IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 51:

  Ivan is a nurse for a home healthcare service provider in the US. The company has implemented a mobile application which Ivan uses to record a patient's vital statistics and access a patient's health care records during home visits. During one visitj^van is unable to access the health care application to record the patient's vitals. He instead records the information on his mobile phone's note-taking application to enter the data in the health care application the next time it is accessible. What would be the best course of action by the IT department to ensure the data is protected on his device?

  A. Provide all healthcare employees with mandatory annual security awareness training with a focus on the health information protection.
  B. Complete a SWOT analysis exercise on the mobile application to identify what caused the application to be inaccessible and remediate any issues.
  C. Adopt mobile platform standards to ensure that only mobile devices that support encryption capabilities are used.
  D. Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.
  D. Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.

  ---

  Explanation/Reference:

  the best course of action by the IT department to ensure the data is protected on Ivan's device is to implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.

• Question 52:

  Which of the following is a stage in the data life cycle?

  A. Data classification.
  B. Data inventory.
  C. Data masking.
  D. Data retention.
  D. Data retention.

  ---

  Explanation/Reference:

  The stages in a typical data lifecycle include creation/collection, processing, storage/retention, usage/access/sharing/distribution, archival/preservation and destruction/deletion/disposition 3. Among these options provided here only "Data retention" is a stage in this cycle.

• Question 53:

  A key principle of an effective privacy policy is that it should be?

  A. Written in enough detail to cover the majority of likely scenarios.
  B. Made general enough to maximize flexibility in its application.
  C. Presented with external parties as the intended audience.
  D. Designed primarily by the organization's lawyers.
  A. Written in enough detail to cover the majority of likely scenarios.

• Question 54:

  Which of the following is the primary privacy consideration with regard to the use of large-scale, unsolicited commercial emails?

  A. The source of the emails may be disguised on purpose.
  B. The email addresses may be gathered without consent.
  C. The recipients may receive fraudulent or deceptive emails.
  D. The recipients' email addresses may contain inaccuracies.
  B. The email addresses may be gathered without consent.

• Question 55:

  An organization is deciding between building a solution in-house versus purchasing a solution for a new customer facing application. When security threats are taken into consideration, a key advantage of purchasing a solution would be the availability of?

  A. Data Management and analytics.
  B. Digital Rights Management.
  C. Outsourcing of resources.
  D. Patching and updates.
  D. Patching and updates.

• Question 56:

  What is a mistake organizations make when establishing privacy settings during the development of applications?

  A. Providing a user with too many choices.
  B. Failing to use "Do Not Track" technology.
  C. Providing a user with too much third-party information.
  D. Failing to get explicit consent from a user on the use of cookies.
  D. Failing to get explicit consent from a user on the use of cookies.

  ---

  Explanation/Reference:

  Failing to get explicit consent from a user on the use of cookies is a mistake organizations make when establishing privacy settings during the development of applications2. Cookies are small files that store information about users' preferences and behavior on websites2 . They can be used for various purposes such as authentication, personalization, analytics, advertising etc.2 However, they can also pose privacy risks as they may collect sensitive or personal information without users' knowledge or consent2. Therefore, organizations should inform users about how they use cookies and obtain their explicit consent before placing cookies on their devices2. This is also required by some laws such as EU's General Data Protection Regulation (GDPR) and ePrivacy Directive2. The other options are not mistakes organizations make when establishing privacy settings during the development of applications.

• Question 57:

  SCENARIO

  Please use the following to answer next question:

  EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.

  The app collects the following information:

  1.

  First and last name

  2.

  Date of birth (DOB)

  3.

  Mailing address

  4.

  Email address

  5.

  Car VIN number

  6.

  Car model

  7.

  License plate

  8.

  Insurance card number

  9.

  Photo 10.Vehicle diagnostics 11.Geolocation

  What would be the best way to supervise the third-party systems the EnsureClaim App will share data with?

  A. Review the privacy notices for each third-party that the app will share personal data with to determine adequate privacy and data protection controls are in place.
  B. Conduct a security and privacy review before onboarding new vendors that collect personal data from the app.
  C. Anonymize all personal data collected by the app before sharing any data with third- parties.
  D. Develop policies and procedures that outline how data is shared with third-party apps.
  C. Anonymize all personal data collected by the app before sharing any data with third- parties.

  ---

  Explanation/Reference:

  Conducting a security and privacy review before onboarding new vendors can help EnsureClaim assess whether these vendors have appropriate measures in place to protect personal data. This can include reviewing their privacy policies and practices as well as their technical security controls.

• Question 58:

  Failing to update software for a system that processes human resources data with the latest security patches may create what?

  A. Data breaches.
  B. Discrimination risks.
  C. Privacy vulnerabilities
  D. Increased threat sources
  A. Data breaches.

  ---

  Explanation/Reference:

• Question 59:

  Which of the following is NOT a step in the methodology of a privacy risk framework?

  A. Assessment.
  B. Monitoring.
  C. Response.
  D. Ranking.
  D. Ranking.

• Question 60:

  Which Privacy by Design principle requires architects and operators to emphasize the interests of the individual by offering measures such as strong privacy defaults, appropriate notice, and user-friendly options?

  A. Data lifecycle protection.
  B. Embedded into design.
  C. Respect for user privacy.
  D. Proactive not reactive.
  C. Respect for user privacy.