IAPP IAPP Certifications CIPT Questions & Answers

• Question 231:

  Which of the following is a stage in the data life cycle?

  A. Data aggregation

  B. Data classification

  C. Data mapping

  D. Data retention

  Correct Answer: D

• Question 232:

  Which of the following occurs when individuals take a specific observable action to indicate and confirm that they give permission for their information to be processed?

  A. Passive consent

  B. Explicit consent

  C. Privacy statement

  D. Privacy notice

  Correct Answer: B

• Question 233:

  Which of the following is the primary purpose of implementing "defense in depth" as a security concept in an organization?

  A. To manage incidents through multiple nodes of escalation

  B. To create multiple layers of security controls to prevent unauthorized access

  C. To ensure compliance with privacy regulations through strong security measures

  D. To monitor and detect security incidents in real-time to minimize privacy breaches

  Correct Answer: B

• Question 234:

  A company is implementing a new online application and the privacy technologist has advised about potential privacy implications. Who would most likely have final accountability if the recommendations made by the privacy technologist are implemented?

  A. The Technology Owner.

  B. The Privacy Legal Team.

  C. The Risk (Business) Owner.

  D. The Chief Information Security Officer.

  Correct Answer: C

• Question 235:

  A company is looking to adopt new technology which the privacy technologist on the project believes may be unethical from a privacy standpoint. How should the privacy technologist respond?

  A. Stop the project by exercising veto rights.

  B. Implement privacy technical measures to help mitigate the identified privacy risks.

  C. Advise the project team about legal mechanisms it could adopt to manage the ethical considerations.

  D. Perform an audit of privacy controls post implementation to show leadership how unethical the project actually was.

  Correct Answer: B

• Question 236:

  When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?

  A. Caching.

  B. Dark patterns.

  C. Social engineering.

  D. Identity and Access Management.

  Correct Answer: B

• Question 237:

  When consulting on privacy policies, a privacy technologist should FIRST?

  A. Align with industry best practices.

  B. Consider the organization's risk profile.

  C. Engage with the relevant external stakeholders.

  D. Require senior leadership to review and provide input.

  Correct Answer: B

• Question 238:

  In terms of data extraction, which of the following should NOT be considered by a privacy technologist in relation to the ease of an individual to reuse personal data across different IT environments?

  A. The size of the data.

  B. The format of the data.

  C. The medium of the data.

  D. The interoperability of the data.

  Correct Answer: A

• Question 239:

  A data scientist wants to improve her customer satisfaction prediction reports and has some ideas to improve the model. This procedure will involve copying the customer database from production to a test environment. To ensure privacy protection of customer information, the data scientist asked the privacy engineers for guidance. Which of the following Privacy Enhancing Techniques (PETs) would be best suited to support her analysis but reduce privacy risks?

  A. Use sample data.

  B. Use synthetic data.

  C. Use anonymized data.

  D. Use pseudonymized data

  Correct Answer: B

• Question 240:

  One difference between privacy threat modeling and information security threat modeling is?

  A. Privacy threat modeling looks at threats to the individual while security threat modeling looks at threats to the organization.

  B. Security threat modeling is required by regulations such as the HIPAA Privacy Rule, but privacy threat modeling is not.

  C. Privacy threat modeling does not consider technical defects such as software vulnerabilities.

  D. Privacy threat modeling must consider insider threats, but security threat modeling does not.

  Correct Answer: A