization principles ? Data minimization involves collecting only the minimum amount of personal data necessary to achieve a specific purpose. This means that Jane should only collect personal information from customers that is relevant and necessary for the intended purpose and should avoid collecting excessive or unnecessary data.

• Question 184:

  A company seeking to hire engineers in Silicon Valley ran an ad campaign targeting women in a specific age range who live in the San Francisco Bay Area. Which Calo objective privacy harm is likely to result from this campaign?

  A. Lost opportunity.
  B. Economic loss.
  C. Loss of liberty.
  D. Social detriment.
  A. Lost opportunity.

• Question 185:

  Which is NOT a way to validate a person's identity?

  A. Swiping a smartcard into an electronic reader.
  B. Using a program that creates random passwords.
  C. Answering a question about "something you know".
  D. Selecting a picture and tracing a unique pattern on it
  B. Using a program that creates random passwords.

• Question 186:

  Truncating the last octet of an IP address because it is NOT needed is an example of which privacy principle?

  A. Use Limitation
  B. Data Minimization
  C. Purpose Limitation
  D. Security Safeguards
  B. Data Minimization

  ---

  Explanation/Reference:

  truncating the last octet of an IP address because it is not needed is an example of data minimization. Data minimization is a privacy principle that involves collecting and processing only the minimum amount of personal data necessary for a specific purpose.

• Question 187:

  A credit card with the last few numbers visible is an example of what?

  A. Masking data
  B. Synthetic data
  C. Sighting controls.
  D. Partial encryption
  A. Masking data

  ---

  Explanation/Reference:

  Reference: https://money.stackexchange.com/questions/98951/credit-card-number-masking-good-practices-rules-law-regulations

• Question 188:

  Which of the following is considered a client-side IT risk?

  A. Security policies focus solely on internal corporate obligations.
  B. An organization increases the number of applications on its server.
  C. An employee stores his personal information on his company laptop.
  D. IDs used to avoid the use of personal data map to personal data in another database.
  C. An employee stores his personal information on his company laptop.

  ---

  Explanation/Reference:

  An employee stores his personal information on his company laptop. This is considered a client-side IT risk because it involves the actions of an employee who has control over the use of their individual device. Client-side IT risk refers to the potential threats that arise from devices or applications that are used by end-users or customers3. An employee storing his personal information on his company laptop is an example of client-side IT risk, as it exposes sensitive data to unauthorized access, theft or loss. The other options are examples of server-side IT risk, which involves threats that originate from systems or networks that host applications or services3.

• Question 189:

  An organization is reliant on temporary contractors for performing data analytics and they require access to personal data via software-as-a-service to perform their job. When the temporary contractor completes their work assignment, what woul^.be the most effective way to safeguard privacy and access to personal data when they leave?

  A. Set a system-based expiry that requires management reauthorization for online access for accounts that have been active more than 6 months.
  B. Establish a predetermined automatic account expiration date based on contract timescales.
  C. Require temporary contractors to sign a non-disclosure agreement, security acceptable use policy, and online access authorizations by hiring managers.
  D. Mandate hiring managers to email IT or Security team when the contractor leaves.
  B. Establish a predetermined automatic account expiration date based on contract timescales.

  ---

  Explanation/Reference:

  when an organization is reliant on temporary contractors for performing data analytics and they require access to personal data via software-as-a-service to perform their job, the most effective way to safeguard privacy and access to personal data when they leave would be to establish a predetermined automatic account expiration date based on contract timescales. This ensures that the contractor's access to personal data is automatically revoked when their contract ends.

• Question 190:

  Which Organization for Economic Co-operation and Development (OECD) privacy protection principle encourages an organization to obtain an individual s consent before transferring personal information?

  A. Individual participation.
  B. Purpose specification.
  C. Collection limitation.
  D. Accountability.
  A. Individual participation.

  ---

  Explanation/Reference:

  The individual participation principle encourages an organization to obtain an individual's consent before transferring personal information1. According to this principle, an individual should have the right to obtain from a data controller confirmation of whether or not the data controller has data relating to him; to have communicated to him such data within a reasonable time; to be given reasons if a request made under subparagraphs (a) and (b) is denied by the data controller; and to challenge such denial; and to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended1. The other options are not principles that encourage an organization to obtain an individual's consent before transferring personal information.

  http://www.oecdprivacy.org/