IAPP CIPT Online Practice Questions and Exam Preparation

IAPP CIPT Online Questions & Answers

• Question 81:

  To comply with the Sarbanes-Oxley Act (SOX), public companies in the United States are required to annually report on the effectiveness of the auditing controls of their financial reporting systems. These controls must be implemented to prevent unauthorized use, disclosure, modification, and damage or loss of financial data.

  Why do these controls ensure both the privacy and security of data?

  A. Modification of data is an aspect of privacy; unauthorized use, disclosure, and damage or loss of data are aspects of security.
  B. Unauthorized use of data is an aspect of privacy; disclosure, modification, and damage or loss of data are aspects of security.
  C. Disclosure of data is an aspect of privacy; unauthorized use, modification, and damage or loss of data are aspects of security.
  D. Damage or loss of data are aspects of privacy; disclosure, unauthorized use, and modification of data are aspects of privacy.
  C. Disclosure of data is an aspect of privacy; unauthorized use, modification, and damage or loss of data are aspects of security.

• Question 82:

  Which of the following is the primary purpose of implementing "defense in depth" as a security concept in an organization?

  A. To manage incidents through multiple nodes of escalation
  B. To create multiple layers of security controls to prevent unauthorized access
  C. To ensure compliance with privacy regulations through strong security measures
  D. To monitor and detect security incidents in real-time to minimize privacy breaches
  B. To create multiple layers of security controls to prevent unauthorized access

• Question 83:

  SCENARIO

  Please use the following to answer the next question:

  Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to

  recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

  The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended

  treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to

  review along with the health record. The patient may also delegate access to the app.

  LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

  The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user

  related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide

  consent.

  Regarding the app, which action is an example of a decisional interference violation?

  A. The app asks income level to determine the treatment of care.
  B. The app sells aggregated data to an advertising company without prior consent.
  C. The app has a pop-up ad requesting sign-up for a pharmaceutical company newsletter.
  D. The app asks questions during account set-up to disclose family medical history that is not necessary for the treatment of the individual's symptoms.
  A. The app asks income level to determine the treatment of care.

  ---

  Explanation/Reference:

  Asking for income level to determine treatment of care could be considered decisional interference because it could influence or interfere with an individual's ability to make decisions about their own healthcare. This type of information may not be necessary for providing medical recommendations and could potentially lead to discrimination or unequal treatment.

• Question 84:

  A valid argument against data minimization is that it?

  A. Can limit business opportunities.
  B. Decreases the speed of data transfers.
  C. Can have an adverse effect on data quality.
  D. Increases the chance that someone can be identified from data.
  A. Can limit business opportunities.

  ---

  Explanation/Reference:

  A valid argument against data minimization is that it can limit business opportunities23 . Data minimization refers to limiting the collection, storage, and processing of personal information to only what is strictly necessary for business operations3. While this practice can help protect privacy and security, it can also restrict the potential uses and benefits of data for innovation, research, marketing, analytics etc.23. The other options are not valid arguments against data minimization, but rather arguments in favor of it23. https://www.manageengine.com/data-security/what-is/data-minimization.html

• Question 85:

  What is the main function of the Amnesic Incognito Live System or TAILS device?

  A. It allows the user to run a self-contained computer from a USB device.
  B. It accesses systems with a credential that leaves no discernable tracks.
  C. It encrypts data stored on any computer on a network.
  D. It causes a system to suspend its security protocols.
  B. It accesses systems with a credential that leaves no discernable tracks.

  ---

  Explanation/Reference:

  It accesses systems with a credential that leaves no discernable tracks. TAILS is designed to provide anonymous and private internet usage by running from a USB device without leaving traces on the host system. It routes internet traffic through the Tor network, ensuring privacy and security for users who need to browse or communicate without revealing their identity or leaving digital footprints. TAILS does not suspend security protocols; instead, it enhances security by minimizing exposure and maintaining anonymity.

  Reference: https://www.wired.co.uk/article/tails-operating-software

• Question 86:

  Which of the following is the least effective privacy preserving practice in the Systems Development Life Cycle (SDLC)?

  A. Conducting privacy threat modeling for the use-case.
  B. Following secure and privacy coding standards in the development.
  C. Developing data flow modeling to identify sources and destinations of sensitive data.
  D. Reviewing the code against Open Web Application Security Project (OWASP) Top 10 Security Risks.
  D. Reviewing the code against Open Web Application Security Project (OWASP) Top 10 Security Risks.

• Question 87:

  SCENARIO

  Wesley Energy has finally made its move, acquiring the venerable oil and gas exploration firm Lancelot from its long-time owner David Wilson. As a member of the transition team, you have come to realize that Wilson's quirky nature affected even Lancelot's data practices, which are maddeningly inconsistent. "The old man hired and fired IT people like he was changing his necktie," one of Wilson's seasoned lieutenants tells you, as you identify the traces of initiatives left half complete. For instance, while some proprietary data and personal information on clients and employees is encrypted, other sensitive information, including health information from surveillance testing of employees for toxic exposures, remains unencrypted, particularly when included within longer records with less-sensitive data. You also find that data is scattered across applications, servers and facilities in a manner that at first glance seems almost random.

  Among your preliminary findings of the condition of data at Lancelot are the following:

  Cloud technology is supplied by vendors around the world, including firms that you have not heard of. You are told by a former Lancelot employee that these vendors operate with divergent security requirements and protocols. The company's proprietary recovery process for shale oil is stored on servers among a variety of less-sensitive information that can be accessed not only by scientists, but by personnel of all types at most company locations. DES is the strongest encryption algorithm currently used for any file. Several company facilities lack physical security controls, beyond visitor check-in, which familiar vendors often bypass. Fixing all of this will take work, but first you need to grasp the scope of the mess and formulate a plan of action to address it.

  Which is true regarding the type of encryption Lancelot uses?

  A. It employs the data scrambling technique known as obfuscation.
  B. Its decryption key is derived from its encryption key.
  C. It uses a single key for encryption and decryption.
  D. It is a data masking methodology.
  C. It uses a single key for encryption and decryption.

  ---

  Explanation/Reference:

  It uses a single key for encryption and decryption. In the scenario, it is mentioned that Lancelot uses symmetric encryption to protect its data. Symmetric encryption uses a single key for both encryption and decryption.

• Question 88:

  What must be done to destroy data stored on "write once read many" (WORM) media?

  A. The data must be made inaccessible by encryption.
  B. The erase function must be used to remove all data.
  C. The media must be physically destroyed.
  D. The media must be reformatted.
  C. The media must be physically destroyed.

• Question 89:

  During a transport layer security (TLS) session, what happens immediately after the web browser creates a random PreMasterSecret?

  A. The server decrypts the PremasterSecret.
  B. The web browser opens a TLS connection to the PremasterSecret.
  C. The web browser encrypts the PremasterSecret with the server's public key.
  D. The server and client use the same algorithm to convert the PremasterSecret into an encryption key.
  C. The web browser encrypts the PremasterSecret with the server's public key.

• Question 90:

  An organization is designing a new system that allows its helpdesk to remotely connect to the device of an individual to provide support. Which of the following will be a privacy technologist's primary concern?

  A. The amount of time before the connection terminates
  B. The type of encryption used between the end user and helpdesk.
  C. The location of the helpdesk to identify cross border data transfers.
  D. The lack of a prompt to obtain consent from the end user to access the device.
  D. The lack of a prompt to obtain consent from the end user to access the device.