IAPP IAPP Certifications CIPT Questions & Answers

• Question 11:

  Which Organization for Economic Co-operation and Development (OECD) privacy protection principle encourages an organization to obtain an individual s consent before transferring personal information?

  A. Individual participation.

  B. Purpose specification.

  C. Collection limitation.

  D. Accountability.

  Correct Answer: A

  The individual participation principle encourages an organization to obtain an individual's consent before transferring personal information1. According to this principle, an individual should have the right to obtain from a data controller confirmation of whether or not the data controller has data relating to him; to have communicated to him such data within a reasonable time; to be given reasons if a request made under subparagraphs (a) and (b) is denied by the data controller; and to challenge such denial; and to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended1. The other options are not principles that encourage an organization to obtain an individual's consent before transferring personal information.

  http://www.oecdprivacy.org/

• Question 12:

  An organization needs to be able to manipulate highly sensitive personal information without revealing the contents of the data to the users. The organization should investigate the use of?

  A. Advanced Encryption Standard (AES)

  B. Homomorphic encryption

  C. Quantum encryption

  D. Pseudonymization

  Correct Answer: B

  if an organization needs to be able to manipulate highly sensitive personal information without revealing the contents of the data to the users, they should investigate the use of homomorphic encryption. Homomorphic encryption allows computations to be performed on encrypted data without revealing its contents.

• Question 13:

  Which of the following statements best describes the relationship between privacy and security?

  A. Security systems can be used to enforce compliance with privacy policies.

  B. Privacy and security are independent; organizations must decide which should by emphasized.

  C. Privacy restricts access to personal information; security regulates how information should be used.

  D. Privacy protects data from being viewed during collection and security governs how collected data should be shared.

  Correct Answer: C

• Question 14:

  A key principle of an effective privacy policy is that it should be?

  A. Written in enough detail to cover the majority of likely scenarios.

  B. Made general enough to maximize flexibility in its application.

  C. Presented with external parties as the intended audience.

  D. Designed primarily by the organization's lawyers.

  Correct Answer: C

  A key principle of an effective privacy policy is that it should be presented with external parties as the intended audience1. This means that the privacy policy should be clear, easily understandable, and accessible to anyone who interacts with the organization or its services. The privacy policy should also inform external parties about how their personal data is collected, processed, stored, shared, and protected by the organization2. The other options are not principles of an effective privacy policy, but rather potential pitfalls or limitations.

• Question 15:

  During a transport layer security (TLS) session, what happens immediately after the web browser creates a random PreMasterSecret?

  A. The server decrypts the PremasterSecret.

  B. The web browser opens a TLS connection to the PremasterSecret.

  C. The web browser encrypts the PremasterSecret with the server's public key.

  D. The server and client use the same algorithm to convert the PremasterSecret into an encryption key.

  Correct Answer: C

  Reference: https://books.google.com.pk/books?id=OaXise4B-p8Candpg=PA175andlpg=PA175anddq=iapp+During+a+transport+layer+security+(TLS)+session,+what+happens+immediately+after+the+web+browser+creates+a+random +PreMasterSecretandsource=blandots=zR0RCfnx3candsig=ACfU3U0bTOeOfPfcoq_Y95SZs6imKKilugandhl=enandsa=Xandved=2ahUKEwjkscDHpcbnAhUJuRoKHU5iC9cQ6AEwCnoECAkQAQ#v=onepageandq=iapp%20During%20a%20transport% 20layer%20security%20(TLS)%20session%2C%20what%20happens%20immediately%20after%20the%20web%20browser%20creates%20a%20random%20PreMasterSecretandf=false

• Question 16:

  Which of the following methods does NOT contribute to keeping the data confidential?

  A. Differential privacy.

  B. Homomorphic encryption.

  C. K-anonymity.

  D. Referential integrity.

  Correct Answer: D

  referential integrity does not contribute to keeping the data confidential.

• Question 17:

  What is the potential advantage of homomorphic encryption?

  A. Encrypted information can be analyzed without decrypting it first.

  B. Ciphertext size decreases as the security level increases.

  C. It allows greater security and faster processing times.

  D. It makes data impenetrable to attacks.

  Correct Answer: C

  Reference: https://www.sciencedirect.com/topics/computer-science/homomorphic-encryption

• Question 18:

  Which of the following occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed?

  A. Express consent.

  B. Implied consent.

  C. Informed notice.

  D. Authorized notice.

  Correct Answer: A

  Express consent occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed. https://niccs.cisa.gov/education-training/catalog/international-association-privacy-professionals-iapp/certified-1

• Question 19:

  Which of the following statements is true regarding software notifications and agreements?

  A. Website visitors must view the site's privacy statement before downloading software.

  B. Software agreements are designed to be brief, while notifications provide more details.

  C. It is a good practice to provide users with information about privacy prior to software installation.

  D. "Just in time" software agreement notifications provide users with a final opportunity to modify the agreement.

  Correct Answer: C

• Question 20:

  What can be used to determine the type of data in storage without exposing its contents?

  A. Collection records.

  B. Data mapping.

  C. Server logs.

  D. Metadata.

  Correct Answer: D

  Reference:https://cloud.google.com/storage/docs/gsutil/addlhelp/WorkingWithObjectMetadata