81 free IAPP CIPT practice questions from the CertStash pack of 325, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 81 free here, all 325 in the pack, and each step includes the one before it.
Get all 325 questions (US$39) · Download the first 10 as a PDF
Question 1
Which Organization for Economic Co-operation and Development (OECD) privacy protection principle encourages an organization to obtain an individual s consent before transferring personal information?
Show answer and explanation
Correct answer: A. Individual participation.
Individual participation is the OECD principle that grants data subjects rights regarding their personal information, including the right to know about data collection and to consent before personal information is transferred to third parties. This principle emphasizes the active role individuals should have in controlling their own data.
Why the other options are wrong
- B. Purpose specification requires organizations to identify purposes before collection, not specifically about consent for transfer.
- C. Collection limitation restricts data collection to necessary information, not about obtaining consent for transfers.
- D. Accountability requires organizations to be responsible for compliance, not specifically about obtaining consent before transfer.
Question 2
Granting data subjects the right to have data corrected, amended, or deleted describes?
Show answer and explanation
Correct answer: D. Individual participation
Individual participation is the principle that grants data subjects the right to access, correct, amend, or delete their personal information. This core privacy right allows individuals to have direct involvement in managing their own data and ensures they can address inaccuracies.
Why the other options are wrong
- A. Use limitation restricts how data may be used once collected, not about correcting or deleting data.
- B. Accountability focuses on organizational responsibility and compliance mechanisms, not data subject correction rights.
- C. A security safeguard is a protective measure against unauthorized access, distinct from the right to amend or delete data.
Question 3
What is a mistake organizations make when establishing privacy settings during the development of applications?
Show answer and explanation
Correct answer: D. Failing to get explicit consent from a user on the use of cookies.
Failing to obtain explicit consent from users on the use of cookies is a critical privacy mistake during application development. Cookies can track user behavior and collect personal data, making explicit consent essential for legal compliance and user trust. Modern privacy regulations require affirmative user consent for cookie deployment.
Why the other options are wrong
- A. Providing too many privacy choices is generally beneficial to users and supports informed decision-making.
- B. Do Not Track technology, while useful, is not a primary regulatory requirement for privacy compliance.
- C. Providing information about third parties is transparency-enhancing and supports user understanding, not a mistake.
Question 4
Which of the following suggests the greatest degree of transparency?
Show answer and explanation
Correct answer: D. After reading the privacy notice, a data subject confidently infers how her information will be used.
Transparency is best demonstrated when a data subject can confidently understand and infer how their information will be used after reading the privacy notice. This reflects true clarity and comprehension, the ultimate goal of transparency is ensuring individuals genuinely understand data practices, not merely disclosing information that remains unclear.
Why the other options are wrong
- A. General articulation of purposes lacks the specificity needed for genuine transparency.
- B. Opt-out opportunities after collection address user control but do not ensure transparency about initial data use.
- C. Broadly defined future collections obscure rather than enhance transparency about actual data usage.
Question 5
Which is NOT a suitable method for assuring the quality of data collected by a third-party company?
Show answer and explanation
Correct answer: C. Introducing erroneous data to see if its detected.
Introducing erroneous data intentionally to test detection is not a suitable quality assurance method because it contaminates the actual data with false information, potentially causing real harm and violating data integrity. Legitimate quality assurance methods include verification through user contact, validation of collection procedures, and audit trails, all of which maintain data integrity while identifying issues.
Why the other options are wrong
- A. Verifying accuracy by contacting users is a direct and legitimate quality assurance method.
- B. Validating collection procedures ensures data quality at the source.
- D. Auditing changes through tracking provides accountability and enables detection of quality issues.
Question 6
A valid argument against data minimization is that it?
Show answer and explanation
Correct answer: A. Can limit business opportunities.
Data minimization, collecting only necessary data, can limit business opportunities because organizations may forgo valuable data that could support new products, services, or business models. While minimization enhances privacy, organizations must balance this against legitimate business needs and the potential competitive advantages of broader data collection.
Why the other options are wrong
- B. Data minimization does not inherently decrease transfer speeds; this is unrelated to the volume of data collected.
- C. Minimizing data generally improves quality by reducing irrelevant noise, not adversely affecting it.
- D. Collecting less data actually reduces the chance of identification, supporting privacy rather than working against it.
Question 7
What is the main reason a company relies on implied consent instead of explicit consent from a user to process her data?
Show answer and explanation
Correct answer: B. To secure explicit consent, a user's website browsing would be significantly disrupted.
Companies rely on implied consent instead of explicit consent because obtaining explicit consent through direct user interaction would significantly disrupt the user experience, requiring interruptions and blocking normal website browsing. Explicit consent mechanisms are burdensome and slow down user interactions, making them impractical for high-volume web operations, though modern privacy regulations increasingly mandate explicit consent despite this friction.
Why the other options are wrong
- A. Implied consent typically provides less detailed information than explicit consent models.
- C. Implementation cost is not the primary driver; user experience disruption is the main concern.
- D. Regulators increasingly prefer and mandate explicit consent, particularly under GDPR and similar frameworks.
Question 8
What is the main benefit of using dummy data during software testing?
Show answer and explanation
Correct answer: D. Developers do not need special privacy training to test the software.
The main benefit of using dummy data during software testing is that developers do not need special privacy training to handle it. Since dummy data contains no real personal information, it eliminates privacy risks and the need for developers to be trained on privacy-sensitive data handling procedures, security protocols, and compliance requirements.
Why the other options are wrong
- A. Format convenience is not the primary benefit; dummy data may require transformation to match production data formats.
- B. Statistical disclosure controls are applied to real data for privacy protection, not to dummy data.
- C. Data suppression applies to real datasets during privacy protection, not to dummy data for testing.
Question 9
SCENARIO Kyle is a new security compliance manager who will be responsible for coordinating and executing controls to ensure compliance with the company's information security policy and industry standards. Kyle is also new to the company, where collaboration is a core value. On his first day of new-hire orientation, Kyle's schedule included participating in meetings and observing work in the IT and compliance departments. Kyle spent the morning in the IT department, where the CIO welcomed him and explained that her department was responsible for IT governance. The CIO and Kyle engaged in a conversation about the importance of identifying meaningful IT governance metrics. Following their conversation, the CIO introduced Kyle to Ted and Barney. Ted is implementing a plan to encrypt data at the transportation level of the organization's wireless network. Kyle would need to get up to speed on the project and suggest ways to monitor effectiveness once the implementation was complete. Barney explained that his short-term goals are to establish rules governing where data can be placed and to minimize the use of offline data storage. Kyle spent the afternoon with Jill, a compliance specialist, and learned that she was exploring an initiative for a compliance program to follow self-regulatory privacy principles. Thanks to a recent internship, Kyle had some experience in this area and knew where Jill could find some support. Jill also shared results of the company's privacy risk assessment, noting that the secondary use of personal information was considered a high risk. By the end of the day, Kyle was very excited about his new job and his new company. In fact, he learned about an open position for someone with strong qualifications and experience with access privileges, project standards board approval processes, and application-level obligations, and couldn't wait to recommend his friend Ben who would be perfect for the job. Ted's implementation is most likely a response to what incident?
Show answer and explanation
Correct answer: D. Confidential information discussed during a strategic teleconference was intercepted by the organization's top competitor.
Ted is implementing encryption at the transportation level of the wireless network, which protects data in transit. This is a direct response to confidential information being intercepted during communication. Option D describes a strategic teleconference where information was intercepted by a competitor, which is exactly the type of in-transit data exposure that wireless-level encryption would prevent. The other options address different security concerns: encryption keys (cloud storage), malware detection (endpoint security), and authentication attacks (access control), none of which are specifically mitigated by transportation-level encryption.
Why the other options are wrong
- A. Encryption key availability is a cloud storage concern, not a wireless network transportation issue.
- B. Advanced malware detection requires endpoint protection and behavioral analysis, not transportation-level encryption.
- C. Authentication attacks are prevented through access controls and credential management, not data-in-transit encryption.
Question 10
SCENARIO Kyle is a new security compliance manager who will be responsible for coordinating and executing controls to ensure compliance with the company's information security policy and industry standards. Kyle is also new to the company, where collaboration is a core value. On his first day of new-hire orientation, Kyle's schedule included participating in meetings and observing work in the IT and compliance departments. Kyle spent the morning in the IT department, where the CIO welcomed him and explained that her department was responsible for IT governance. The CIO and Kyle engaged in a conversation about the importance of identifying meaningful IT governance metrics. Following their conversation, the CIO introduced Kyle to Ted and Barney. Ted is implementing a plan to encrypt data at the transportation level of the organization's wireless network. Kyle would need to get up to speed on the project and suggest ways to monitor effectiveness once the implementation was complete. Barney explained that his short-term goals are to establish rules governing where data can be placed and to minimize the use of offline data storage. Kyle spent the afternoon with Jill, a compliance specialist, and learned that she was exploring an initiative for a compliance program to follow self-regulatory privacy principles. Thanks to a recent internship, Kyle had some experience in this area and knew where Jill could find some support. Jill also shared results of the company's privacy risk assessment, noting that the secondary use of personal information was considered a high risk. By the end of the day, Kyle was very excited about his new job and his new company. In fact, he learned about an open position for someone with strong qualifications and experience with access privileges, project standards board approval processes, and application-level obligations, and couldn't wait to recommend his friend Ben who would be perfect for the job. Which of the following should Kyle recommend to Jill as the best source of support for her initiative?
