IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 41:

  SCENARIO

  Kyle is a new security compliance manager who will be responsible for coordinating and executing controls to ensure compliance with the company's information security policy and industry standards. Kyle is also new to the company, where

  collaboration is a core value. On his first day of new-hire orientation, Kyle's schedule included participating in meetings and observing work in the IT and compliance departments.

  Kyle spent the morning in the IT department, where the CIO welcomed him and explained that her department was responsible for IT governance. The CIO and Kyle engaged in a conversation about the importance of identifying meaningful IT

  governance metrics. Following their conversation, the CIO introduced Kyle to Ted and Barney. Ted is implementing a plan to encrypt data at the transportation level of the organization's wireless network. Kyle would need to get up to speed on

  the project and suggest ways to monitor effectiveness once the implementation was complete. Barney explained that his short-term goals are to establish rules governing where data can be placed and to minimize the use of offline data

  storage.

  Kyle spent the afternoon with Jill, a compliance specialist, and learned that she was exploring an initiative for a compliance program to follow self-regulatory privacy principles. Thanks to a recent internship, Kyle had some experience in this

  area and knew where Jill could find some support. Jill also shared results of the company's privacy risk assessment, noting that the secondary use of personal information was considered a high risk.

  By the end of the day, Kyle was very excited about his new job and his new company. In fact, he learned about an open position for someone with strong qualifications and experience with access privileges, project standards board approval

  processes, and application-level obligations, and couldn't wait to recommend his friend Ben who would be perfect for the job.

  Which of the following should Kyle recommend to Jill as the best source of support for her initiative?

  A. Investors.
  B. Regulators.
  C. Industry groups.
  D. Corporate researchers.
  C. Industry groups.

  ---

  Explanation/Reference:

  Jill is leading an initiative to develop a new industry standard for data privacy and security. Kyle should recommend that Jill seek support from industry groups as they are likely to have a vested interest in the development of such a standard and may be able to provide valuable input and resources.

• Question 42:

  SCENARIO

  Please use the following to answer the next question: Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.

  Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.

  After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.

  What is the most secure method Finley Motors should use to transmit Chuck's information to AMP Payment Resources?

  A. Cloud file transfer services.
  B. Certificate Authority (CA).
  C. HyperText Transfer Protocol (HTTP).
  D. Transport Layer Security (TLS).
  D. Transport Layer Security (TLS).

  ---

  Explanation/Reference:

  TLS is a cryptographic protocol that provides secure communication over a network. It can help protect against eavesdropping and tampering by encrypting data in transit. Cloud file transfer services (option A) can also provide secure transmission of data but their security depends on the specific service used. Certificate Authority (CA) (option B) is not a method for transmitting data but rather a trusted third party that issues digital certificates used for authentication. HyperText Transfer Protocol (HTTP) (option C) is not a secure method for transmitting sensitive data as it does not provide encryption.

• Question 43:

  What is the potential advantage of homomorphic encryption?

  A. Encrypted information can be analyzed without decrypting it first.
  B. Ciphertext size decreases as the security level increases.
  C. It allows greater security and faster processing times.
  D. It makes data impenetrable to attacks.
  A. Encrypted information can be analyzed without decrypting it first.

  ---

  Explanation/Reference:

  Reference: https://www.sciencedirect.com/topics/computer-science/homomorphic-encryption

• Question 44:

  An organization is in the process of designing a new application. It is currently looking at processes related to data that is no longer necessary for the purpose for which it was collected, and requests for deletion of data by individuals. What kind of data-oriented strategy is the organization considering?

  A. Abstract
  B. Hide
  C. Minimize
  D. Separate
  C. Minimize

• Question 45:

  When considering dark patterns, which of the following should the privacy technologist be concerned about?

  A. Illicit collection of personal data
  B. Manipulation of a user's choice.
  C. Discrimination stemming from user profiles.
  D. Unauthorized access to an individual's data.
  B. Manipulation of a user's choice.

• Question 46:

  What risk is mitigated when routing meeting video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?

  A. The user's identity is protected from the other user
  B. The user is protected against cyberstalking attacks
  C. The user's IP address is hidden from the other user
  D. The user is assured that stronger authentication methods have been used
  C. The user's IP address is hidden from the other user

• Question 47:

  Aadhaar is a unique-identity number of 12 digits issued to all Indian residents based on their biometric and demographic data. The data is collected by the Unique Identification Authority of India. The Aadhaar database contains the Aadhaar number, name, date of birth, gender and address of over 1 billion individuals.

  Which of the following datasets derived from that data would be considered the most de- identified?

  A. A count of the years of birth and hash of the person' s gender.
  B. A count of the month of birth and hash of the person's first name.
  C. A count of the day of birth and hash of the person's first initial of their first name.
  D. Account of the century of birth and hash of the last 3 digits of the person's Aadhaar number.
  D. Account of the century of birth and hash of the last 3 digits of the person's Aadhaar number.

  ---

  Explanation/Reference:

  This dataset would be considered the most de-identified because it removes most of the precise individual identifiers. The century of birth provides a very broad time frame, significantly reducing the likelihood of identifying an individual. Similarly, hashing the last three digits of the Aadhaar number instead of using more significant parts of the Aadhaar number or other direct identifiers (like full name or exact date of birth) further minimizes the risk of re-identification.

• Question 48:

  Which of these is considered an ethical dark pattern on privacy?

  A. Using attractive designs to influence an individual.
  B. Rewarding users for providing more personal information
  C. Giving users more privacy options in relation to their personal information
  D. Providing dear and simple privacy notices to users
  B. Rewarding users for providing more personal information

  ---

  Explanation/Reference:

  rewarding users for providing more personal information is considered an unethical dark pattern on privacy. Dark patterns are user interface design choices that are intended to manipulate users into taking actions they might not otherwise take.

• Question 49:

  An organization would like to quantify potential losses from its privacy and security risks. This would best be achieved by utilizing?

  A. Calo's Harms Dimensions.
  B. Factor Analysis in Information Risk (FAIR).
  C. Fair Information Practice Principles (FIPPs).
  D. Organization for Economic Cooperation and Development (OECD) Principles.
  B. Factor Analysis in Information Risk (FAIR).

• Question 50:

  Value Sensitive Design (VSD) focuses on which of the following?

  A. Quality and benefit.
  B. Ethics and morality.
  C. Principles and standards.
  D. Privacy and human rights.
  B. Ethics and morality.