IAPP IAPP Certifications CIPT Questions & Answers

• Question 41:

  What must be used in conjunction with disk encryption?

  A. Increased CPU speed.

  B. A strong password.

  C. A digital signature.

  D. Export controls.

  Correct Answer: C

• Question 42:

  Which of the following would be an example of an "objective" privacy harm to an individual?

  A. Receiving spam following the sale an of email address.

  B. Negative feelings derived from government surveillance.

  C. Social media profile views indicating unexpected interest in a person.

  D. Inaccuracies in personal data.

  Correct Answer: D

  Inaccuracies in personal data would be an example of an "objective" privacy harm to an individual. This is because inaccuracies in personal data can lead to incorrect decisions being made about an individual, which can have negative consequences for the individual.

• Question 43:

  What is a mistake organizations make when establishing privacy settings during the development of applications?

  A. Providing a user with too many choices.

  B. Failing to use "Do Not Track" technology.

  C. Providing a user with too much third-party information.

  D. Failing to get explicit consent from a user on the use of cookies.

  Correct Answer: D

  Failing to get explicit consent from a user on the use of cookies is a mistake organizations make when establishing privacy settings during the development of applications2. Cookies are small files that store information about users' preferences and behavior on websites2 . They can be used for various purposes such as authentication, personalization, analytics, advertising etc.2 However, they can also pose privacy risks as they may collect sensitive or personal information without users' knowledge or consent2. Therefore, organizations should inform users about how they use cookies and obtain their explicit consent before placing cookies on their devices2. This is also required by some laws such as EU's General Data Protection Regulation (GDPR) and ePrivacy Directive2. The other options are not mistakes organizations make when establishing privacy settings during the development of applications.

• Question 44:

  SCENARIO

  Clean-Q is a company that offers house-hold and office cleaning services. The company receives requests from consumers via their website and telephone, to book cleaning services. Based on the type and size of service, Clean-Q then contracts individuals that are registered on its resource database - currently managed in-house by Clean-Q IT Support. Because of Clean-Q's business model, resources are contracted as needed instead of permanently employed. The table below indicates some of the personal information Clean-Q requires as part of its business operations:

  

  Clean-Q has an internal employee base of about 30 people. A recent privacy compliance exercise has been conducted to align employee data management and human resource functions with applicable data protection regulation. Therefore,

  the Clean-Q permanent employee base is not included as part of this scenario.

  With an increase in construction work and housing developments, Clean-Q has had an influx of requests for cleaning services. The demand has overwhelmed Clean-Q's traditional supply and demand system that has caused some

  overlapping bookings.

  Ina business strategy session held by senior management recently, Clear-Q invited vendors to present potential solutions to their current operational issues. These vendors included Application developers and Cloud-Q's solution providers,

  presenting their proposed solutions and platforms.

  The Managing Director opted to initiate the process to integrate Clean-Q's operations with a cloud solution (LeadOps) that will provide the following solution one single online platform: A web interface that Clean-Q accesses for the purposes

  of resource and customer management. This would entail uploading resource and customer information.

  A customer facing web interface that enables customers to register, manage and submit cleaning service requests online.

  A resource facing web interface that enables resources to apply and manage their assigned jobs.

  An online payment facility for customers to pay for services.

  Considering that LeadOps will host/process personal information on behalf of Clean-Q remotely, what is an appropriate next step for Clean-Q senior management to assess LeadOps' appropriateness?

  A. Nothing at this stage as the Managing Director has made a decision.

  B. Determine if any Clean-Q competitors currently use LeadOps as a solution.

  C. Obtain a legal opinion from an external law firm on contracts management.

  D. Involve the Information Security team to understand in more detail the types of services and solutions LeadOps is proposing.

  Correct Answer: D

  Since LeadOps will host/process personal information on behalf of Clean-Q remotely, it is important for Clean-Q's Information Security team to assess the security measures and controls that LeadOps has in place to protect this information. This will help Clean-Q senior management make an informed decision about whether or not to engage LeadOps' services.

• Question 45:

  What was the first privacy framework to be developed?

