IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 251:

  A company is implementing a new online application and the privacy technologist has advised about potential privacy implications. Who would most likely have final accountability if the recommendations made by the privacy technologist are implemented?

  A. The Technology Owner.
  B. The Privacy Legal Team.
  C. The Risk (Business) Owner.
  D. The Chief Information Security Officer.
  C. The Risk (Business) Owner.

• Question 252:

  SCENARIO

  Please use the following to answer next question:

  EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.

  The app collects the following information:

  1.

  First and last name

  2.

  Date of birth (DOB)

  3.

  Mailing address

  4.

  Email address

  5.

  Car VIN number

  6.

  Car model

  7.

  License plate

  8.

  Insurance card number

  9.

  Photo 10.Vehicle diagnostics 11.Geolocation

  The app is designed to collect and transmit geolocation data. How can data collection best be limited to the necessary minimum?

  A. Allow user to opt-out geolocation data collection at any time.
  B. Allow access and sharing of geolocation data only after an accident occurs.
  C. Present a clear and explicit explanation about need for the geolocation data.
  D. Obtain consent and capture geolocation data at all times after consent is received.
  B. Allow access and sharing of geolocation data only after an accident occurs.

• Question 253:

  What is the goal of privacy enhancing technologies (PETS) like multiparty computation and differential privacy?

  A. To facilitate audits of third party vendors.
  B. To protect sensitive data while maintaining its utility.
  C. To standardize privacy activities across organizational groups.
  D. To protect the security perimeter and the data items themselves.
  B. To protect sensitive data while maintaining its utility.

  ---

  Explanation/Reference:

  Reference: https://royalsociety.org/-/media/policy/projects/privacy-enhancing- technologies/privacy-report-summary.pdf

• Question 254:

  SCENARIO

  Tom looked forward to starting his new position with a U.S --based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below. Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as-a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.

  Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.

  Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and West Company networks.

  Which statement is correct about addressing New Company stakeholders' expectations for privacy?

  A. New Company should expect consumers to read the company's privacy policy.
  B. New Company should manage stakeholder expectations for privacy even when the stakeholders` data is not held by New Company.
  C. New Company would best meet consumer expectations for privacy by adhering to legal requirements.
  D. New Company's commitment to stakeholders ends when the stakeholders' data leaves New Company.
  C. New Company would best meet consumer expectations for privacy by adhering to legal requirements.

  ---

  Explanation/Reference:

  Adhering to legal requirements for data protection and privacy is an important way for New Company to meet its stakeholders' expectations for privacy. This includes complying with applicable data protection laws and regulations and implementing appropriate measures to protect personal data.

• Question 255:

  Which of the following occurs when individuals take a specific observable action to indicate and confirm that they give permission for their information to be processed?

  A. Passive consent
  B. Explicit consent
  C. Privacy statement
  D. Privacy notice
  B. Explicit consent

• Question 256:

  How can a hacker gain control of a smartphone to perform remote audio and video surveillance?

  A. By performing cross-site scripting.
  B. By installing a roving bug on the phone.
  C. By manipulating geographic information systems.
  D. By accessing a phone's global positioning system satellite signal.
  B. By installing a roving bug on the phone.

• Question 257:

  Which of these is NOT one of four elements of a design pattern?

  A. A problem description
  B. A pattern name
  C. A set of risks
  D. A solution
  C. A set of risks

• Question 258:

  What is the main privacy threat posed by Radio Frequency Identification (RFID)?

  A. An individual with an RFID receiver can track people or consumer products.
  B. An individual can scramble computer transmissions in weapons systems.
  C. An individual can use an RFID receiver to engage in video surveillance.
  D. An individual can tap mobile phone communications.
  A. An individual with an RFID receiver can track people or consumer products.

• Question 259:

  What element is most conducive to fostering a sound privacy by design culture in an organization?

  A. Ensuring all employees acknowledge and understood the privacy policy.
  B. Frequent privacy and security awareness training for employees.
  C. Monthly reviews of organizational privacy principles.
  D. Gaining advocacy from senior management.
  D. Gaining advocacy from senior management.

  ---

  Explanation/Reference:

  gaining advocacy from senior management is the element most conducive to fostering a sound privacy by design culture in an organization. Senior management plays a crucial role in setting the tone and direction for privacy practices within an organization and their support is essential for establishing a strong privacy culture.

• Question 260:

  There are two groups of users. In a company, where one group Is allowed to see credit card numbers, while the other group Is not. Both are accessing the data through the same application. The most effective and efficient way to achieve this would be?

  A. Have two copies of the data, one copy where the credit card numbers are obfuscated, while the other copy has them in the clear. Serve up from the appropriate copy depending on the user accessing it.
  B. Have the data encrypted at rest, and selectively decrypt It for the users who have the rights to see it.
  C. Obfuscate the credit card numbers whenever a user who does not have the right to see them accesses the data.
  D. Drop credit card numbers altogether whenever a user who does not have the right to see them accesses the data.
  B. Have the data encrypted at rest, and selectively decrypt It for the users who have the rights to see it.

  ---

  Explanation/Reference:

  the most effective and efficient way to achieve this would be to have the data encrypted at rest, and selectively decrypt it for the users who have the rights to see it.