IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 221:

  Users of a web-based email service have their accounts breached through compromised login credentials. Which possible consequences of the breach illustrate the two categories of Calo's Harm Dimensions?

  A. Financial loss and blackmail.
  B. Financial loss and solicitation.
  C. Identity theft and embarrassment.
  D. Identity theft and the leaking of information.
  C. Identity theft and embarrassment.

  ---

  Explanation/Reference:

  Extracts from The boundaries of privacy harms: "Objective harms can also occur when such information is used to commit a crime, such as identity theft or murder."; "The subjective category of privacy harm is the perception of unwanted observation. This category describes unwelcome mental states--anxiety, for instance, or embarrassment--that accompany the belief that one is or will be watched or monitored. "

• Question 222:

  In terms of data extraction, which of the following should NOT be considered by a privacy technologist in relation to the ease of an individual to reuse personal data across different IT environments?

  A. The size of the data.
  B. The format of the data.
  C. The medium of the data.
  D. The interoperability of the data.
  A. The size of the data.

• Question 223:

  Implementation of privacy controls for compliance with the requirements of the Children's Online Privacy Protection Act (COPPA) is necessary for all the following situations EXCEPT?

  A. A virtual jigsaw puzzle game marketed for ages 5-9 displays pieces of the puzzle on a handheld screen. Once the child completes a certain level, it flashes a message about new themes released that day.
  B. An interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.
  C. A math tutoring service commissioned an advertisement on a bulletin board inside a charter school. The service makes it simple to reach out to tutors through a QR-code shaped like a cartoon character.
  D. A note-taking application converts hard copies of kids' class notes into audio books in seconds. It does so by using the processing power of idle server farms.
  B. An interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.

• Question 224:

  Which of the following is one of the fundamental principles of information security?

  A. Accountability.
  B. Accessibility.
  C. Confidentiality.
  D. Connectivity.
  C. Confidentiality.

• Question 225:

  Which of the following would be the best method of ensuring that Information Technology projects follow Privacy by Design (PbD) principles?

  A. Develop a technical privacy framework that integrates with the development lifecycle.
  B. Utilize Privacy Enhancing Technologies (PETs) as a part of product risk assessment and management.
  C. Identify the privacy requirements as a part of the Privacy Impact Assessment (PIA) process during development and evaluation stages.
  D. Develop training programs that aid the developers in understanding how to turn privacy requirements into actionable code and design level specifications.
  A. Develop a technical privacy framework that integrates with the development lifecycle.

  ---

  Explanation/Reference:

  This option is the best method to ensure that Information Technology projects follow Privacy by Design (PbD) principles. By developing a technical privacy framework that is integrated with the development lifecycle, privacy considerations are embedded at every stage of the project, from initial design to deployment and beyond. This approach ensures that privacy is not an afterthought but a foundational component of the development process, aligning directly with the core concept of Privacy by Design, which advocates for privacy to be included throughout the entire engineering process.

• Question 226:

  After stringent testing an organization has launched a new web-facing ordering system for its consumer medical products. As the medical products could provide indicators of health conditions, the organization could further strengthen its privacy controls by deploying?

  A. Run time behavior monitoring.
  B. A content delivery network.
  C. Context aware computing.
  D. Differential identifiability.
  D. Differential identifiability.

  ---

  Explanation/Reference:

  Differential identifiability is a strong method to enhance privacy controls, especially for sensitive data such as medical products that could indicate health conditions. This approach involves modifying data in a way that maintains its utility while making it difficult to identify specific individuals from the dataset. Differential identifiability provides a statistical assurance that an individual's data does not affect the overall outcome of data analysis significantly, thus protecting individual privacy while allowing for the data's use in research or other applications. Implementing this method would strengthen the privacy controls of the organization's web-facing ordering system by ensuring that the sensitive information it processes is protected against identification risks.

• Question 227:

  What can be used to determine the type of data in storage without exposing its contents?

  A. Collection records.
  B. Data mapping.
  C. Server logs.
  D. Metadata.
  D. Metadata.

  ---

  Explanation/Reference:

  Reference:https://cloud.google.com/storage/docs/gsutil/addlhelp/WorkingWithObjectMetadata

• Question 228:

  What has been found to undermine the public key infrastructure system?

  A. Man-in-the-middle attacks.
  B. Inability to track abandoned keys.
  C. Disreputable certificate authorities.
  D. Browsers missing a copy of the certificate authority's public key.
  C. Disreputable certificate authorities.

• Question 229:

  Which of the following became a foundation for privacy principles and practices of countries and organizations across the globe?

  A. The Personal Data Ordinance.
  B. The EU Data Protection Directive.
  C. The Code of Fair Information Practices.
  D. The Organization for Economic Co-operation and Development (OECD) Privacy Principles.
  D. The Organization for Economic Co-operation and Development (OECD) Privacy Principles.

  ---

  Explanation/Reference:

  Reference: https://privacyrights.org/resources/review-fair-information-principles-foundation- privacy-public-policy

  The Organization for Economic Co-operation and Development (OECD) Privacy Principles became a foundation for privacy principles and practices of countries and organizations across the globe4. The OECD Privacy Principles were adopted by OECD member countries in 1980 as a set of eight basic principles for ensuring adequate protection of personal data across national borders4. The OECD Privacy Principles have been widely recognized as an international standard for data protection and have influenced many regional and national laws and frameworks4.

• Question 230:

  Which of the following is an example of drone "swarming"?

  A. A drone filming a cyclist from above as he rides.
  B. A drone flying over a building site to gather data.
  C. Drones delivering retailers' packages to private homes.
  D. Drones communicating with each other to perform a search and rescue.
  D. Drones communicating with each other to perform a search and rescue.