IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 71:

  Which of the following is NOT a workplace surveillance best practice?

  A. Check local privacy laws before putting surveillance in place.
  B. Ensure surveillance is discreet so employees do not alter their behavior.
  C. Once surveillance data has been gathered, limit exposure of the content.
  D. Ensure the minimal amount of surveillance is performed to meet the objective.
  B. Ensure surveillance is discreet so employees do not alter their behavior.

• Question 72:

  Which is NOT a suitable action to apply to data when the retention period ends?

  A. Aggregation.
  B. De-identification.
  C. Deletion.
  D. Retagging.
  D. Retagging.

  ---

  Explanation/Reference:

  Retagging is not a suitable action to apply to data when the retention period ends2 . Retagging means changing the classification or label of data based on its sensitivity or value2. Retagging does not reduce the risk of unauthorized access or disclosure of personal data that is no longer needed by the organization2. The other options are suitable actions to apply to data when the retention period ends, as they either remove or anonymize personal data2.

• Question 73:

  SCENARIO

  Clean-Q is a company that offers house-hold and office cleaning services. The company receives requests from consumers via their website and telephone, to book cleaning services. Based on the type and size of service, Clean-Q then contracts individuals that are registered on its resource database - currently managed in-house by Clean-Q IT Support. Because of Clean-Q's business model, resources are contracted as needed instead of permanently employed. The table below indicates some of the personal information Clean-Q requires as part of its business operations:

  

  Clean-Q has an internal employee base of about 30 people. A recent privacy compliance exercise has been conducted to align employee data management and human resource functions with applicable data protection regulation. Therefore,

  the Clean-Q permanent employee base is not included as part of this scenario.

  With an increase in construction work and housing developments, Clean-Q has had an influx of requests for cleaning services. The demand has overwhelmed Clean-Q's traditional supply and demand system that has caused some

  overlapping bookings.

  Ina business strategy session held by senior management recently, Clear-Q invited vendors to present potential solutions to their current operational issues. These vendors included Application developers and Cloud-Q's solution providers,

  presenting their proposed solutions and platforms.

  The Managing Director opted to initiate the process to integrate Clean-Q's operations with a cloud solution (LeadOps) that will provide the following solution one single online platform: A web interface that Clean-Q accesses for the purposes

  of resource and customer management. This would entail uploading resource and customer information.

  A customer facing web interface that enables customers to register, manage and submit cleaning service requests online.

  A resource facing web interface that enables resources to apply and manage their assigned jobs.

  An online payment facility for customers to pay for services.

  Which question would you most likely ask to gain more insight about LeadOps and provide practical privacy recommendations?

  A. What is LeadOps' annual turnover?
  B. How big is LeadOps' employee base?
  C. Where are LeadOps' operations and hosting services located?
  D. Does LeadOps practice agile development and maintenance of their system?
  C. Where are LeadOps' operations and hosting services located?

  ---

  Explanation/Reference:

  The location of LeadOps' operations and hosting services is important information for Clean-Q to consider when assessing LeadOps' appropriateness as a service provider. This is because different countries have different data protection laws and regulations that may impact how personal information can be processed and stored. Knowing where LeadOps' operations and hosting services are located will help Clean-Q make informed decisions about how to protect the personal information it entrusts to LeadOps.

• Question 74:

  What has been identified as a significant privacy concern with chatbots?

  A. Most chatbot providers do not agree to code audits
  B. Chatbots can easily verify the identity of the contact.
  C. Users' conversations with chatbots are not encrypted in transit.
  D. Chatbot technology providers may be able to read chatbot conversations with users.
  D. Chatbot technology providers may be able to read chatbot conversations with users.

  ---

  Explanation/Reference:

  Reference: https://resources.infosecinstitute.com/privacy-concerns-emotional-chatbots/

• Question 75:

  An organization is launching a new smart speaker to the market. The device will have the capability to play music and provide news and weather updates. Which of the following would be a concern from a privacy perspective?

  A. Appropriation.
  B. Browser Fingerprinting.
  C. Context of authority.
  D. Context aware computing.
  D. Context aware computing.

  ---

  Explanation/Reference:

  An organization launching a new smart speaker to the market that has the capability to play music and provide news and weather updates would have concerns about context aware computing rather than browser fingerprinting from a privacy perspective. Context aware computing involves using information about an individual's location or behavior to tailor their experience with technology. This can raise concerns about how personal data is collected and used without individuals' knowledge or consent.