Show answer and explanation
Correct answer: C. Industry groups.
Jill is exploring a compliance initiative based on self-regulatory privacy principles. Self-regulatory frameworks and privacy best practices are typically developed and maintained by industry groups and professional organizations that establish standards and guidance for their sectors. Industry groups provide peer support, benchmarking, and collaborative development of privacy standards that companies follow voluntarily. Investors focus on financial returns, regulators enforce mandatory requirements rather than self-regulatory guidance, and corporate researchers develop internal solutions.
Why the other options are wrong
- A. Investors are concerned with financial performance and return on investment, not privacy program methodology.
- B. Regulators enforce compliance through mandatory requirements, whereas self-regulatory principles are voluntary standards developed by industry peers.
- D. Corporate researchers develop organization-specific solutions rather than industry-wide self-regulatory frameworks.
What people say about the full CIPT pack 4.3 from 8
Question 11
What is the main privacy threat posed by Radio Frequency Identification (RFID)?
Show answer and explanation
Correct answer: A. An individual with an RFID receiver can track people or consumer products.
The main privacy threat posed by Radio Frequency Identification is that an individual with an RFID receiver can track people or consumer products without authorization. RFID tags transmit information wirelessly and can be read from a distance, enabling unauthorized tracking and monitoring. Option B concerns weapons systems, which is not an RFID-specific privacy threat. Option C describes video surveillance, which is unrelated to RFID technology. Option D involves mobile phone communications, which uses cellular networks rather than RFID.
Why the other options are wrong
- B. Scrambling computer transmissions in weapons systems is not a primary privacy concern of RFID technology.
- C. RFID does not enable video surveillance; it transmits identification data over short radio frequencies.
- D. Tapping mobile phone communications is a separate security threat unrelated to RFID technology.
Question 12
Properly configured databases and well-written website codes are the best protection against what online threat?
Show answer and explanation
Correct answer: B. SQL injection.
SQL injection is prevented through properly configured databases and well-written website code. This attack occurs when malicious SQL commands are inserted through user input fields to manipulate database queries. Secure coding practices (input validation, parameterized queries, prepared statements) and proper database configuration prevent the execution of injected SQL code. This is the direct and primary defense against SQL injection attacks.
Why the other options are wrong
- A. Pharming redirects users to fraudulent sites through DNS manipulation; it is not prevented by database configuration or website code quality.
- C. Malware execution is prevented through antivirus, endpoint protection, and system hardening rather than database configuration or code quality.
- D. System modification is prevented through access controls, file integrity monitoring, and system hardening, not database configuration alone.
Question 13
SCENARIO Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them. You also recall a recent visit to the Records Storage Section, often termed `The Dungeon` in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage. Which regulation most likely applies to the data stored by Berry Country Regional Medical Center?
Show answer and explanation
Correct answer: A. Personal Information Protection and Electronic Documents Act
Berry Country Regional Medical Center is located in Thorn Bay, Ontario, Canada, making it subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which is Canada's primary federal privacy legislation governing the private sector. PIPEDA applies to organizations processing personal information in Canada and establishes obligations for collection, use, disclosure, and retention of personal data. Option B, HIPAA, applies to U.S. healthcare organizations and is not applicable in Ontario. Option C, The Health Records Act 2001, applies to New South Wales, Australia, not Ontario. Option D, the EU Directive, governs data protection within the European Union and does not apply to Canadian facilities.
Why the other options are wrong
- B. HIPAA is U.S. legislation and does not apply to Canadian medical centers.
- C. The Health Records Act 2001 is Australian legislation applicable to New South Wales, not Ontario.
- D. The European Union Directive 95/46/EC (now GDPR) applies to EU member states, not Canada.
Question 14
What has been found to undermine the public key infrastructure system?
Show answer and explanation
Correct answer: C. Disreputable certificate authorities.
Disreputable or compromised certificate authorities have been identified as a significant threat to PKI systems. When certificate authorities issue fraudulent certificates or have their private keys compromised, they can undermine the entire trust model of PKI. Attackers with valid-looking certificates from trusted CAs can conduct impersonation and man-in-the-middle attacks that appear legitimate.
Why the other options are wrong
- A. While man-in-the-middle attacks are a threat, they are not specifically what undermines PKI itself; rather, PKI is designed to prevent them.
- B. The inability to track abandoned keys is a management concern but not a fundamental undermining of the PKI system.
- D. Modern browsers include copies of trusted CA public keys in their certificate stores, which is a standard and functional part of PKI.
Question 15
A key principle of an effective privacy policy is that it should be?
Show answer and explanation
Correct answer: A. Written in enough detail to cover the majority of likely scenarios.
An effective privacy policy must be written with sufficient detail and specificity to address likely scenarios and provide clear, actionable guidance to the organization and its stakeholders. General policies (B) create ambiguity and inconsistent application; external audience focus (C) is secondary since employees and management must first understand and implement it; and legal-only design (D) often produces policies that lack practical implementability for operational staff.
Why the other options are wrong
- B. Excessive generality reduces the policy's usefulness for actual implementation and leaves critical practices undefined.
- C. While privacy notices communicate with external parties, the policy itself must primarily guide internal organizational behavior.
- D. Policies designed solely by lawyers without operational input often lack practical implementation mechanisms and employee usability.
Question 16
All of the following can be indications of a ransomware attack EXCEPT?
Show answer and explanation
Correct answer: B. An increased amount of spam email in an individual's inbox.
An increased amount of spam email is not a typical indication of ransomware infection. Ransomware attacks are characterized by the encryption or inaccessibility of files, increased CPU and network activity as the malware operates, and suspicious communications with command and control servers. Spam email volume changes are more commonly associated with compromised email accounts or network-level issues rather than ransomware presence.
Why the other options are wrong
- A. Inability to access files is a primary hallmark of ransomware, which encrypts or locks victim data.
- C. Increased CPU activity is a direct indicator as ransomware uses system resources to encrypt files and communicate.
- D. Suspicious network communications with C2 servers are a definitive sign of active ransomware operations.
Question 17
In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?
Show answer and explanation
Correct answer: B. Obfuscation.
Obfuscation is the privacy tactic of making data unclear or less intelligible to prevent identification of individuals. Cryptographically-secure hashing transforms personal identifiers into irreversible hash values, rendering the original data unrecognizable while still allowing the dataset to function. This process obscures the relationship between the hash and the individual, exemplifying obfuscation.
Why the other options are wrong
- A. Isolation involves segregating data into separate systems or environments, not transforming it into unrecognizable form.
- C. Perturbation involves adding noise or slight modifications to data values while maintaining statistical properties, not irreversible hashing.
- D. Stripping refers to removing identifying fields entirely from a dataset, whereas hashing preserves the data field in transformed form.
Question 18
Which of the following statements describes an acceptable disclosure practice?
Show answer and explanation
Correct answer: A. An organization's privacy policy discloses how data will be used among groups within the organization itself.
An acceptable disclosure practice includes clearly communicating how personal data will be used within an organization, including among different internal groups and departments. This internal transparency is fundamental to privacy governance and ensures compliance with privacy principles. Organizations must disclose their data practices to individuals, starting with how data flows and is used internally.
Why the other options are wrong
- B. Internal policies do not override contractual obligations with third parties; contracts establish binding legal terms that supersede unilateral internal policies.
- C. Intermediaries and vendors require comparable disclosure oversight; the distinction between these categories does not create a hierarchy of disclosure requirements.
- D. When an organization discloses data to a vendor, the organization's privacy notice and contractual terms typically govern the relationship, not the vendor's separate privacy notice.
Question 19
Which of the following functionalities can meet some of the General Data Protection Regulation's (GDPR's) Data Portability requirements for a social networking app designed for users in the EU?
Show answer and explanation
Correct answer: C. Allow users to download the content they have provided the app.
GDPR's data portability requirement (Article 20) requires that individuals can obtain and reuse their personal data across different services. Allowing users to download the content they have provided directly fulfills this requirement by providing data in a structured, commonly used, and machine-readable format that can be transferred to another service. This is the explicit mechanism GDPR mandates for data portability.
Why the other options are wrong
- A. Allowing users to modify data addresses the right to rectification, not data portability.
- B. Allowing deletion addresses the right to erasure, not data portability.
- D. Providing a time-stamped list documents activity but does not constitute portable access to the actual data itself.
Question 20
Value Sensitive Design (VSD) focuses on which of the following?
Show answer and explanation
Correct answer: B. Ethics and morality.
Value Sensitive Design (VSD) is a methodological approach that integrates considerations of human values into the design process of technology systems. It emphasizes ethical considerations, moral principles, and the impact of technology on human stakeholders throughout the design lifecycle. VSD explicitly addresses how technology affects people's values and rights, making ethics and morality central to its framework.
Why the other options are wrong
- A. Quality and benefit focus on technical performance metrics rather than the value-centered ethical framework that defines VSD.
- C. While VSD may involve principles and standards, these are applied in service of ethical and moral considerations, not as the primary focus.
- D. Privacy and human rights are important outcomes of VSD but not its singular defining focus; VSD addresses these as part of broader ethical considerations.
Question 21
In the realm of artificial intelligence, how has deep learning enabled greater implementation of machine learning?
Show answer and explanation
Correct answer: B. By increasing the size of neural networks and running massive amounts of data through the network to train it.
Deep learning has enabled greater implementation of machine learning by scaling neural networks to much larger sizes and training them on massive datasets. Unlike traditional machine learning approaches that relied on hand-crafted features or explicit programming, deep learning uses multiple layers of artificial neurons that automatically learn hierarchical representations of data through exposure to vast amounts of training examples. This approach has proven far more effective for complex tasks like image recognition, natural language processing, and pattern recognition.
Why the other options are wrong
- A. Hand-coded classifiers like edge detection filters represent traditional computer vision approaches that preceded deep learning and are not how deep learning improved machine learning implementation.
- C. Decision tree learning and inductive logic programming are classical machine learning techniques that do not define how deep learning advanced the field.
- D. Hand-coding software routines is the opposite of how deep learning works; deep learning systems learn automatically from data rather than through explicit programming.
Question 22
What is the main benefit of using a private cloud?
Show answer and explanation
Correct answer: C. The ability to restrict data access to employees and contractors.
The primary benefit of a private cloud is the ability to restrict data access exclusively to authorized employees, contractors, and designated users. Private clouds provide enhanced security and control over who can access organizational data, distinguishing them from public clouds where data may be shared with other organizations. This restricted access model aligns with compliance requirements and organizational security policies.
Why the other options are wrong
- A. Backup functionality exists in both private and public clouds and is not the distinguishing benefit.
- B. Private clouds involve maintaining infrastructure in-house or with dedicated providers, not outsourcing to third parties.
- D. Private clouds typically increase costs compared to public clouds due to dedicated infrastructure and maintenance.
Question 23
SCENARIO Please use the following to answer the next question: Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process. The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent. Regarding the app, which action is an example of a decisional interference violation?
Show answer and explanation
Correct answer: A. The app asks income level to determine the treatment of care.
Decisional interference occurs when personal data about an individual is used to make or influence decisions that affect that person, particularly when the data collection is not necessary for the stated purpose. Using income level to determine treatment of care is a classic example, it collects financial information to influence medical decisions, which interferes with autonomous decision-making about treatment. This violates the principle that medical care should be based on medical necessity, not financial status.
Why the other options are wrong
- B. Selling aggregated data without consent is a consent and use violation, not specifically a decisional interference violation.
- C. A pop-up ad requesting newsletter signup is a marketing practice, not decisional interference about medical treatment.
- D. Collecting unnecessary family medical history during setup is data minimization overreach but does not represent interference with the user's own medical decisions.
Question 24
SCENARIO Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: • First and last name • Date of birth (DOB) • Mailing address • Email address • Car VIN number • Car model • License plate • Insurance card number • Photo • Vehicle diagnostics • Geolocation The app is designed to collect and transmit geolocation data. How can data collection best be limited to the necessary minimum?
Show answer and explanation
Correct answer: B. Allow access and sharing of geolocation data only after an accident occurs.
Limiting geolocation collection to only after an accident occurs best achieves data minimization by restricting collection to the specific moment when geolocation is actually necessary for the insurance claim assessment purpose. This temporal limitation ensures the app does not collect unnecessary location data during normal driving or when no incident has occurred. Continuous or pre-consent collection violates the principle of collecting only what is necessary for the stated purpose.
Why the other options are wrong
- A. Opt-out capability allows continued collection unless the user actively declines, rather than limiting collection to necessary instances.
- C. Explanation alone does not reduce collection; data is still gathered regardless of how clearly the need is explained.
- D. Collecting data at all times after consent, even continuously, exceeds what is necessary and violates data minimization principles.
Question 25
Implementation of privacy controls for compliance with the requirements of the Children's Online Privacy Protection Act (COPPA) is necessary for all the following situations EXCEPT?
Show answer and explanation
Correct answer: B. An interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.
COPPA applies to operators of online services directed at children under 13 that collect personal information from them online. The interactive toy mimics the child locally and only connects to a home base station to charge, so nothing is collected or transmitted over the internet. The other scenarios involve an online, child-directed service or channel, so COPPA controls are needed.
Why the other options are wrong
- A. The puzzle game is directed at children aged 5 to 9 and receives same-day theme announcements, so it is a connected child-directed service that must address COPPA, for example over persistent identifiers.
- C. The QR code shaped like a cartoon character invites children to contact tutors online, which is an online service directed at children that can collect their contact details.
- D. The note-taking app uploads children's class notes to remote servers for processing, which is online collection of children's content and triggers COPPA.
Question 26
To comply with the Sarbanes-Oxley Act (SOX), public companies in the United States are required to annually report on the effectiveness of the auditing controls of their financial reporting systems. These controls must be implemented to prevent unauthorized use, disclosure, modification, and damage or loss of financial data. Why do these controls ensure both the privacy and security of data?
Show answer and explanation
Correct answer: C. Disclosure of data is an aspect of privacy; unauthorized use, modification, and damage or loss of data are aspects of security.
Disclosure of data is an aspect of privacy because privacy concerns who can access and see personal information. Unauthorized use, modification, and damage or loss of data are aspects of security because security focuses on protecting data integrity, availability, and authorized access control. SOX controls prevent unauthorized disclosure (privacy) and prevent unauthorized use, modification, and damage (security).
Why the other options are wrong
- A. Modification is a security concern related to integrity, not a privacy concern; unauthorized use is a security issue, not exclusively privacy.
- B. Unauthorized use is a security concern regarding access control and authorization, not a privacy concern; disclosure alone relates to privacy.
- D. This option incorrectly categorizes damage/loss and lists privacy twice, misunderstanding the privacy-security distinction.
Question 27
What was the first privacy framework to be developed?
Show answer and explanation
Correct answer: C. Code of Fair Information Practice Principles (FIPPs).
The Code of Fair Information Practice Principles (FIPPs) were developed in the 1970s and represent the first comprehensive privacy framework. They established foundational concepts that influenced subsequent frameworks worldwide. The OECD Privacy Principles (A) came later and built upon FIPPs; Generally Accepted Privacy Principles (B) were developed in the 2000s; and the APEC Privacy Framework (D) emerged in the 2000s as a regional adaptation of earlier principles.
Why the other options are wrong
- A. The OECD Privacy Principles were developed after and based upon the foundational FIPPs framework.
- B. Generally Accepted Privacy Principles were developed decades after FIPPs in response to contemporary practices.
- D. The APEC Privacy Framework was created as a regional framework in the early 2000s, much later than FIPPs.
Question 28
SCENARIO Please use the following to answer the next question: Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file. Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine. After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental. What should Finley Motors have done to incorporate the transparency principle of Privacy by Design (PbD)?
Show answer and explanation
Correct answer: D. Provided notice of data sharing practices within the electronically signed rental agreement.
To incorporate the transparency principle of Privacy by Design, Finley Motors should have provided notice of data sharing practices within the electronically signed rental agreement. Transparency requires that individuals understand how their data will be used and shared before providing it. By clearly disclosing that rental information would be shared with third parties like AMP Payment Resources, Chuck would have had visibility into data handling practices. A data sharing agreement (option A) is a business arrangement but does not ensure transparency to the individual. Documenting legitimate interest (option B) is an internal justification, not transparency to the individual. Verbal consent (option C) is neither transparent nor documented in a manner the individual can reference.
Why the other options are wrong
- A. A data sharing agreement between companies is a legal arrangement but does not provide transparency to the individual whose data is being shared.
- B. Documenting legitimate interest is an internal compliance measure, not a transparency mechanism for communicating with the data subject.
- C. Verbal consent that is only recorded internally does not provide Chuck with documented transparency about how his data will be shared.
Question 29
Which of the following modes of interaction often target both people who personally know and are strangers to the attacker?
Show answer and explanation
Correct answer: B. Phishing.
Phishing attacks are designed to deceive recipients into revealing sensitive information or performing harmful actions by impersonating trusted entities. Phishing campaigns target both known contacts and strangers indiscriminately, making it a mode of interaction that affects both groups. Spam (A) is unsolicited bulk messaging but less specifically targeted to exploit trust relationships. Sexual imagery scenarios (C and D) involve different types of harm and targeting patterns.
Why the other options are wrong
- A. Spam is bulk unsolicited messaging that targets strangers broadly but doesn't typically exploit personal relationships with known contacts.
- C. Unsolicited sexual imagery is generally directed at strangers and doesn't target people who personally know the attacker.
- D. Consensually-shared sexual imagery by definition involves known contacts, not strangers.
Question 30
What is true of providers of wireless technology?
Show answer and explanation
Correct answer: B. They can see all unencrypted data that crosses the system.
Wireless technology providers can see all unencrypted data that crosses their systems because they operate the network infrastructure through which data passes. This is a technical reality of how wireless networks function, any data transmitted without encryption is visible to the provider at the network level, regardless of legal rights or regulations.
Why the other options are wrong
- A. Legal rights to control data vary by jurisdiction and are constrained by data protection regulations; providers do not have blanket rights.
- C. Wireless providers are not exempt from data security regulations; they have specific compliance obligations under laws like GDPR and others.
- D. Providers do not routinely backup all data crossing their systems; this would be impractical and typically not part of standard operations.
Question 31
Which is NOT a suitable action to apply to data when the retention period ends?
Show answer and explanation
Correct answer: D. Retagging.
When a retention period ends, organizations must take action on the data through approved disposal methods. Aggregation combines data into summary statistics, de-identification removes identifiers so data cannot be linked to individuals, and deletion removes the data entirely, all are valid post-retention actions. Retagging simply relabels the data without actually addressing its disposition and would improperly extend the data's lifecycle beyond its authorized retention period, making it unsuitable as a retention-end action.
Why the other options are wrong
- A. Aggregation is a valid post-retention action that transforms individual records into statistical summaries.
- B. De-identification is a valid post-retention action that allows data to be retained for secondary purposes.
- C. Deletion is the standard post-retention action that removes data entirely.
Question 32
A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account. What would be the best recommendation to minimize the potential privacy risk from this weakness?
Show answer and explanation
Correct answer: A. Implement a CAPTCHA system.
Implementing a CAPTCHA system is the best recommendation to minimize privacy risk from unlimited login attempts. A CAPTCHA provides rate limiting and account protection by requiring human verification after multiple failed login attempts, thereby preventing brute force attacks that could compromise user accounts and expose personal information. This directly addresses the identified weakness of unlimited invalid attempts.
Why the other options are wrong
- B. Server-side input validation checks are important for security but do not specifically address the issue of unlimited login attempts and account compromise.
- C. Enforcing strong passwords is a helpful general security measure but does not prevent brute force attacks when unlimited attempts are permitted.
- D. Strong TLS encryption protects data in transit but does not prevent an attacker from making unlimited login attempts to compromise an account.
Question 33
SCENARIO WebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker. The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll. This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome `" a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker. To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks. The results of this initial work include the following notes: • There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome. • You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure. • There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system. • Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker. • All the WebTracker and SmartHome customers are based in USA and Canada. Which of the following issues is most likely to require an investigation by the Chief Privacy Officer (CPO) of WebTracker?
Show answer and explanation
Correct answer: B. AmaZure sends newsletter to WebTracker customers, as approved by the Marketing Manager.
AmaZure is contracted as a processor providing databases and AI services, with WebTracker as the controller. A processor sending its own newsletters to the controller's customers goes beyond its documented instructions and purpose, and marketing approval by a line manager does not make it lawful. That is a privacy governance issue the CPO needs to investigate.
Why the other options are wrong
- A. Encrypting data at rest is a normal security safeguard that reduces privacy risk rather than raising a concern for the CPO.
- C. Storing employee data in a cloud HR system with the HR Manager's approval is a routine, sanctioned activity and falls outside the marketing-focused concern here.
- D. File Integrity Monitoring on SQL servers is a standard security control that protects data and does not by itself create a privacy issue.
Question 34
When releasing aggregates, what must be performed to magnitude data to ensure privacy?
Show answer and explanation
Correct answer: B. Noise addition.
Noise addition is the technique used to protect aggregated data by introducing random variations into the values. This method obscures the true values while maintaining statistical validity and patterns in the aggregated data. Noise addition prevents attackers from reverse-engineering individual records from aggregate statistics while preserving the overall utility of the aggregated dataset.
Why the other options are wrong
- A. Value swapping is a technique for microdata de-identification, not for protecting aggregated magnitude data.
- C. Basic rounding alone provides insufficient protection for aggregated data and does not adequately prevent re-identification attacks.
- D. Top coding addresses extreme values in individual records and is not the primary technique for protecting aggregated magnitude data.
Question 35
SCENARIO Please use the following to answer the next question: Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process. The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent. What is the best way to minimize the risk of an exposure violation through the use of the app?
Show answer and explanation
Correct answer: B. Dissociate the patient health data from the personal data.
Dissociating patient health data from personal data (de-identification or pseudonymization) minimizes exposure violations by preventing the linking of sensitive health information with identifying personal information. If health records cannot be connected to individuals, the impact of unauthorized exposure is significantly reduced. This directly addresses the privacy risk of exposure by limiting what can be revealed about any specific individual.
Why the other options are wrong
- A. Preventing photo downloads does not address the core exposure risk of health data being compromised.
- C. Excluding collection of personal information entirely is impractical and conflicts with the app's stated purpose of using health records.
- D. A policy preventing data combination is administrative but does not technologically minimize the exposure risk of the data already collected.
Question 36
What is the main reason the Do Not Track (DNT) header is not acknowledged by more companies?
Show answer and explanation
Correct answer: C. There is a lack of consensus about what the DNT header should mean.
The Do Not Track (DNT) header has not been widely adopted by companies primarily because there is no industry consensus on what the header should actually mean or enforce. Without agreed-upon standards for interpretation and implementation, companies cannot reliably interpret user intentions, leading to inconsistent adoption and effectiveness across the web.
Why the other options are wrong
- A. While many browsers do incorporate DNT, this is not the reason companies fail to acknowledge it.
- B. Financial penalties for violating DNT guidelines are not the primary barrier to adoption.
- D. DNT technology itself is not particularly challenging to implement; the issue is semantic agreement.
Question 37
Revocation and reissuing of compromised credentials is impossible for which of the following authentication techniques?
Show answer and explanation
Correct answer: A. Biometric data.
Biometric data cannot be revoked or reissued because it is based on permanent physical characteristics. Unlike passwords, smartcards, or PINs that can be changed or replaced if compromised, biometric credentials are inherent to the individual. If a biometric identifier is compromised, the person cannot simply obtain a new fingerprint, iris pattern, or face, making biometric authentication uniquely problematic in breach scenarios.
Why the other options are wrong
- B. Picture passwords can be changed and reissued if compromised.
- C. Personal identification numbers can be revoked and new ones issued to the user.
- D. Radio frequency identification credentials can be revoked and new tokens issued to replace compromised ones.
Question 38
A company configures their information system to have the following capabilities: • Allow for selective disclosure of attributes to certain parties, but not to others. Permit the sharing of attribute references instead of attribute values - such as `I am over 21` instead of birthday date. • Allow for information to be altered or deleted as needed. These capabilities help to achieve which privacy engineering objective?
Show answer and explanation
Correct answer: B. Manageability.
Manageability is the privacy engineering objective achieved by these capabilities. Selective disclosure allows users to control what attributes are shared with different parties, attribute references provide privacy-preserving alternatives, and the ability to alter or delete data gives users management control over their information throughout its lifecycle. These features enable users to actively manage and control their personal information.
Why the other options are wrong
- A. Predictability relates to clarity about data practices, not the technical ability to control and manage data attributes.
- C. Disassociability is the ability to separate data so it cannot be linked to individuals; these features focus on control and management.
- D. Integrity relates to accuracy and consistency of data, not the selective disclosure and modification capabilities described.
Question 39
Which of the following would best improve an organization' s system of limiting data use?
Show answer and explanation
Correct answer: A. Implementing digital rights management technology.
Digital rights management is a preventive technical control that enforces use limitation directly, restricting what a user can do with data such as viewing, copying, printing or forwarding it. It keeps working even after the data leaves the original system, so it best improves a system for limiting how data is used.
Why the other options are wrong
- B. Relying on implied consent for secondary uses expands data use rather than limiting it, and secondary uses usually need fresh notice or explicit consent.
- C. Audit trails are a detective control that record use after the fact, so they help find misuse but do not actually limit what personnel can do with the data.
- D. Authentication verifies who a user is but places no restriction on how an authenticated user uses the data once access is granted.
Question 40
Which of the following provides a mechanism that allows an end-user to use a single sign-on (SSO) for multiple services?
Show answer and explanation
Correct answer: A. The Open ID Federation.
OpenID Federation provides an open standard mechanism that allows end-users to use a single sign-on (SSO) credential across multiple federated services and organizations. It enables interoperability between identity providers and service providers, allowing seamless authentication without requiring separate credentials for each service.
Why the other options are wrong
- B. The PCI Data Security Standards Council establishes payment card security standards but does not provide SSO mechanisms.
- C. The International Organization for Standardization publishes standards but is not itself a mechanism or system that enables SSO.
- D. The Personal Information Protection and Electronic Documents Act is Canadian privacy legislation, not a technical mechanism for implementing single sign-on.
Question 41
What must be done to destroy data stored on "write once read many" (WORM) media?
Show answer and explanation
Correct answer: C. The media must be physically destroyed.
WORM (Write Once Read Many) media cannot be erased, reformatted, or overwritten by definition, data written to WORM media is permanent and immutable. The only effective method to destroy data on WORM media is to physically destroy the media itself through shredding, incineration, or similar methods that render it completely unusable.
Why the other options are wrong
- A. Encryption does not destroy data; it only makes it unreadable, and the physical media could still be compromised if encryption keys are recovered.
- B. WORM media cannot be erased by function; this is a fundamental characteristic of the technology.
- D. WORM media cannot be reformatted; reformatting requires the ability to write, which contradicts the write-once nature of the media.
Question 42
Which of the following does NOT illustrate the `˜respect to user privacy' principle?
Show answer and explanation
Correct answer: D. Filing breach notification paperwork with data protection authorities which detail the impact to data subjects.
The 'respect to user privacy' principle emphasizes empowering individuals and enabling them to exercise control over their personal information. Option D, filing breach notification with authorities, is a compliance and legal obligation but does not directly respect user privacy or empower data subjects. It is reactive notification of harm rather than proactive respect for privacy choices. Option A illustrates respect by ensuring accessibility to privacy-related user interface features for all users. Option B exemplifies respect by enabling data subjects to exercise rights over their information through DSARs. Option C demonstrates respect by providing transparency and user control through a consent management portal where individuals review and manage their consent preferences.
Why the other options are wrong
- A. Accessible user interface design for privacy features directly respects user privacy by enabling all users to exercise privacy controls.
- B. Data Subject Access Requests empower individuals to control, correct, and delete their personal information, exemplifying respect for privacy.
- C. A consent management portal enables data subjects to review and control their consent, directly respecting user privacy autonomy.
Question 43
SCENARIO Please use the following to answer the next question: Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file. Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine. After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental. What is the most secure method Finley Motors should use to transmit Chuck's information to AMP Payment Resources?
Show answer and explanation
Correct answer: D. Transport Layer Security (TLS).
Transport Layer Security (TLS) is the most secure method for transmitting sensitive personal information to third parties. TLS provides encryption of data in transit, protecting it from interception and eavesdropping. Cloud file transfer services (option A) vary in security and may not provide adequate encryption guarantees. A Certificate Authority (option B) issues certificates used in TLS but is not itself a transmission method. HTTP (option C) is unencrypted and completely insecure for sensitive data transmission.
Why the other options are wrong
- A. Cloud file transfer services vary widely in security implementation and do not guarantee encryption equivalent to TLS.
- B. A Certificate Authority is a component of secure infrastructure but not a transmission method itself.
- C. HTTP is unencrypted and provides no protection for sensitive personal data in transit.
Question 44
A privacy engineer reviews a newly developed online registration page on a company's website. The purpose of the page is to enable corporate customers to submit a returns / refund request for physical goods. The page displays the following data capture fields: company name, account reference, company address, contact name, email address, contact phone number, product name, quantity, issue description and company bank account details. After her review, the privacy engineer recommends setting certain capture fields as `non-mandatory`. Setting which of the following fields as `non-mandatory` would be the best example of the principle of data minimization?
Show answer and explanation
Correct answer: A. The contact phone number field.
The contact phone number field best exemplifies data minimization as non-mandatory. Data minimization requires collecting only the personal data necessary for the stated purpose. For processing a returns/refund request, the company needs the account reference, product information, and a contact method to respond, but email address already provides an adequate contact method. The phone number is redundant and not essential for completing the refund process, making it the clearest example of data that can be eliminated while maintaining functional capability.
Why the other options are wrong
- B. Company name and address are necessary to identify the corporate customer and process the return for the correct entity.
- C. Contact name and email are both essential to identify the requesting person and communicate the refund decision.
- D. While bank account details may be unnecessary for some refund methods, phone number is a clearer example of non-essential contact information when email is already collected.
Question 45
Which is likely to reduce the types of access controls needed within an organization?
Show answer and explanation
Correct answer: C. Standardization of technology.
Standardization of technology across an organization reduces the variety of platforms, systems, and tools requiring different access control implementations. With standardized technology, organizations need fewer types of access controls since different systems use consistent permission models and interfaces. Option A increases complexity, option B provides visibility but not control reduction, and option D increases distributed access points requiring more controls.
Why the other options are wrong
- A. Decentralized data increases the number of access control points needed.
- B. Inventories provide visibility but don't reduce the types of controls required.
- D. Remote employees typically require additional access control mechanisms, not fewer.
Question 46
SCENARIO Please use the following to answer the next question: Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user's region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences. Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any `offering goods or services` in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no `offering` from the company. The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step-tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company's servers in order to be processed, and then the results are sent to the smartphone or computer. Jordan argues that there is no personal information involved since the company does not collect banking or social security information. Based on the current features of the fitness watch, what would you recommend be implemented into each device in order to most effectively ensure privacy?
Show answer and explanation
Correct answer: D. Randomized MAC address.
To protect user privacy in fitness tracking devices that collect continuous behavioral and location data, randomized MAC addresses should be implemented. A MAC address is the device's hardware identifier used in network communication. Randomizing it prevents tracking of the device across different networks and locations, which is critical for a GPS-enabled fitness tracker that collects location data. This prevents both the company and third parties from persistently identifying and tracking the physical device and user movements, addressing the core privacy threat posed by the device's continuous monitoring capabilities.
Why the other options are wrong
- A. Hashing is a data transformation technique but does not address device identification and tracking issues inherent in fitness watch operations.
- B. A2DP is a Bluetooth audio profile used for streaming audio; it is irrelevant to privacy protection in fitness trackers.
- C. A persistent unique identifier would actually worsen privacy by enabling constant tracking of the device rather than preventing it.
Question 47
SCENARIO Please use the following to answer the next question: Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file. Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine. After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental. How can Finley Motors reduce the risk associated with transferring Chuck's personal information to AMP Payment Resources?
Show answer and explanation
Correct answer: A. By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer.
The best way to reduce risk when transferring personal information to third parties is to provide only the minimum necessary data to accomplish the specific purpose and mask all other information prior to transfer. This applies the principle of data minimization, which limits exposure to only essential information. Requesting the third party delete data (option B) places responsibility on them after receipt and does not minimize initial transfer. Obfuscating minimum data (option C) is redundant, if only minimum data is transferred, obfuscation adds complexity without proportional benefit. Separating datasets (option D) increases complexity and does not reduce the amount of sensitive information transferred.
Why the other options are wrong
- B. Requesting deletion after transfer does not reduce the risk during transmission or prevent interim exposure of unnecessary data.
- C. If only minimum necessary data is provided, additional obfuscation is unnecessary and creates operational complexity.
- D. Separating data into multiple files does not reduce risk and may increase it by requiring the recipient to recombine sensitive datasets.
Question 48
How does k-anonymity help to protect privacy in micro data sets?
Show answer and explanation
Correct answer: A. By ensuring that every record in a set is part of a group of "k" records having similar identifying information.
K-anonymity protects privacy by ensuring that each record in a dataset is indistinguishable from at least k-1 other records with respect to identifying attributes. This means every individual's data is part of a group of at least k records sharing similar identifying information, making it impossible to isolate any single person's data with certainty. This technique prevents re-identification attacks by guaranteeing that any record could belong to any of k individuals.
Why the other options are wrong
- B. Switching values between records describes data swapping or permutation, which is a different privacy technique that preserves certain statistical properties.
- C. Adding noise to data describes differential privacy or perturbation methods, which are distinct approaches to privacy protection.
- D. Top-coding is a suppression technique for extreme values but does not implement k-anonymity's core principle of grouped indistinguishability.
Question 49
Users of a web-based email service have their accounts breached through compromised login credentials. Which possible consequences of the breach illustrate the two categories of Calo's Harm Dimensions?
Show answer and explanation
Correct answer: C. Identity theft and embarrassment.
Calo's Harm Dimensions framework identifies two primary categories of privacy harm: autonomy/dignity harms and informational harms. Identity theft represents an autonomy harm, affecting a person's ability to control their identity and actions. Embarrassment from leaked private information represents an informational harm, resulting from disclosure of sensitive personal information. Option A conflates financial loss and blackmail, which are both economic harms rather than representing two distinct dimensions. Option B similarly treats financial loss and solicitation as separate categories when they are not aligned with Calo's framework. Option D presents identity theft and information leaking, but leaking is a mechanism rather than a distinct harm category.
Why the other options are wrong
- A. Financial loss and blackmail are both economic harms, not representing two distinct harm dimensions.
- B. Financial loss and solicitation do not represent the two categories Calo identifies.
- D. Information leaking is a mechanism of harm rather than a distinct category of harm outcome.
Question 50
Which of the following statements best describes the relationship between privacy and security?
Show answer and explanation
Correct answer: A. Security systems can be used to enforce compliance with privacy policies.
Security systems can be used to enforce compliance with privacy policies by controlling access, encryption, audit logging, and data handling to ensure privacy promises are met. Security mechanisms are the technical means through which privacy policies are implemented and enforced. Option B is incorrect because privacy and security are interdependent, not independent choices. Option C confuses the definitions, privacy restricts access but also governs use; security protects all confidential information regardless of type. Option D incorrectly suggests privacy only applies to collection, when it encompasses the entire data lifecycle.
Why the other options are wrong
- B. Privacy and security are inherently interdependent; organizations must implement both, as security mechanisms enforce privacy policies.
- C. This misdefines the roles; security also regulates how information is used and protected, not just access restriction.
- D. Privacy extends beyond collection to govern use throughout the data lifecycle, and security applies to all sensitive data, not just sharing.
Question 51
What is the most effective first step to take to operationalize Privacy by Design principles in new product development and projects?
Show answer and explanation
Correct answer: B. Obtain leadership buy-in for a mandatory privacy review and approval process.
Operationalizing Privacy by Design principles requires organizational commitment from the top down. Leadership buy-in is the foundational first step because without executive support and mandate, any privacy review process will lack authority, resources, and organizational adherence. Once leadership is committed to making privacy review and approval mandatory, the organization can then implement the necessary processes, tools, and training. Leadership alignment establishes the organizational culture and governance framework needed for Privacy by Design to be effective throughout new product development.
Why the other options are wrong
- A. Implementing a process without leadership buy-in first risks the process being deprioritized or ignored when faced with competing pressures.
- C. Setting up tools is a subsequent implementation step that requires leadership mandate and clear governance frameworks to be effective.
- D. Training comes after establishing the commitment and processes; it reinforces rather than initiates operationalization.
Question 52
Which of the following CANNOT be effectively determined during a code audit?
Show answer and explanation
Correct answer: C. Whether consent is durably recorded in the case of a server crash.
Whether consent is durably recorded in the case of a server crash cannot be effectively determined through code audit alone. This determination requires testing system behavior under actual or simulated failure conditions to verify that consent records persist and are recoverable after infrastructure failures. Code review can examine the intended consent recording logic, but cannot empirically demonstrate durability under real crash scenarios without runtime testing and infrastructure validation.
Why the other options are wrong
- A. Code audit can identify whether access control logic is implemented in all necessary locations and cases throughout the codebase.
- B. Code audit can trace data flows to third parties and identify whether data sharing mechanisms are properly restricted or validated.
- D. Code audit can review the implementation of differential privacy algorithms to verify correctness of the anonymization approach used.
Question 53
Which of the following occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed?
Show answer and explanation
Correct answer: A. Express consent
Express consent occurs when an individual takes a specific, observable, and affirmative action to indicate permission for their information to be processed. This includes actions such as clicking a consent button, signing a form, checking a box, or verbally confirming permission. The key characteristic is that the individual performs a deliberate action that explicitly communicates their agreement. This is distinct from implied consent, which is inferred from actions or circumstances without explicit confirmation.
Why the other options are wrong
- B. Implied consent is inferred from the individual's conduct or circumstances, not from a specific observable action they take to confirm permission.
- C. Informed notice refers to providing information to individuals about data processing, but does not itself constitute an action confirming permission.
- D. Authorized notice is not a recognized consent model in privacy frameworks; it conflates authorization with notification.
Question 54
A BaaS provider backs up the corporate data and stores it in an outsider provider under contract with the organization. A researcher notifies the organization that he found unsecured data in the cloud. The organization looked into the issue and realized one of its backups was misconfigured on the outside provider's cloud and the data fully exposed to the open internet. They quickly secured the backup. Which is the best next step the organization should take?
Show answer and explanation
Correct answer: A. Review the content of the data exposed
After securing exposed data, the organization's first priority is to understand the scope and nature of the breach by reviewing what data was actually exposed. This assessment is critical for determining what notification obligations exist, whether personally identifiable information or sensitive data was compromised, and the potential impact on individuals. Understanding the exposed content directly informs all subsequent actions including notification requirements, regulatory reporting, and remediation strategies. While contract review and investigating alternate providers are important longer-term steps, they depend first on understanding the actual breach scope.
Why the other options are wrong
- B. While important for future accountability, contract review is a secondary step that follows understanding the breach scope and impact.
- C. Investigating how the researcher discovered the data is less critical than assessing what data was actually exposed and its sensitivity level.
- D. Evaluating alternative providers is a strategic decision that comes after incident response, root cause analysis, and understanding the breach scope.
Question 55
What can be used to determine the type of data in storage without exposing its contents?
Show answer and explanation
Correct answer: D. Metadata.
Metadata describes data about data, including its type, format, creation date, classification level, and other characteristics without revealing the actual content. By examining metadata, organizations can determine what types of data are in storage, such as personal information, financial records, or health data, without exposing or decrypting the contents themselves.
Why the other options are wrong
- A. Collection records document the gathering of data but do not specifically identify data types in storage.
- B. Data mapping shows the relationships between data elements but does not directly indicate the type of data without exposure.
- C. Server logs track system activities and access but do not inherently reveal what types of data are stored on the systems.
Question 56
Which of the following is a vulnerability of a sensitive biometrics authentication system?
Show answer and explanation
Correct answer: A. Theft of finely individualized personal data.
Biometric data represents finely individualized personal information that, once stolen, cannot be changed like a password and poses a significant privacy and security risk. The theft of biometric data is a fundamental vulnerability of biometric systems because it exposes highly sensitive, permanent personal identifiers. Slow recognition speeds (B) and false negatives/positives (C and D) are performance or accuracy issues, not vulnerabilities in the security or privacy sense.
Why the other options are wrong
- B. Slow recognition speeds are a performance limitation, not a security vulnerability.
- C. False negatives affect system accuracy and user experience but do not represent a privacy or security vulnerability.
- D. False positives affect system accuracy but are not inherently privacy or security vulnerabilities.
Question 57
Which of the following is NOT a step in the methodology of a privacy risk framework?
Show answer and explanation
Correct answer: D. Ranking
A privacy risk framework methodology includes assessment (identifying and analyzing risks), monitoring (ongoing observation of privacy risks), and response (taking action to mitigate identified risks). Ranking, while useful for prioritization, is not a distinct step in the core privacy risk framework methodology, instead, risk assessment and analysis inherently involve evaluating severity and likelihood to inform response priorities. The three fundamental operational steps are assessment, monitoring, and response.
Why the other options are wrong
- A. Assessment is a core step where privacy risks are identified and analyzed.
- B. Monitoring is a core step where privacy risks are continuously tracked and observed.
- C. Response is a core step where organizations take action to mitigate and manage identified privacy risks.
Question 58
During a transport layer security (TLS) session, what happens immediately after the web browser creates a random PreMasterSecret?
Show answer and explanation
Correct answer: C. The web browser encrypts the PremasterSecret with the server's public key.
During the TLS handshake, immediately after the client (web browser) generates the PreMasterSecret, it encrypts this value using the server's public key before sending it. This ensures that only the server, which possesses the corresponding private key, can decrypt the PreMasterSecret. Both client and server then use this shared secret to derive the session encryption keys through a key derivation function.
Why the other options are wrong
- A. The server decrypts the PreMasterSecret after receiving it, not immediately after the client creates it.
- B. A TLS connection is not opened to the PreMasterSecret; the PreMasterSecret is sent over the existing connection.
- D. The conversion of the PreMasterSecret into encryption keys happens after the server receives and decrypts it, not immediately upon creation.
Question 59
Which of the following is NOT a workplace surveillance best practice?
Show answer and explanation
Correct answer: B. Ensure surveillance is discreet so employees do not alter their behavior.
Ensuring surveillance is discreet so employees do not alter their behavior is NOT a best practice for workplace surveillance. Legitimate workplace surveillance requires transparency and employee awareness as fundamental ethical principles. Best practices demand that employees know they are being monitored, understand the scope and purpose of surveillance, and have the opportunity to comply knowingly with workplace policies. Covert surveillance that prevents behavioral adjustment violates privacy principles and undermines the trust necessary for ethical workplace monitoring.
Why the other options are wrong
- A. Checking local privacy laws before implementing surveillance is a critical best practice to ensure legal compliance.
- C. Limiting exposure of gathered surveillance content once collected is a best practice that protects employee privacy and prevents misuse of sensitive data.
- D. Performing only the minimal amount of surveillance necessary to meet objectives is a best practice that respects employee privacy and reduces unnecessary intrusion.
Question 60
Aadhaar is a unique-identity number of 12 digits issued to all Indian residents based on their biometric and demographic data. The data is collected by the Unique Identification Authority of India. The Aadhaar database contains the Aadhaar number, name, date of birth, gender and address of over 1 billion individuals. Which of the following datasets derived from that data would be considered the most de-identified?
Show answer and explanation
Correct answer: D. Account of the century of birth and hash of the last 3 digits of the person's Aadhaar number.
Century of birth is an extremely coarse generalisation that places almost everyone in one or two groups. The last three digits of a randomly assigned Aadhaar number have only 1,000 possible values and carry no real-world meaning, so their hash cannot be linked to a person. Together these attributes give the lowest re-identification risk of the options.
Why the other options are wrong
- A. Year of birth is a far finer quasi-identifier than century, and hashing gender is trivially reversible because it has so few possible values.
- B. Month of birth is finer than century, and a hashed first name can be reversed with a dictionary of common names, leaving a real identifier in the data.
- C. Day of birth is a detailed quasi-identifier, and a hashed first initial has only 26 possible values, so it is easily reversed.
Question 61
SCENARIO Tom looked forward to starting his new position with a U.S `"based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below. Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as-a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data. Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse. Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and West Company networks. Which statement is correct about addressing New Company stakeholders' expectations for privacy?
Show answer and explanation
Correct answer: B. New Company should manage stakeholder expectations for privacy even when the stakeholders' data is not held by New Company.
Privacy professionals must manage stakeholder expectations comprehensively, including situations where data transfers to third parties or leaves organizational control. Option B correctly recognizes that New Company's privacy commitment extends to data held by service providers and vendors, not just data within New Company's direct possession. This aligns with the scenario's discussion of SaaS reliance and third-party data protection concerns. Option A is incorrect because privacy policies are not typically read by most consumers, yet organizations must still protect privacy. Option C is insufficient because legal compliance alone does not meet stakeholder expectations, which often exceed minimum legal requirements. Option D is directly contradicted by modern privacy principles and the scenario's emphasis on third-party risks.
Why the other options are wrong
- A. Assuming consumers read privacy policies is unrealistic and does not address the actual management of privacy expectations.
- C. Legal compliance is a floor, not a ceiling for meeting stakeholder privacy expectations.
- D. Privacy obligations continue when data transfers to third parties, as highlighted by the SaaS threat discussion.
Question 62
SCENARIO Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them. You also recall a recent visit to the Records Storage Section, often termed `The Dungeon` in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage. Which data lifecycle phase needs the most attention at this Ontario medical center?
Show answer and explanation
Correct answer: A. Retention
The scenario describes extensive retention problems: unlabeled data tapes and drives, records stored without organization, data not incorporated into new systems, and unclear retention schedules for long-term studies. These represent failures in the retention phase of the data lifecycle. The medical center must establish retention schedules, determine when records should be securely destroyed, and ensure proper management of legacy data. Option B, disclosure, is not the primary concern as the focus is on stored data management. Option C, collection, is not problematic since the center successfully collects data for clinical and research purposes. Option D, use, is functioning adequately as evidenced by the interactive medical records system and ongoing studies.
Why the other options are wrong
- B. Disclosure concerns are secondary to the core issue of unmanaged data retention.
- C. Data collection processes appear functional; the problem is what happens after collection.
- D. Data use for clinical and research purposes is working; the problem is retention and disposal management.
Question 63
You are a wine collector who uses the web to do research about your hobby. You navigate to a news site and an ad for wine pops up. What kind of advertising is this?
Show answer and explanation
Correct answer: B. Behavioral.
The wine ad appears on a news site whose content has nothing to do with wine, so it was chosen from what the user did earlier, namely researching wine across the web. Targeting based on a profile of past browsing activity is behavioral advertising.
Why the other options are wrong
- A. Remnant advertising is unsold ad inventory sold cheaply at the last minute, which says nothing about why a wine ad was chosen for this user.
- C. Contextual advertising matches ads to the content of the current page, and a news page would not trigger a wine ad on its content alone.
- D. Demographic advertising targets traits such as age, gender or income, not a specific hobby shown by the user's browsing history.
Question 64
Which of the following is considered a client-side IT risk?
Show answer and explanation
Correct answer: C. An employee stores his personal information on his company laptop.
A client-side risk occurs on end-user devices rather than on organizational infrastructure. An employee storing personal information on a company laptop represents a client-side vulnerability because the sensitive data exists on an individual's client device. Security policies (A) and server applications (B) are organizational/server-side concerns, and option D describes a data mapping issue unrelated to client-side risk.
Why the other options are wrong
- A. Security policy focus is an organizational governance issue, not a client-side technical risk.
- B. Adding applications to servers is a server-side infrastructure change, not a client-side risk.
- D. ID-to-personal-data mapping is a database architecture issue, not a client device vulnerability.
Question 65
Which of the following is considered a records management best practice?
Show answer and explanation
Correct answer: D. Using classification to determine access rules and retention policy.
Using classification to determine access rules and retention policies is a cornerstone records management best practice. Classification establishes the sensitivity level of records, which then dictates who can access them and how long they must be retained, creating a systematic and legally compliant approach to managing all types of records.
Why the other options are wrong
- A. Archiving expired data is important but is a specific action rather than a comprehensive best practice framework.
- B. Storing decryption keys with backup systems is a security risk and violates best practices; keys should be stored separately from encrypted data.
- C. While consistency is valuable, applying identical handling practices across all record types ignores the fact that different records have different requirements based on their sensitivity and regulatory obligations.
Question 66
A user who owns a resource wants to give other individuals access to the resource. What control would apply?
Show answer and explanation
Correct answer: C. Discretionary access control.
Discretionary access control (DAC) allows resource owners to determine and grant access to their resources at their own discretion. This model gives individual users the ability to decide who can access their resources and what permissions they have. The scenario explicitly describes an owner wanting to give other individuals access, which is the defining characteristic of DAC.
Why the other options are wrong
- A. Mandatory access control is enforced by the system based on security labels and administrator policies, not by individual resource owners.
- B. Role-based access control grants permissions based on predefined job roles, not on individual owner discretion.
- D. Context of authority controls is not a standard access control model and does not describe owner-granted permissions.
Question 67
What distinguishes a "smart" device?
Show answer and explanation
Correct answer: D. It augments its intelligence with information from the internet.
A 'smart' device is distinguished by its ability to augment its intelligence with information from the internet. Smart devices leverage cloud connectivity and real-time data feeds to enhance their functionality beyond their local capabilities, such as smart thermostats using weather data or smart speakers using internet-connected services.
Why the other options are wrong
- A. Performing multiple data functions simultaneously is multitasking, not the distinguishing characteristic of a smart device.
- B. User programmability without specialized training describes accessible design, not the defining feature of smart devices.
- C. Reapplying access controls from internal memory is a security feature, not what makes a device 'smart'.
Question 68
SCENARIO Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: • First and last name • Date of birth (DOB) • Mailing address • Email address • Car VIN number • Car model • License plate • Insurance card number • Photo • Vehicle diagnostics • Geolocation What IT architecture would be most appropriate for this mobile platform?
Show answer and explanation
Correct answer: B. Client-server architecture.
Client-server architecture is most appropriate for this mobile insurance platform. The mobile app serves as the client, collecting data and capturing photos at the crash site, while the third-party hosting provider and EnsureClaim backend systems serve as the server infrastructure. This architecture naturally separates client-side data collection from server-side processing, storage, and sharing with claim adjusters, providing clear separation of concerns and scalability for managing distributed user access.
Why the other options are wrong
- A. Peer-to-peer architecture is unsuitable because it lacks centralized data storage and server-side processing needed for insurance claim management and adjuster access.
- C. Plug-in-based architecture is a development pattern rather than a deployment model appropriate for a mobile app requiring centralized data management.
- D. While service-oriented architecture could work, client-server architecture is more straightforward and conventionally appropriate for a mobile app with backend services.
Question 69
What Privacy by Design (PbD) element should include a de-identification or deletion plan?
Show answer and explanation
Correct answer: C. Retention.
The Retention element of Privacy by Design should include a de-identification or deletion plan. Retention policies define how long personal data is kept and what happens to it afterward. Effective retention planning includes specific provisions for securely deleting data when it is no longer needed or de-identifying it so it cannot be linked back to individuals. This ensures data is not retained indefinitely and addresses the privacy principle that data should not be kept longer than necessary.
Why the other options are wrong
- A. Categorization organizes data types and sensitivity levels but does not address what happens to data after its useful life.
- B. Remediation addresses correcting privacy breaches or issues; it is not where deletion and de-identification plans belong.
- D. Security addresses protecting data from unauthorized access and modification, not what to do with data at end-of-life.
Question 70
What is the potential advantage of homomorphic encryption?
Show answer and explanation
Correct answer: A. Encrypted information can be analyzed without decrypting it first.
The primary advantage of homomorphic encryption is that it allows computations to be performed on encrypted data without first decrypting it. This enables data analysis, searching, and processing while maintaining encryption throughout the operation, providing both security and functionality. The results of computations on encrypted data remain encrypted until decryption is performed by an authorized party.
Why the other options are wrong
- B. Homomorphic encryption typically increases ciphertext size as security levels increase, not decreases it.
- C. Homomorphic encryption generally results in slower processing times compared to unencrypted operations, not faster processing.
- D. While homomorphic encryption provides strong security, no encryption makes data truly impenetrable to all possible attacks.
Question 71
A vendor has been collecting data under an old contract, not aligned with the practices of the organization. Which is the preferred response?
Show answer and explanation
Correct answer: B. Update the contract to bring the vendor into alignment.
When a vendor's data collection practices are misaligned with organizational standards, the preferred response is to update the contract to bring the vendor into compliance with current practices. This approach maintains the business relationship while addressing the non-compliance issue and is more efficient than terminating and re-contracting. It demonstrates good vendor management by clarifying expectations and ensuring alignment with organizational data governance standards.
Why the other options are wrong
- A. Destroying data may not be practical if the data has legitimate business value, and it does not address the underlying vendor alignment issue.
- C. Continuing non-compliant practices until contract expiration unnecessarily prolongs exposure to misaligned data collection and violates governance principles.
- D. Terminating the contract and beginning vendor selection is more disruptive and expensive than updating the existing contract to achieve alignment.
Question 72
Organizations understand there are aggregation risks associated with the way the process their customer's data. They typically include the details of this aggregation risk in a privacy notice and ask that all customers acknowledge they understand these risks and consent to the processing. What type of risk response does this notice and consent represent?
Show answer and explanation
Correct answer: D. Risk acceptance.
When organizations disclose aggregation risks in privacy notices and obtain customer consent, they are accepting the risk rather than eliminating or reducing it. Risk acceptance means acknowledging the risk exists and proceeding with business practices despite that risk, with customer awareness. This is neither transferring liability, mitigating impact, nor avoiding the practice entirely.
Why the other options are wrong
- A. Risk transfer would involve shifting responsibility to another party via insurance or contracts.
- B. Risk mitigation would involve implementing controls to reduce the impact or likelihood of harm.
- C. Risk avoidance would mean not performing the aggregation or processing activities at all.
Question 73
What is the term for information provided to a social network by a member?
Show answer and explanation
Correct answer: B. Declared data.
Declared data is the specific term used in data privacy and social networking contexts to refer to information that a user voluntarily provides or declares to a social network platform. This includes profile information, preferences, and other details that members explicitly input themselves, distinguishing it from inferred or behavioral data collected through system observation.
Why the other options are wrong
- A. Profile data is too broad and doesn't specifically denote the action of declaration by the user.
- C. Personal choice data is not the standard terminology used in social networking and data classification frameworks.
- D. Identifier information refers to data used to identify individuals, not voluntarily provided user content.
Question 74
SCENARIO Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: • First and last name • Date of birth (DOB) • Mailing address • Email address • Car VIN number • Car model • License plate • Insurance card number • Photo • Vehicle diagnostics • Geolocation What would be the best way to supervise the third-party systems the EnsureClaim App will share data with?
Show answer and explanation
Correct answer: B. Conduct a security and privacy review before onboarding new vendors that collect personal data from the app.
The best way to supervise third-party systems is to conduct a comprehensive security and privacy review before onboarding new vendors that will collect or access personal data. This proactive approach ensures adequate controls are in place before any data sharing begins. While reviewing privacy notices (option A) is part of due diligence, a full security and privacy review is more thorough. Anonymizing all data (option C) is impractical for claims processing and eliminates the ability to track claims. Developing policies (option D) is necessary but doesn't constitute active supervision of third-party systems.
Why the other options are wrong
- A. Reviewing privacy notices alone is passive and insufficient; a comprehensive security review examines actual technical and operational controls.
- C. Anonymizing all personal data before sharing would make the claims process impossible, as claim adjusters need to identify and contact claimants.
- D. Developing internal policies addresses EnsureClaim's procedures but does not actively supervise or validate third-party security controls.
Question 75
What privacy risk is NOT mitigated by the use of encrypted computation to target and serve online ads?
Show answer and explanation
Correct answer: A. The ad being served to the user may not be relevant.
Encrypted computation enables ad targeting while keeping personal data encrypted from the server, thereby mitigating privacy risks related to sensitive information exposure and weak de-identification. However, encrypted computation does not address whether the resulting ad is relevant to the user, this is an advertising effectiveness issue, not a privacy risk that the technology can prevent. A user's sensitive information remaining secure doesn't guarantee ad relevance.
Why the other options are wrong
- B. Encrypted computation directly mitigates the risk of the user's sensitive information being used for ad targeting by keeping it encrypted.
- C. Encrypted computation specifically prevents the server from discerning personal information used to target ads.
- D. Encrypted computation mitigates the risk of information leakage through weak de-identification by avoiding de-identification altogether.
Question 76
SCENARIO Kyle is a new security compliance manager who will be responsible for coordinating and executing controls to ensure compliance with the company's information security policy and industry standards. Kyle is also new to the company, where collaboration is a core value. On his first day of new-hire orientation, Kyle's schedule included participating in meetings and observing work in the IT and compliance departments. Kyle spent the morning in the IT department, where the CIO welcomed him and explained that her department was responsible for IT governance. The CIO and Kyle engaged in a conversation about the importance of identifying meaningful IT governance metrics. Following their conversation, the CIO introduced Kyle to Ted and Barney. Ted is implementing a plan to encrypt data at the transportation level of the organization's wireless network. Kyle would need to get up to speed on the project and suggest ways to monitor effectiveness once the implementation was complete. Barney explained that his short-term goals are to establish rules governing where data can be placed and to minimize the use of offline data storage. Kyle spent the afternoon with Jill, a compliance specialist, and learned that she was exploring an initiative for a compliance program to follow self-regulatory privacy principles. Thanks to a recent internship, Kyle had some experience in this area and knew where Jill could find some support. Jill also shared results of the company's privacy risk assessment, noting that the secondary use of personal information was considered a high risk. By the end of the day, Kyle was very excited about his new job and his new company. In fact, he learned about an open position for someone with strong qualifications and experience with access privileges, project standards board approval processes, and application-level obligations, and couldn't wait to recommend his friend Ben who would be perfect for the job. Which data practice is Barney most likely focused on improving?
Show answer and explanation
Correct answer: C. Retention.
Barney's goals are to establish rules governing where data can be placed and minimize the use of offline data storage. These objectives directly address retention policy, determining how long data is kept and where it resides during that retention period. By establishing rules about data placement and reducing offline storage, Barney is controlling how data is retained across the organization's storage infrastructure. Deletion applies only after retention ends, inventory catalogs existing data, and sharing controls who accesses data, but none of these capture the focus on placement rules and storage minimization.
Why the other options are wrong
- A. Deletion occurs after the retention period expires, not before, and is not about placement rules.
- B. Inventory involves cataloging what data exists, not establishing rules about where data can be placed.
- D. Sharing controls access and distribution to other parties, not the internal placement and storage of retained data.
Question 77
Why is first-party web tracking very difficult to prevent?
Show answer and explanation
Correct answer: A. The available tools to block tracking would break most sites' functionality.
First-party web tracking is difficult to prevent because the same cookies and mechanisms used for legitimate functionality, such as remembering login sessions, shopping cart contents, and user preferences, are also used for tracking purposes. Blocking these tracking tools would simultaneously break essential website features that users depend on, creating a functionality versus privacy tradeoff.
Why the other options are wrong
- B. While some consumers appreciate targeted ads, this is not the primary reason prevention is difficult from a technical standpoint.
- C. Regulatory frameworks are increasingly concerned with web tracking, as evidenced by GDPR and similar regulations.
- D. Modern browsers increasingly support tracking blocking features, so this is not the primary obstacle.
Question 78
What risk is mitigated when routing video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?
Show answer and explanation
Correct answer: B. The user's identity is protected from the other user.
Routing video traffic through company application servers instead of peer-to-peer protects users' identities from each other because direct IP addresses are not exposed during communication. The server acts as an intermediary, masking one user's identity from the other. Option A is unrelated to routing architecture, option C addresses location data not identity, and option D concerns authentication methods which routing architecture doesn't guarantee.
Why the other options are wrong
- A. Routing architecture doesn't provide phishing protection.
- C. Physical location can still be derived from server logs or metadata.
- D. Routing through servers doesn't ensure or relate to authentication strength.
Question 79
How can a hacker gain control of a smartphone to perform remote audio and video surveillance?
Show answer and explanation
Correct answer: B. By installing a roving bug on the phone.
A roving bug is malicious software installed on a smartphone that enables remote audio and video surveillance by activating the device's microphone and camera without user knowledge or consent. This represents a direct and common method for attackers to achieve covert remote surveillance capabilities on mobile devices.
Why the other options are wrong
- A. Cross-site scripting targets web browsers and server-side applications, not smartphones, and does not provide direct access to device hardware like microphones and cameras.
- C. Geographic information systems are specialized mapping applications unrelated to smartphone surveillance capabilities.
- D. Accessing a phone's GPS satellite signal provides location data but does not enable audio or video surveillance capabilities.
Question 80
What would be an example of an organization transferring the risks associated with a data breach?
Show answer and explanation
Correct answer: C. Purchasing insurance to cover the organization in case of a breach.
Risk transfer moves the financial burden of a potential data breach to another party, typically an insurance company. Purchasing insurance explicitly transfers the risk of breach costs to the insurer. Using a third-party processor (A) may reduce operational risk but doesn't transfer breach liability; encryption (B) is a risk mitigation control; and applying industry standards (D) is risk reduction, not transfer.
Why the other options are wrong
- A. Outsourcing to a third party reduces operational burden but maintains organizational liability for data breaches.
- B. Encryption is a risk mitigation technique that reduces vulnerability, not a risk transfer mechanism.
- D. Following industry standards is a risk reduction strategy, not a transfer of risk to another party.
Question 81
Which is NOT a drawback to using a biometric recognition system?
Show answer and explanation
Correct answer: D. It is difficult for people to use.
Difficulty for people to use is not a drawback of modern biometric recognition systems. Contemporary biometric systems (fingerprint readers, facial recognition, iris scanners) are generally user-friendly and require minimal training or effort to operate. Users simply present their biometric identifier and authentication is quick and intuitive, making ease of use an advantage rather than a disadvantage.
Why the other options are wrong
- A. Biometric systems do require specialized maintenance, calibration, and technical support.
- B. Biometric authentication systems are typically more expensive than password-only or basic token systems.
- C. Biometric systems often have limited cross-platform compatibility, requiring specialized hardware and software integration.
That was 81 of 325.
The full IAPP CIPT pack has all 325 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 153 free as one PDF by email. Get the Half Pack →