IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 241:

  Which of the following is a privacy consideration for NOT sending large-scale SPAM type emails to a database of email addresses?

  A. Poor user experience.
  B. Emails are unsolicited.
  C. Data breach notification.
  D. Reduction in email deliverability score.
  B. Emails are unsolicited.

  ---

  Explanation/Reference:

  Sending large-scale SPAM type emails involves dispatching bulk communications that recipients have not agreed to receive. This is a critical privacy consideration because unsolicited emails infringe on the privacy of individuals by using their personal information (such as email addresses) without consent. Such practices can violate privacy laws and regulations that require explicit permission for marketing communications, emphasizing the importance of obtaining consent prior to sending emails. This consent is central to respecting user privacy and complying with legal standards.

• Question 242:

  Organizations understand there are aggregation risks associated with the way the process their customer's data. They typically include the details of this aggregation risk in a privacy notice and ask that all customers acknowledge they

  understand these risks and consent to the processing.

  What type of risk response does this notice and consent represent?

  A. Risk transfer.
  B. Risk mitigation.
  C. Risk avoidance.
  D. Risk acceptance.
  D. Risk acceptance.

• Question 243:

  Revocation and reissuing of compromised credentials is impossible for which of the following authentication techniques?

  A. Biometric data.
  B. Picture passwords.
  C. Personal identification number.
  D. Radio frequency identification.
  A. Biometric data.

  ---

  Explanation/Reference:

  https://www.ciodive.com/news/you-cant-revoke-your-fingerprint/449088/ https://www.pentestpartners.com/security-blog/biometric-revocation-not-an-option/

• Question 244:

  One-way hash functions can be used is to?

  A. Verify a password in a secure way.
  B. Recover a credit card number at refund
  C. Encrypt a document for confidentiality.
  D. Secure an end-to-end communication.
  A. Verify a password in a secure way.

• Question 245:

  What occurs during data distortion?

  A. False and inaccurate information about an individual is shared
  B. Data collected about an individual includes prejudicial assumptions
  C. The personal data about an individual is modified to preserve their anonymity
  D. Truthful information that negatively affects how others view an individual is revealed
  C. The personal data about an individual is modified to preserve their anonymity

• Question 246:

  SCENARIO

  Please use the following to answer the next question:

  Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.

  Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.

  After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.

  What is the strongest method for authenticating Chuck's identity prior to allowing access to his violation information through the AMP Payment Resources web portal?

  A. By requiring Chuck use the last 4 digits of his driver's license number in combination with a unique PIN provided within the violation notice.
  B. By requiring Chuck use his credit card number in combination with the last 4 digits of his driver's license.
  C. By requiring Chuck use the rental agreement number in combination with his email address.
  D. By requiring Chuck to call AMP Payment Resources directly and provide his date of birth and home address.
  A. By requiring Chuck use the last 4 digits of his driver's license number in combination with a unique PIN provided within the violation notice.

  ---

  Explanation/Reference:

  The strongest method for authenticating Chuck's identity prior to allowing access to his violation information through the AMP Payment Resources web portal would be option A: By requiring Chuck use the last 4 digits of his driver's license number in combination with a unique PIN provided within the violation notice.

• Question 247:

  Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?

  A. Identification.
  B. Insecurity.
  C. Aggregation.
  D. Exclusion.
  C. Aggregation.

  ---

  Explanation/Reference:

  combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called aggregation. Aggregation can be used to create more detailed profiles of individuals by combining data from multiple sources.

• Question 248:

  SCENARIO

  Please use the following to answer next question:

  EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.

  The app collects the following information:

  1.

  First and last name

  2.

  Date of birth (DOB)

  3.

  Mailing address

  4.

  Email address

  5.

  Car VIN number

  6.

  Car model

  7.

  License plate

  8.

  Insurance card number

  9.

  Photo 10.Vehicle diagnostics 11.Geolocation

  What IT architecture would be most appropriate for this mobile platform?

  A. Peer-to-peer architecture.
  B. Client-server architecture.
  C. Plug-in-based architecture.
  D. Service-oriented architecture.
  D. Service-oriented architecture.

• Question 249:

  When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?

  A. Caching.
  B. Dark patterns.
  C. Social engineering.
  D. Identity and Access Management.
  B. Dark patterns.

• Question 250:

  When consulting on privacy policies, a privacy technologist should FIRST?

  A. Align with industry best practices.
  B. Consider the organization's risk profile.
  C. Engage with the relevant external stakeholders.
  D. Require senior leadership to review and provide input.
  B. Consider the organization's risk profile.