• Question 76:

  SCENARIO

  Carol was a U.S.-based glassmaker who sold her work at art festivals. She kept things simple by only accepting cash and personal checks. As business grew, Carol couldn't keep up with demand, and traveling to festivals became burdensome. Carol opened a small boutique and hired Sam to run it while she worked in the studio. Sam was a natural salesperson, and business doubled. Carol told Sam, "I don't know what you are doing, but keep doing it!"

  But months later, the gift shop was in chaos. Carol realized that Sam needed help so she hired Jane, who had business expertise and could handle the back-office tasks. Sam would continue to focus on sales. Carol gave Jane a few weeks to get acquainted with the artisan craft business, and then scheduled a meeting for the three of them to discuss Jane's first impressions.

  At the meeting, Carol could not wait to hear Jane's thoughts, but she was unprepared for what Jane had to say. "Carol, I know that he doesn't realize it, but some of Sam's efforts to increase sales have put you in a vulnerable position. You are not protecting customers' personal information like you should."

  Sam said, "I am protecting our information. I keep it in the safe with our bank deposit. It's only a list of customers' names, addresses and phone numbers that I get from their checks before I deposit them. I contact them when you finish a piece that I think they would like. That's the only information I have! The only other thing I do is post photos and information about your work on the photo sharing site that I use with family and friends. I provide my email address and people send me their information if they want to see more of your work. Posting online really helps sales, Carol. In fact, the only complaint I hear is about having to come into the shop to make a purchase."

  Carol replied, "Jane, that doesn't sound so bad. Could you just fix things and help us to post even more online?"

  `I can," said Jane. "But it's not quite that simple. I need to set up a new program to make sure that we follow the best practices in data management. And I am concerned for our customers. They should be able to manage how we use their personal information. We also should develop a social media strategy."

  Sam and Jane worked hard during the following year. One of the decisions they made was to contract with an outside vendor to manage online sales. At the end of the year, Carol shared some exciting news. "Sam and Jane, you have done such a great job that one of the biggest names in the glass business wants to buy us out! And Jane, they want to talk to you about merging all of our customer and vendor information with theirs beforehand."

  What type of principles would be the best guide for Jane's ideas regarding a new data management program?

  A. Collection limitation principles.
  B. Vendor management principles.
  C. Incident preparedness principles.
  D. Fair Information Practice Principles
  D. Fair Information Practice Principles

  ---

  Explanation/Reference:

  Reference: https://www.worldprivacyforum.org/2008/01/report-a-brief-introduction-to-fair- information-practices/

• Question 77:

  Which of the following would best improve an organization' s system of limiting data use?

  A. Implementing digital rights management technology.
  B. Confirming implied consent for any secondary use of data.
  C. Applying audit trails to resources to monitor company personnel.
  D. Instituting a system of user authentication for company personnel.
  A. Implementing digital rights management technology.

  ---

  Explanation/Reference:

  Implementing digital rights management (DRM) technology is the best option to improve an organization's system of limiting data use. DRM helps in controlling and preventing unauthorized access or use of digital content, ensuring that data is used only in ways that comply with policy or legal requirements. This technology can enforce restrictions on copying, editing, or printing of sensitive data, thus effectively limiting its use to intended purposes.

• Question 78:

  What tactic does pharming use to achieve its goal?

  A. It modifies the user's Hosts file.
  B. It encrypts files on a user's computer.
  C. It creates a false display advertisement.
  D. It generates a malicious instant message.
  A. It modifies the user's Hosts file.

  ---

  Explanation/Reference:

  Reference: https://inspiredelearning.com/blog/phishing-vs-pharming-whats-difference/

• Question 79:

  An organization has changed its policies to allow its employees to work remotely. However, it is concerned about employees working and processing personal data in jurisdictions outside of its own. Which of the following would allow the organization to mitigate the risk?

  A. Geofencing
  B. l-diversity
  C. Pseudonymization
  D. Multi-Factor Authentication
  A. Geofencing

• Question 80:

  What logs should an application server retain in order to prevent phishing attacks while minimizing data retention?

  A. Limited-retention, de-identified logs including only metadata.
  B. Limited-retention, de-identified logs including the links clicked in messages as well as metadata.
  C. Limited-retention logs including the identity of parties sending and receiving messages as well as metadata.
  D. Limited-retention logs including the links clicked in messages, the identity of parties sending and receiving them, as well as metadata.
  B. Limited-retention, de-identified logs including the links clicked in messages as well as metadata.