IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 261:

  An organization is evaluating a number of Machine Learning (ML) solutions to help automate a customer-facing part of its business From a privacy perspective, the organization should first?

  A. Define their goals for fairness
  B. Document the distribution of bias scores
  C. Document the False Positive Rates (FPR).
  D. Define how data subjects may object to the processing
  D. Define how data subjects may object to the processing

  ---

  Explanation/Reference:

  from a privacy perspective, an organization evaluating a number of Machine Learning (ML) solutions to help automate a customer-facing part of its business should first define how data subjects may object to the processing. This involves establishing clear and transparent mechanisms for individuals to exercise their rights with respect to their personal data.

• Question 262:

  What information is included in an effective privacy notice?

  A. Methods for data collection
  B. Provisions for data subject rights.
  C. Cost breakdown of privacy actions.
  D. Specific opt-in and opt-out statements.
  B. Provisions for data subject rights.

• Question 263:

  All of the following can be indications of a ransomware attack EXCEPT?

  A. The inability to access certain files.
  B. An increased amount of spam email in an individual's inbox.
  C. An increase in activity of the CPU of a computer for no apparent reason.
  D. The detection of suspicious network communications between the ransomware and the attacker's command and control servers.
  B. An increased amount of spam email in an individual's inbox.

• Question 264:

  A privacy engineer reviews a newly developed on-line registration page on a company's website. The purpose of the page is to enable corporate customers to submit a returns / refund request for physical goods. The page displays the

  following data capture fields:

  company name, account reference, company address, contact name, email address, contact phone number, product name, quantity, issue description and company bank account details.

  After her review, the privacy engineer recommends setting certain capture fields as "non- mandatory". Setting which of the following fields as "non-mandatory" would be the best example of the principle of data minimization?

  A. The contact phone number field.
  B. The company address and name.
  C. The contact name and email address.
  D. The company bank account detail field.
  A. The contact phone number field.

• Question 265:

  An organization is considering launching enhancements to improve security and authentication mechanisms in their products. To better identify the user and reduce friction from the authentication process, they plan to track physical attributes of an individual. A privacy technologist assessing privacy implications would be most interested in which of the following?

  A. The purpose of the data tracking.
  B. That the individual is aware tracking is occurring.
  C. The authentication mechanism proposed.
  D. The encryption of individual physical attributes.
  A. The purpose of the data tracking.

  ---

  Explanation/Reference:

  a privacy technologist assessing privacy implications would be most interested in the purpose of the data tracking.

• Question 266:

  The web design team incorporated asterisks (*) next to all the PII (Personally Identifiable Information) fields in a web intake form. An asterisk signifies a mandatory field. Which of the following is an essential step prior to the web intake form go-live date?

  A. Analyze intake forms for similar use-cases available on the web and the competitors.
  B. Test the form using synthetic data to ensure it works to determine privacy functionality.
  C. Check with the web-development team on how to enforce input validation for the mandatory fields.
  D. Speak with the company's intake team on the appropriate number of data elements that the intake team requires to execute the use-case.
  B. Test the form using synthetic data to ensure it works to determine privacy functionality.

• Question 267:

  When should code audits be concluded?

  A. At code check-in time.
  B. At engineering design time.
  C. While code is being sent to production.
  D. Before launch after all code for a feature is complete.
  A. At code check-in time.

• Question 268:

  A clinical research organization is processing highly sensitive personal data, including numerical attributes, from medical trial results. The organization needs to manipulate the data without revealing the contents to data users. This can be achieved by utilizing?

  A. k-anonymity.
  B. Microdata sets.
  C. Polymorphic encryption.
  D. Homomorphic encryption.
  D. Homomorphic encryption.

  ---

  Explanation/Reference:

  Homomorphic encryption. Homomorphic encryption allows computations to be performed on encrypted data without revealing the contents of the data. This can be useful in situations where sensitive personal data needs to be processed without revealing its contents to data users.

• Question 269:

  it Is Important for a privacy technologist to understand dark patterns In order to reduce the risk of which of the following?

  A. Breaches of an individual's data.
  B. Illicit collection of personal data.
  C. Manipulation of a user's choice.
  D. Discrimination from profiling.
  C. Manipulation of a user's choice.

  ---

  Explanation/Reference:

  it is important for a privacy technologist to understand dark patterns in order to reduce the risk of manipulation of a user's choice. Dark patterns are user interface design choices that are intended to manipulate users into taking actions they might not otherwise take.

• Question 270:

  Which of the following is a vulnerability of a sensitive biometrics authentication system?

  A. False positives.
  B. False negatives.
  C. Slow recognition speeds.
  D. Theft of finely individualized personal data.
  B. False negatives.

  ---

  Explanation/Reference: