Quiz IT certification exam

Question 1

What is the goal of privacy enhancing technologies (PETS) like multiparty computation and differential privacy?

Accepted Answer

To protect sensitive data while maintaining its utility.

Answer

To facilitate audits of third party vendors.

Answer

To standardize privacy activities across organizational groups.

Answer

To protect the security perimeter and the data items themselves.

Question 2

To comply with the Sarbanes-Oxley Act (SOX), public companies in the United States are required to annually report on the effectiveness of the auditing controls of their financial reporting systems.These controls must be implemented to prevent unauthorized use, disclosure, modification, and damage or loss of financial data.Why do these controls ensure both the privacy and security of data?

Accepted Answer

Disclosure of data is an aspect of privacy; unauthorized use, modification, and damage or loss of data are aspects of security.

Answer

Modification of data is an aspect of privacy; unauthorized use, disclosure, and damage or loss of data are aspects of security.

Answer

Unauthorized use of data is an aspect of privacy; disclosure, modification, and damage or loss of data are aspects of security.

Answer

Damage or loss of data are aspects of privacy; disclosure, unauthorized use, and modification of data are aspects of privacy.

Question 3

Which of the following entities would most likely be exempt from complying with the General Data Protection Regulation (GDPR)?

Accepted Answer

A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.

Answer

A South American company that regularly collects European customers' personal data.

Answer

A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.

Answer

A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

Question 4

SCENARIOWebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker.The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll.This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome — a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.The results of this initial work include the following notes:There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome.You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure.There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system.Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.All the WebTracker and SmartHome customers are based in USA and Canada.Based on the initial assessment and review of the available data flows, which of the following would be the most important privacy risk you should investigate first?

Accepted Answer

Confirm whether the data transfer from London to the USA has been fully approved by AmaZure and the appropriate institutions in the USA and the European Union.

Answer

Verify that WebTracker's HR and Payroll systems implement the current privacy notice (after the typos are fixed).

Answer

Review the list of subcontractors employed by AmaZure and ensure these are included in the formal agreement with WebTracker.

Answer

Evaluate and review the basis for processing employees' personal data in the context of the prototype created by WebTracker and approved by the CEO.

Question 5

SCENARIOWebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker.The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll.This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome — a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.The results of this initial work include the following notes:There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome.You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure.There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system.Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.All the WebTracker and SmartHome customers are based in USA and Canada.Which of the following issues is most likely to require an investigation by the Chief Privacy Officer (CPO) of WebTracker?

Accepted Answer

AmaZure sends newsletter to WebTracker customers, as approved by the Marketing Manager.

Answer

Data flows use encryption for data at rest, as defined by the IT manager.

Answer

Employees' personal data are being stored in a cloud HR system, as approved by the HR Manager.

Answer

File Integrity Monitoring is being deployed in SQL servers, as indicated by the IT Architect Manager.

Question 6

SCENARIOTom looked forward to starting his new position with a U.S —based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/threats) analysis for New Company. Their SWOT analysis conclusions are summarized below.Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-asa- service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and WestCompany networks.Which statement is correct about addressing New Company stakeholders' expectations for privacy?

Accepted Answer

New Company would best meet consumer expectations for privacy by adhering to legal requirements.

Answer

New Company should expect consumers to read the company's privacy policy.

Answer

New Company should manage stakeholder expectations for privacy even when the stakeholders' data is not held by New Company.

Answer

New Company's commitment to stakeholders ends when the stakeholders' data leaves New Company.

Question 7

SCENARIOTom looked forward to starting his new position with a U.S —based automobile leasing company (New Company), now operating in 32 states. New Company was recently formed through the merger of two prominent players, one from the eastern region (East Company) and one from the western region (West Company). Tom, a Certified Information Privacy Technologist (CIPT), is New Company's first Information Privacy and Security Officer. He met today with Dick from East Company, and Harry, from West Company. Dick and Harry are veteran senior information privacy and security professionals at their respective companies, and continue to lead the east and west divisions of New Company. The purpose of the meeting was to conduct a SWOT (strengths/weaknesses/opportunities/ threats) analysis for New Company. Their SWOT analysis conclusions are summarized below.Dick was enthusiastic about an opportunity for the New Company to reduce costs and increase computing power and flexibility through cloud services. East Company had been contemplating moving to the cloud, but West Company already had a vendor that was providing it with software-as- a-service (SaaS). Dick was looking forward to extending this service to the eastern region. Harry noted that this was a threat as well, because West Company had to rely on the third party to protect its data.Tom mentioned that neither of the legacy companies had sufficient data storage space to meet the projected growth of New Company, which he saw as a weakness. Tom stated that one of the team's first projects would be to construct a consolidated New Company data warehouse. Tom would personally lead this project and would be held accountable if information was modified during transmission to or during storage in the new data warehouse.Tom, Dick and Harry agreed that employee network access could be considered both a strength and a weakness. East Company and West Company had strong performance records in this regard; both had robust network access controls that were working as designed. However, during a projected year-long transition period, New Company employees would need to be able to connect to a New Company network while retaining access to the East Company and WestCompany networks.When employees are working remotely, they usually connect to a Wi-Fi network. What should Harry advise for maintaining company security in this situation?

Accepted Answer

Hiding wireless service set identifiers (SSID).

Answer

Retaining the password assigned by the network.

Answer

Employing Wired Equivalent Privacy (WEP) encryption.

Answer

Using tokens sent through HTTP sites to verify user identity.

Question 8

SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.Which regulation most likely applies to the data stored by Berry Country Regional Medical Center?

Accepted Answer

Personal Information Protection and Electronic Documents Act

Answer

Health Insurance Portability and Accountability Act

Answer

The Health Records Act 2001

Answer

The European Union Directive 95/46/EC

Question 9

SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.Which data lifecycle phase needs the most attention at this Ontario medical center?

Accepted Answer

Retention

Answer

Disclosure

Answer

Collection

Answer

Use

Question 10

SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system?

Accepted Answer

Symmetric Encryption

Answer

Asymmetric Encryption

Answer

Obfuscation

Answer

Hashing

Question 11

Users of a web-based email service have their accounts breached through compromised login credentials. Which possible consequences of the breach illustrate the two categories of Calo's Harm Dimensions?

Accepted Answer

Identity theft and the leaking of information.

Answer

Financial loss and blackmail.

Answer

Financial loss and solicitation.

Answer

Identity theft and embarrassment.

Question 12

Implementation of privacy controls for compliance with the requirements of the Children's Online Privacy Protection Act (COPPA) is necessary for all the following situations EXCEPT?

Accepted Answer

A virtual jigsaw puzzle game marketed for ages 5-9 displays pieces of the puzzle on a handheld screen. Once the child completes a certain level, it flashes a message about new themes released that day.

Answer

An interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.

Answer

A math tutoring service commissioned an advertisement on a bulletin board inside a charter school. The service makes it simple to reach out to tutors through a QR-code shaped like a cartoon character.

Answer

A note-taking application converts hard copies of kids' class notes into audio books in seconds. It does so by using the processing power of idle server farms.

Question 13

Which of the following does NOT illustrate the 'respect to user privacy' principle?

Accepted Answer

Filing breach notification paperwork with data protection authorities which detail the impact to data subjects.

Answer

Implementing privacy elements within the user interface that facilitate the use of technology by any visually-challenged users.

Answer

Enabling Data Subject Access Request (DSARs) that provide rights for correction, deletion, amendment and rectification of personal information.

Answer

Developing a consent management self-service portal that enables the data subjects to review the details of consent provided to an organization.

Question 14

Value Sensitive Design (VSD) focuses on which of the following?

Accepted Answer

Principles and standards.

Answer

Quality and benefit.

Answer

Ethics and morality.

Answer

Privacy and human rights.

Question 15

SCENARIOLooking back at your first two years as the Director of Personal Information Protection and Compliance for the St. Anne's Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on-hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.You recall a recent visit to the Records Storage Section in the basement of the old hospital next to the modern facility, where you noticed paper records sitting in crates labeled by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. On the back shelves of the section sat data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the records storage section, you noticed a man leaving whom you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.You quickly realize that you need a plan of action on the maintenance, secure storage and disposal of data.Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system at St. Anne's Regional Medical Center?

Accepted Answer

Tokenization

Answer

Symmetric Encryption

Answer

Obfuscation

Answer

Certificates

Question 16

A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account.What would be the best recommendation to minimize the potential privacy risk from this weakness?

Accepted Answer

Develop server-side input validation checks.

Answer

Implement a CAPTCHA system.

Answer

Enforce strong password and account credentials.

Answer

Implement strong Transport Layer Security (TLS) to ensure an encrypted link.

Question 17

Which of these actions is NOT generally part of the responsibility of an IT or software engineer?

Accepted Answer

Providing feedback on privacy policies.

Answer

Implementing multi-factor authentication.

Answer

Certifying compliance with security and privacy law.

Answer

Building privacy controls into the organization's IT systems or software.

Question 18

Which of the following are the mandatory pieces of information to be included in the documentation of records of processing activities for an organization that processes personal data on behalf of another organization?

Accepted Answer

Time limits for erasure of different categories of data.

Answer

Copies of the consent forms from each data subject.

Answer

Contact details of the processor and Data Protection Offer (DPO).

Answer

Descriptions of the processing activities and relevant data subjects.

Question 19

After downloading and loading a mobile app, the user is presented with an account registration page requesting the user to provide certain personal details. Two statements are also displayed on the same page along with a box for the user to check to indicate their confirmation:Statement 1 reads: "Please check this box to confirm you have read and accept the terms and conditions of the end user license agreement" and includes a hyperlink to the terms and conditions.Statement 2 reads: "Please check this box to confirm you have read and understood the privacy notice" and includes a hyperlink to the privacy notice.Under the General Data Protection Regulation (GDPR), what lawful basis would you primarily except the privacy notice to refer to?

Accepted Answer

Consent.

Answer

Vital interests.

Answer

Legal obligation.

Answer

Legitimate interests.

Question 20

Which of the following is the best method to minimize tracking through the use of cookies?

Accepted Answer

Manage settings in the browser to limit the use of cookies and remove them once the session completes.

Answer

Use 'private browsing' mode and delete checked files, clear cookies and cache once a day.

Answer

Install a commercially available third-party application on top of the browser that is already installed.

Answer

Install and use a web browser that is advertised as 'built specifically to safeguard user privacy'.

Question 21

Which of the following is NOT relevant to a user exercising their data portability rights?

Accepted Answer

Validation of users with unauthenticated identifiers (e.g. IP address, physical address).

Answer

Notice and consent for the downloading of data.

Answer

Detection of phishing attacks against the portability interface.

Answer

Re-authentication of an account, including two-factor authentication as appropriate.

Question 22

In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?

Accepted Answer

Obfuscation.

Answer

Isolation.

Answer

Perturbation.

Answer

Stripping.

Question 23

An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls.Before implementation, a privacy technologist should conduct which of the following?

Accepted Answer

A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.

Answer

A Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.

Answer

A privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.

Answer

A security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.

Question 24

Which technique is most likely to facilitate the deletion of every instance of data associated with a deleted user account from every data store held by an organization?

Accepted Answer

Monitoring each data store for presence of data associated with the deleted user account.

Answer

Auditing the code which deletes user accounts.

Answer

Building a standardized and documented retention program for user data deletion.

Answer

Training engineering teams on the importance of deleting user accounts their associated data from all data stores when requested.

Question 25

Which of the following CANNOT be effectively determined during a code audit?

Accepted Answer

Whether the differential privacy implementation correctly anonymizes data.

Answer

Whether access control logic is recommended in all cases.

Answer

Whether data is being incorrectly shared with a third-party.

Answer

Whether consent is durably recorded in the case of a server crash.

Question 26

An EU marketing company is planning to make use of personal data captured to make automated decisions based on profiling. In some cases, processing and automated decisions may have a legal effect on individuals, such as credit worthiness.When evaluating the implementation of systems making automated decisions, in which situation would the company have to accommodate an individual's right NOT to be subject to such processing to ensure compliance under the GeneralData Protection Regulation (GDPR)?

Accepted Answer

When there is no human intervention or influence in the decision-making process.

Answer

When an individual's legal status or rights are not affected by the decision.

Answer

When the individual has given explicit consent to such processing and suitable safeguards exist.

Answer

When the decision is necessary for entering into a contract and the individual can contest the decision.

Question 27

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationThe app is designed to collect and transmit geolocation data. How can data collection best be limited to the necessary minimum?

Accepted Answer

Present a clear and explicit explanation about need for the geolocation data.

Answer

Allow user to opt-out geolocation data collection at any time.

Answer

Allow access and sharing of geolocation data only after an accident occurs.

Answer

Question 28

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationAll of the following technical measures can be implemented by EnsureClaim to protect personal information that is accessible by third-parties EXCEPT?

Accepted Answer

Access Controls.

Answer

Encryption.

Answer

De-identification.

Answer

Multi-factor authentication.

Question 29

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationWhat IT architecture would be most appropriate for this mobile platform?

Accepted Answer

Service-oriented architecture.

Answer

Peer-to-peer architecture.

Answer

Client-server architecture.

Answer

Plug-in-based architecture.

Question 30

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationWhat would be the best way to supervise the third-party systems the EnsureClaim App will share data with?

Accepted Answer

Conduct a security and privacy review before onboarding new vendors that collect personal data from the app.

Answer

Review the privacy notices for each third-party that the app will share personal data with to determine adequate privacy and data protection controls are in place.

Answer

Anonymize all personal data collected by the app before sharing any data with third-parties.

Answer

Develop policies and procedures that outline how data is shared with third-party apps.

Question 31

What is the main privacy threat posed by Radio Frequency Identification (RFID)?

Accepted Answer

An individual can tap mobile phone communications.

Answer

An individual with an RFID receiver can track people or consumer products.

Answer

An individual can scramble computer transmissions in weapons systems.

Answer

An individual can use an RFID receiver to engage in video surveillance.

Question 32

SCENARIOPlease use the following to answer the next question:Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office.The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction.On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.What should Finley Motors have done to incorporate the transparency principle of Privacy by Design (PbD)?

Accepted Answer

Provided notice of data sharing practices within the electronically signed rental agreement.

Answer

Signed a data sharing agreement with AMP Payment Resources.

Answer

Documented that Finley Motors has a legitimate interest to share Chuck's information.

Answer

Obtained verbal consent from Chuck and recorded it within internal systems.

Question 33

SCENARIOPlease use the following to answer the next question:Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office.The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction.On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.What is the most secure method Finley Motors should use to transmit Chuck's information to AMP Payment Resources?

Accepted Answer

Transport Layer Security (TLS).

Answer

Cloud file transfer services.

Answer

Certificate Authority (CA).

Answer

HyperText Transfer Protocol (HTTP).

Question 34

SCENARIOPlease use the following to answer the next question:Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office.The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction.On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.How can Finley Motors reduce the risk associated with transferring Chuck's personal information to AMP Payment Resources?

Accepted Answer

By providing only the minimum necessary data to process the violation notice and masking all other information prior to transfer.

Answer

By requesting AMP Payment Resources delete unnecessary datasets and only utilize what is necessary to process the violation notice.

Answer

By obfuscating the minimum necessary data to process the violation notice and require AMP Payment Resources to secure store the personal information.

Answer

By transferring all information to separate datafiles and requiring AMP Payment Resources to combine the datasets during processing of the violation notice.

Question 35

SCENARIOPlease use the following to answer the next question:Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office.The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction.On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file.Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine.After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental.What is the strongest method for authenticating Chuck's identity prior to allowing access to his violation information through the AMP Payment Resources web portal?

Accepted Answer

By requiring Chuck use the last 4 digits of his driver's license number in combination with a unique PIN provided within the violation notice.

Answer

By requiring Chuck use his credit card number in combination with the last 4 digits of his driver's license.

Answer

By requiring Chuck use the rental agreement number in combination with his email address.

Answer

By requiring Chuck to call AMP Payment Resources directly and provide his date of birth and home address.

Question 36

Which of the following statements best describes the relationship between privacy and security?

Accepted Answer

Privacy restricts access to personal information; security regulates how information should be used.

Answer

Security systems can be used to enforce compliance with privacy policies.

Answer

Privacy and security are independent; organizations must decide which should by emphasized.

Answer

Privacy protects data from being viewed during collection and security governs how collected data should be shared.

Question 37

SCENARIOPlease use the following to answer the next question:Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user's region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences.Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any "offering goods or services" in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no "offering" from the company.The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step-tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company's servers in order to be processed, and then the results are sent to the smartphone or computer. Jordan argues that there is no personal information involved since the company does not collect banking or social security information.Why is Jordan's claim that the company does not collect personal information as identified by the GDPR inaccurate?

Accepted Answer

The fitness trackers capture sleep and heart rate data to monitor an individual's behavior.

Answer

The potential customers must browse for products online.

Answer

The website collects the customers' and users' region and country information.

Answer

The customers must pair their fitness trackers to either smartphones or computers.

Question 38

SCENARIOPlease use the following to answer the next question:Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user's region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences.Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any "offering goods or services" in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no "offering" from the company.The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step-tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company's servers in order to be processed, and then the results are sent to the smartphone or computer. Jordan argues that there is no personal information involved since the company does not collect banking or social security information.Based on the current features of the fitness watch, what would you recommend be implemented into each device in order to most effectively ensure privacy?

Accepted Answer

Randomized MAC address.

Answer

Hashing.

Answer

A2DP Bluetooth profile.

Answer

Persistent unique identifier.

Question 39

Which of the following statements is true regarding software notifications and agreements?

Accepted Answer

It is a good practice to provide users with information about privacy prior to software installation.

Answer

Website visitors must view the site's privacy statement before downloading software.

Answer

Software agreements are designed to be brief, while notifications provide more details.

Answer

"Just in time" software agreement notifications provide users with a final opportunity to modify the agreement.

Question 40

What is typically NOT performed by sophisticated Access Management (AM) techniques?

Accepted Answer

Restricting access to data based on user role.

Answer

Restricting access to data based on location.

Answer

Preventing certain types of devices from accessing data.

Answer

Preventing data from being placed in unprotected storage.

IAPP CIPT Practice Test 3

IAPP CIPT Practice Tests

IAPP CIPT Practice Test 3

Question

IAPP CIPT Practice Tests

Practice Tests