IAPP IAPP Certifications CIPT Questions & Answers

• Question 221:

  Which of these is NOT one of four elements of a design pattern?

  A. A problem description

  B. A pattern name

  C. A set of risks

  D. A solution

  Correct Answer: C

• Question 222:

  Which of the following is an example of an appropriation harm?

  A. A friend takes and uploads your pictures to a social media website.

  B. A hacker gains access to your email account and reads your messages.

  C. A government agency uses cameras to monitor your movements in a public area.

  D. An unauthorized individual obtains access to your personal information and uses it for medical fraud.

  Correct Answer: A

• Question 223:

  Which of the following is NOT a factor to consider in FAIR analysis?

  A. The severity of the harm that might be caused by the privacy risk

  B. The capability of a threat actor to exploit the analyzed privacy risk

  C. The stage of the data life cycle in which the analyzed privacy risk occurs

  D. The probability that a threat actor's attempts to exploit a privacy risk might succeed

  Correct Answer: C

• Question 224:

  What is the key idea behind the "flow" component of Nissenbaum's contextual integrity model?

  A. The flow of Information from one actor to another

  B. The integrity of information during each stage of the data lifecycle

  C. The maintenance of accuracy when personal information is transmitted

  D. The movement of personal information within a particular context or domain

  Correct Answer: D

• Question 225:

  Which of the following is the most important action to take prior to collecting personal data directly from a customer?

  A. Define what data needs to be collected.

  B. Define the purpose for collecting and using the data.

  C. Identify business requirements for the data that will be collected.

  D. Provide individuals with information about how their data will be used after collection.

  Correct Answer: B

• Question 226:

  Which Privacy by Design principle requires architects and operators to emphasize the interests of the individual by offering measures such as strong privacy defaults, appropriate notice, and user-friendly options?

  A. Data lifecycle protection.

  B. Embedded into design.

  C. Respect for user privacy.

  D. Proactive not reactive.

  Correct Answer: C

• Question 227:

  Which of the following is the best control to apply to personally identifiable data when the retention period ends?

  A. De-identification.

  B. Anonymization.

  C. Archiving.

  D. Deletion.

  Correct Answer: D

• Question 228:

  What information is included in an effective privacy notice?

  A. Methods for data collection

  B. Provisions for data subject rights.

  C. Cost breakdown of privacy actions.

  D. Specific opt-in and opt-out statements.

  Correct Answer: B

• Question 229:

  Which of the following best describes the role of privacy frameworks in the context of laws and guidance?

  A. They offer a set of guidelines for collecting and processing personal data.

  B. They offer a technical solution for encrypting and securing personal data.

  C. They provide a legal standard for determining whether a privacy violation has occurred.

  D. They provide a common language and structure for discussing and managing privacy risks.

  Correct Answer: D

• Question 230:

  An organization would like to quantify potential losses from its privacy and security risks. This would best be achieved by utilizing?

  A. Calo's Harms Dimensions.

  B. Factor Analysis in Information Risk (FAIR).

  C. Fair Information Practice Principles (FIPPs).

  D. Organization for Economic Cooperation and Development (OECD) Principles.

  Correct Answer: B