  A. OECD Privacy Principles.

  B. Generally Accepted Privacy Principles.

  C. Code of Fair Information Practice Principles (FIPPs).

  D. The Asia-Pacific Economic Cooperation (APEC) Privacy Framework.

  Correct Answer: C

  The first privacy framework to be developed was the Code of Fair Information Practice Principles (FIPPs)3. The FIPPs were proposed by a US government advisory committee in 1973 as a set of guidelines for protecting personal data in automated systems3. The FIPPs influenced many subsequent privacy frameworks and laws around the world, such as the OECD Privacy Principles (1980), the EU Data Protection Directive (1995), and the APEC Privacy Framework (2004)3.

• Question 46:

  When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?

  A. Encryption.

  B. Social distancing.

  C. Social engineering.

  D. Identity and Access Management.

  Correct Answer: C

  Social engineering is a privacy threat that the privacy technologist should consider when designing a new system.

• Question 47:

  What is an example of a just-in-time notice?

  A. A warning that a website may be unsafe.

  B. A full organizational privacy notice publicly available on a website

  C. A credit card company calling a user to verify a purchase before itis authorized

  D. Privacy information given to a user when he attempts to comment on an online article.

  Correct Answer: D

  Reference: https://www.clarip.com/data-privacy/just-time-notices/

• Question 48:

  Which of these actions is NOT generally part of the responsibility of an IT or software engineer?

  A. Providing feedback on privacy policies.

  B. Implementing multi-factor authentication.

  C. Certifying compliance with security and privacy law.

  D. Building privacy controls into the organization's IT systems or software.

  Correct Answer: A

• Question 49:

  SCENARIO

  It should be the most secure location housing data in all of Europe, if not the world. The Global Finance Data Collective (GFDC) stores financial information and other types of client data from large banks, insurance companies, multinational corporations and governmental agencies. After a long climb on a mountain road that leads only to the facility, you arrive at the security booth. Your credentials are checked and checked again by the guard to visually verify that you are the person pictured on your passport and national identification card. You are led down a long corridor with server rooms on each side, secured by combination locks built into the doors. You climb a flight of stairs and are led into an office that is lighted brilliantly by skylights where the GFDC Director of Security, Dr. Monique Batch, greets you. On the far wall you notice a bank of video screens showing different rooms in the facility. At the far end, several screens show different sections of the road up the mountain

  Dr. Batch explains once again your mission. As a data security auditor and consultant, it is a dream assignment: The GFDC does not want simply adequate controls, but the best and most effective security that current technologies allow.

  "We were hacked twice last year," Dr. Batch says, "and although only a small number of records were stolen, the bad press impacted our business. Our clients count on us to provide security that is nothing short of impenetrable and to do so quietly. We hope to never make the news again." She notes that it is also essential that the facility is in compliance with all relevant security regulations and standards.

  You have been asked to verify compliance as well as to evaluate all current security controls and security measures, including data encryption methods, authentication controls and the safest methods for transferring data into and out of the facility. As you prepare to begin your analysis, you find yourself considering an intriguing question: Can these people be sure that I am who I say I am?

  You are shown to the office made available to you and are provided with system login information, including the name of the wireless network and a wireless key. Still pondering, you attempt to pull up the facility's wireless network, but no networks appear in the wireless list. When you search for the wireless network by name, however it is readily found.

  Why would you recommend that GFC use record encryption rather than disk, file or table encryption?

  A. Record encryption is asymmetric, a stronger control measure.

  B. Record encryption is granular, limiting the damage of potential breaches.

  C. Record encryption involves tag masking, so its metadata cannot be decrypted

  D. Record encryption allows for encryption of personal data only.

  Correct Answer: B

  Record encryption is granular, limiting the damage of potential breaches. Record encryption encrypts data at the record level, providing a more granular level of protection than disk, file or table encryption. This means that even if a breach were to occur, only the specific records that were accessed would be compromised.

• Question 50:

  A BaaS provider backs up the corporate data and stores it in an outsider provider under contract with the organization. A researcher notifies the organization that he found unsecured data in the cloud. The organization looked into the issue and realized $ne of its backups was misconfigured on the outside provider's cloud and the data fully exposed to the open internet. They quickly secured the backup. Which is the best next step the organization should take?

  A. Review the content of the data exposed.

  B. Review its contract with the outside provider.

  C. Investigate how the researcher discovered the unsecured data.

  D. Investigate using alternate BaaS providers or on-premise backup systems.

  Correct Answer: B

  The best next step the organization should take is to review its contract with the outside provider. This will help the organization to identify the responsibilities of the outside provider and the organization in the event of a data breach.