IAPP IAPP Certifications CIPT Questions & Answers

• Question 51:

  Which is NOT a suitable action to apply to data when the retention period ends?

  A. Aggregation.

  B. De-identification.

  C. Deletion.

  D. Retagging.

  Correct Answer: D

  Retagging is not a suitable action to apply to data when the retention period ends2 . Retagging means changing the classification or label of data based on its sensitivity or value2. Retagging does not reduce the risk of unauthorized access or disclosure of personal data that is no longer needed by the organization2. The other options are suitable actions to apply to data when the retention period ends, as they either remove or anonymize personal data2.

• Question 52:

  Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?

  A. Identification.

  B. Insecurity.

  C. Aggregation.

  D. Exclusion.

  Correct Answer: C

  combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called aggregation. Aggregation can be used to create more detailed profiles of individuals by combining data from multiple sources.

• Question 53:

  Which of the following provides a mechanism that allows an end-user to use a single sign- on (SSO) for multiple services?

  A. The Open ID Federation.

  B. PCI Data Security Standards Council

  C. International Organization for Standardization.

  D. Personal Information Protection and Electronic Documents Act.

  Correct Answer: A

• Question 54:

  Which of the following is NOT a workplace surveillance best practice?

  A. Check local privacy laws before putting surveillance in place.

  B. Ensure surveillance is discreet so employees do not alter their behavior.

  C. Once surveillance data has been gathered, limit exposure of the content.

  D. Ensure the minimal amount of surveillance is performed to meet the objective.

  Correct Answer: B

• Question 55:

  SCENARIO

  Please use the following to answer next question:

  EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.

  The app collects the following information:

  1.

  First and last name

  2.

  Date of birth (DOB)

  3.

  Mailing address

  4.

  Email address

  5.

  Car VIN number

  6.

  Car model

  7.

  License plate

  8.

  Insurance card number

  9.

  Photo 10.Vehicle diagnostics 11.Geolocation

  What would be the best way to supervise the third-party systems the EnsureClaim App will share data with?

  A. Review the privacy notices for each third-party that the app will share personal data with to determine adequate privacy and data protection controls are in place.

  B. Conduct a security and privacy review before onboarding new vendors that collect personal data from the app.

  C. Anonymize all personal data collected by the app before sharing any data with third- parties.

  D. Develop policies and procedures that outline how data is shared with third-party apps.

  Correct Answer: C

  Conducting a security and privacy review before onboarding new vendors can help EnsureClaim assess whether these vendors have appropriate measures in place to protect personal data. This can include reviewing their privacy policies and practices as well as their technical security controls.

• Question 56:

  Which of these is considered an ethical dark pattern on privacy?

  A. Using attractive designs to influence an individual.

  B. Rewarding users for providing more personal information

  C. Giving users more privacy options in relation to their personal information

  D. Providing dear and simple privacy notices to users

  Correct Answer: B

  rewarding users for providing more personal information is considered an unethical dark pattern on privacy. Dark patterns are user interface design choices that are intended to manipulate users into taking actions they might not otherwise take.

• Question 57:

  An organization is launching a new smart speaker to the market. The device will have the capability to play music and provide news and weather updates. Which of the following would be a concern from a privacy perspective?

  A. Appropriation.

  B. Browser Fingerprinting.

  C. Context of authority.

  D. Context aware computing.

  Correct Answer: D

  An organization launching a new smart speaker to the market that has the capability to play music and provide news and weather updates would have concerns about context aware computing rather than browser fingerprinting from a privacy perspective. Context aware computing involves using information about an individual's location or behavior to tailor their experience with technology. This can raise concerns about how personal data is collected and used without individuals' knowledge or consent.

• Question 58:

  An organization is using new technologies that will target and process personal data of EU customers. In which of the following circumstances would a privacy technologist need to support a data protection impact assessment (DPIA)?

  A. If a privacy notice and opt-m consent box are not displayed to the individual

  B. If security of data processing has not been evaluated

  C. If a large amount of personal data will be collected.

  D. If data processing is a high risk to an individual's rights and freedoms

  Correct Answer: D

  a privacy technologist would need to support a data protection impact assessment (DPIA) if data processing is a high risk to an individual's rights and freedoms.

• Question 59:

  A privacy technologist has been asked to aid in a forensic investigation on the darknet following the compromise of a company's personal data. This will primarily involve an understanding of which of the following privacy-preserving techniques?

  A. Encryption

  B. Do Not Track

  C. Masking

  D. Tokenization

  Correct Answer: A

  a privacy technologist aiding in a forensic investigation on the darknet following the compromise of a company's personal data would primarily need an understanding of encryption. Encryption is a privacy-preserving technique that can help protect sensitive data from unauthorized access.

• Question 60:

  SCENARIO

  It should be the most secure location housing data in all of Europe, if not the world. The Global Finance Data Collective (GFDC) stores financial information and other types of client data from large banks, insurance companies, multinational corporations and governmental agencies. After a long climb on a mountain road that leads only to the facility, you arrive at the security booth. Your credentials are checked and checked again by the guard to visually verify that you are the person pictured on your passport and national identification card. You are led down a long corridor with server rooms on each side, secured by combination locks built into the doors. You climb a flight of stairs and are led into an office that is lighted brilliantly by skylights where the GFDC Director of Security, Dr. Monique Batch, greets you. On the far wall you notice a bank of video screens showing different rooms in the facility. At the far end, several screens show different sections of the road up the mountain

  Dr. Batch explains once again your mission. As a data security auditor and consultant, it is a dream assignment: The GFDC does not want simply adequate controls, but the best and most effective security that current technologies allow.

  "We were hacked twice last year," Dr. Batch says, "and although only a small number of records were stolen, the bad press impacted our business. Our clients count on us to provide security that is nothing short of impenetrable and to do so quietly. We hope to never make the news again." She notes that it is also essential that the facility is in compliance with all relevant security regulations and standards.

  You have been asked to verify compliance as well as to evaluate all current security controls and security measures, including data encryption methods, authentication controls and the safest methods for transferring data into and out of the facility. As you prepare to begin your analysis, you find yourself considering an intriguing question: Can these people be sure that I am who I say I am?

  You are shown to the office made available to you and are provided with system login information, including the name of the wireless network and a wireless key. Still pondering, you attempt to pull up the facility's wireless network, but no networks appear in the wireless list. When you search for the wireless network by name, however it is readily found.

  What type of wireless network does GFDC seem to employ?

  A. A hidden network.

  B. A reluctant network.

  C. A user verified network.

  D. A wireless mesh network.

  Correct Answer: A

  A hidden network, also known as a non-broadcast network, does not broadcast its SSID (Service Set Identifier), making it invisible in the list of available networks that devices normally display. To connect to a hidden network, one must know the exact name of the network and manually enter it into their device. This practice can be part of a security strategy to make the network less visible to casual scanners and potential unauthorized users.