IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 31:

  What is a main benefit of data aggregation?

  A. It is a good way to perform analysis without needing a statistician.
  B. It applies two or more layers of protection to a single data record.
  C. It allows one to draw valid conclusions from small data samples.
  D. It is a good way to achieve de-identification and unlinkabilty.
  D. It is a good way to achieve de-identification and unlinkabilty.

• Question 32:

  Information classification helps an organization protect confidential and nonpublic information primarily because?

  A. It helps identify sensitive and critical information that require very strict safeguards.
  B. It falls under the security principles of confidentiality, integrity, and availability.
  C. It promotes employee accountability for safeguarding confidential information.
  D. It is legally required under most regulations.
  A. It helps identify sensitive and critical information that require very strict safeguards.

  ---

  Explanation/Reference:

  Information classification helps an organization protect confidential and nonpublic information primarily because it helps identify sensitive and critical information that require very strict safeguards.

• Question 33:

  A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account. What would be the best recommendation to minimize the potential privacy risk from this weakness?

  A. Implement a CAPTCHA system.
  B. Develop server-side input validation checks.
  C. Enforce strong password and account credentials.
  D. Implement strong Transport Layer Security (TLS) to ensure an encrypted link.
  A. Implement a CAPTCHA system.

• Question 34:

  When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?

  A. Encryption.
  B. Social distancing.
  C. Social engineering.
  D. Identity and Access Management.
  C. Social engineering.

  ---

  Explanation/Reference:

  Social engineering is a privacy threat that the privacy technologist should consider when designing a new system.

• Question 35:

  Which activity would best support the principle of data quality?

  A. Providing notice to the data subject regarding any change in the purpose for collecting such data.
  B. Ensuring that the number of teams processing personal information is limited.
  C. Delivering information in a format that the data subject understands.
  D. Ensuring that information remains accurate.
  D. Ensuring that information remains accurate.

  ---

  Explanation/Reference:

  Reference: https://iapp.org/resources/article/fair-information-practices/ The principle of data quality states that personal data should be relevant to the purposes for which they are to be used and, to the extent necessary for those purposes, should be accurate, complete, and up to date1. Therefore, ensuring that information remains accurate is an activity that would best support this principle1. The other options are not directly related to the principle of data quality, but rather to other principles such as purpose specification, security safeguards, or openness.

• Question 36:

  SCENARIO

  Clean-Q is a company that offers house-hold and office cleaning services. The company receives requests from consumers via their website and telephone, to book cleaning services. Based on the type and size of service, Clean-Q then contracts individuals that are registered on its resource database - currently managed in-house by Clean-Q IT Support. Because of Clean-Q's business model, resources are contracted as needed instead of permanently employed.

  The table below indicates some of the personal information Clean-Q requires as part of its business operations:

  

  Clean-Q has an internal employee base of about 30 people. A recent privacy compliance exercise has been conducted to align employee data management and human resource functions with applicable data protection regulation. Therefore,

  the Clean-Q permanent employee base is not included as part of this scenario.

  With an increase in construction work and housing developments, Clean-Q has had an influx of requests for cleaning services. The demand has overwhelmed Clean-Q's traditional supply and demand system that has caused some

  overlapping bookings.

  Ina business strategy session held by senior management recently, Clear-Q invited vendors to present potential solutions to their current operational issues. These vendors included Application developers and Cloud-Q's solution providers,

  presenting their proposed solutions and platforms.

  The Managing Director opted to initiate the process to integrate Clean-Q's operations with a cloud solution (LeadOps) that will provide the following solution one single online platform: A web interface that Clean-Q accesses for the purposes

  of resource and customer management. This would entail uploading resource and customer information.

  A customer facing web interface that enables customers to register, manage and submit cleaning service requests online.

  A resource facing web interface that enables resources to apply and manage their assigned jobs.

  An online payment facility for customers to pay for services.

  Considering that LeadOps will host/process personal information on behalf of Clean-Q remotely, what is an appropriate next step for Clean-Q senior management to assess LeadOps' appropriateness?

  A. Nothing at this stage as the Managing Director has made a decision.
  B. Determine if any Clean-Q competitors currently use LeadOps as a solution.
  C. Obtain a legal opinion from an external law firm on contracts management.
  D. Involve the Information Security team to understand in more detail the types of services and solutions LeadOps is proposing.
  D. Involve the Information Security team to understand in more detail the types of services and solutions LeadOps is proposing.

  ---

  Explanation/Reference:

  Since LeadOps will host/process personal information on behalf of Clean-Q remotely, it is important for Clean-Q's Information Security team to assess the security measures and controls that LeadOps has in place to protect this information. This will help Clean-Q senior management make an informed decision about whether or not to engage LeadOps' services.

• Question 37:

  of the following best describes a network threat model and Its uses?

  A. It Is used in software development to detect programming errors. .
  B. It is a risk-based model used to calculate the probabilities of risks identified during vulnerability tests.
  C. It helps assess the probability, the potential harm, and the priority of attacks to help minimize or eradicate the threats.
  D. It combines the results of vulnerability and penetration tests to provide useful insights into the network's overall threat and security posture.
  C. It helps assess the probability, the potential harm, and the priority of attacks to help minimize or eradicate the threats.

  ---

  Explanation/Reference:

  a network threat model helps assess the probability, the potential harm, and the priority of attacks to help minimize or eradicate the threats.

• Question 38:

  What is the most effective first step to take to operationalize Privacy by Design principles in new product development and projects?

  A. Implementing a mandatory privacy review and legal approval process.
  B. Obtain leadership buy-in for a mandatory privacy review and approval process.
  C. Set up an online Privacy Impact Assessment tool to facilitate Privacy by Design compliance.
  D. Conduct annual Privacy by Design training and refreshers for all impacted personnel.
  B. Obtain leadership buy-in for a mandatory privacy review and approval process.

  ---

  Explanation/Reference:

  This is the most effective first step to operationalize Privacy by Design principles in new product development and projects. It is important to obtain leadership buy-in for a mandatory privacy review and approval process to ensure that privacy is a priority throughout the organization.

• Question 39:

  A user who owns a resource wants to give other individuals access to the resource. What control would apply?

  A. Mandatory access control.
  B. Role-based access controls.
  C. Discretionary access control.
  D. Context of authority controls.
  C. Discretionary access control.

  ---

  Explanation/Reference:

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/role-based-access-control/overview

• Question 40:

  SCENARIO

  Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.

  You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.

  Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system?

  A. Asymmetric Encryption
  B. Symmetric Encryption
  C. Obfuscation
  D. Hashing
  B. Symmetric Encryption

  ---

  Explanation/Reference:

  To protect patient credit card information in the records system at Berry Country Regional Medical Center, an appropriate cryptographic standard to use would be option B: Symmetric Encryption. Symmetric encryption uses a single secret key to encrypt and decrypt data. It is a fast and efficient method of encryption that can provide strong protection for sensitive data such as credit card information when implemented correctly.