IAPP IAPP Certifications CIPT Questions & Answers

• Question 31:

  How can a hacker gain control of a smartphone to perform remote audio and video surveillance?

  A. By performing cross-site scripting.

  B. By installing a roving bug on the phone.

  C. By manipulating geographic information systems.

  D. By accessing a phone's global positioning system satellite signal.

  Correct Answer: B

• Question 32:

  Which of the following is NOT a step in the methodology of a privacy risk framework?

  A. Assessment.

  B. Monitoring.

  C. Response.

  D. Ranking.

  Correct Answer: B

  The steps in the methodology of a privacy risk framework are Assessment, Response, and Ranking. Monitoring is not a step in the methodology of a privacy risk framework.

• Question 33:

  In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?

  A. Isolation.

  B. Obfuscation.

  C. Perturbation.

  D. Stripping.

  Correct Answer: B

• Question 34:

  Which activity would best support the principle of data quality?

  A. Providing notice to the data subject regarding any change in the purpose for collecting such data.

  B. Ensuring that the number of teams processing personal information is limited.

  C. Delivering information in a format that the data subject understands.

  D. Ensuring that information remains accurate.

  Correct Answer: D

  Reference: https://iapp.org/resources/article/fair-information-practices/ The principle of data quality states that personal data should be relevant to the purposes for which they are to be used and, to the extent necessary for those purposes, should be accurate, complete, and up to date1. Therefore, ensuring that information remains accurate is an activity that would best support this principle1. The other options are not directly related to the principle of data quality, but rather to other principles such as purpose specification, security safeguards, or openness.

• Question 35:

  In terms of data extraction, which of the following should NOT be considered by a privacy technologist in relation to data portability?

  A. The size of the data.

  B. The format of the data.

  C. The range of the data.

  D. The medium of the data.

  Correct Answer: D

  The medium of the data. Data portability refers to an individual's right to receive their personal data in a structured and commonly used format so that they can transfer it to another service provider. The size (A), format (B), and range ?of the data are all relevant considerations when extracting data for portability purposes. However, the medium of the data is not relevant in this context.

• Question 36:

  A user who owns a resource wants to give other individuals access to the resource. What control would apply?

  A. Mandatory access control.

  B. Role-based access controls.

  C. Discretionary access control.

  D. Context of authority controls.

  Correct Answer: B

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/role-based-access-control/overview

• Question 37:

  A computer user navigates to a page on the Internet. The privacy notice pops up and the user clicks the box to accept cookies, then continues to scroll the page to read the Information displayed. This is an example of which type of consent?

  A. Explicit.

  B. Implicit.

  C. Specific

  D. Valid.

  Correct Answer: C

  if a computer user navigates to a page on the Internet and clicks the box to accept cookies when presented with a privacy notice before continuing to scroll the page and read the information displayed, this is an example of specific consent. Specific consent involves obtaining clear and unambiguous agreement from individuals for the processing of their personal data for specific purposes.

• Question 38:

  Which of the following would be the best method of ensuring that Information Technology projects follow Privacy by Design (PbD) principles?

  A. Develop a technical privacy framework that integrates with the development lifecycle.

  B. Utilize Privacy Enhancing Technologies (PETs) as a part of product risk assessment and management.

  C. Identify the privacy requirements as a part of the Privacy Impact Assessment (PIA) process during development and evaluation stages.

  D. Develop training programs that aid the developers in understanding how to turn privacy requirements into actionable code and design level specifications.

  Correct Answer: D

• Question 39:

  How does browser fingerprinting compromise privacy?

  A. By creating a security vulnerability.

  B. By differentiating users based upon parameters.

  C. By persuading users to provide personal information.

  D. By customizing advertising based on the geographic location.

  Correct Answer: B

  browser fingerprinting compromises privacy by differentiating users based upon parameters. Browser fingerprinting involves collecting information about a user's device and browser configuration in order to uniquely identify them. This can allow for tracking of user behavior across websites without their knowledge or consent.

• Question 40:

  What is a main benefit of data aggregation?

  A. It is a good way to perform analysis without needing a statistician.

  B. It applies two or more layers of protection to a single data record.

  C. It allows one to draw valid conclusions from small data samples.

  D. It is a good way to achieve de-identification and unlinkabilty.

  Correct Answer: C