A privacy engineer reviews a newly developed on-line registration page on a company's website. The purpose of the page is to enable corporate customers to submit a returns / refund request for physical goods. The page displays the following data capture fields: company name, account reference, company address, contact name, email address, contact phone number, product name, quantity, issue description and company bank account details.After her review, the privacy engineer recommends setting certain capture fields as "nonmandatory".Setting which of the following fields as "non-mandatory" would be the best example of the principle of data minimization?

The contact phone number field.

The contact name and email address.

The company bank account detail field.

Which of the following would be the best method of ensuring that Information Technology projects follow Privacy by Design (PbD) principles?

Develop training programs that aid the developers in understanding how to turn privacy requirements into actionable code and design level specifications.

Develop a technical privacy framework that integrates with the development lifecycle.

Utilize Privacy Enhancing Technologies (PETs) as a part of product risk assessment and management.

Identify the privacy requirements as a part of the Privacy Impact Assessment (PIA) process during development and evaluation stages.

Develop training programs that aid the developers in understanding how to turn privacy requirements into actionable code and design level specifications.

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app.The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.What is the best way to ensure that the application only collects personal data that is needed to fulfill its primary purpose of providing potential medical and healthcare recommendations?

Document each personal category collected by the app and ensure it maps to an app function or feature.

Obtain consent before using personal health information for data analytics purposes.

Provide the user with an option to select which personal data the application may collect.

Disclose what personal data the application the collecting in the company Privacy Policy posted online.

Document each personal category collected by the app and ensure it maps to an app function or feature.

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app.The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.The Privacy Team is conducting a Privacy Impact Assessment (PIA) for the new Light Blue Health application currently in development. Which of the following best describes a risk that is likely to result in a privacy breach?

Not encrypting the health record when it is transferred to the Light Blue Health servers.

Limiting access to the app to authorized personnel.

Including non-transparent policies, terms and conditions in the app.

Insufficiently deleting personal data after an account reaches its retention period.

Not encrypting the health record when it is transferred to the Light Blue Health servers.

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app.The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.Regarding the app, which action is an example of a decisional interference violation?

The app asks income level to determine the treatment of care.

The app sells aggregated data to an advertising company without prior consent.

The app has a pop-up ad requesting sign-up for a pharmaceutical company newsletter.

The app asks questions during account set-up to disclose family medical history that is not necessary for the treatment of the individual's symptoms.

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app.The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.What is the best way to minimize the risk of an exposure violation through the use of the app?

Dissociate the patient health data from the personal data.

Prevent the downloading of photos stored in the app.

Dissociate the patient health data from the personal data.

Exclude the collection of personal information from the health record.

Create a policy to prevent combining data with external data sources.

When should code audits be concluded?

Before launch after all code for a feature is complete.

While code is being sent to production.

Before launch after all code for a feature is complete.

Which of the following functionalities can meet some of the General Data Protection Regulation's (GDPR's) Data Portability requirements for a social networking app designed for users in the EU?

Allow users to download the content they have provided the app.

Allow users to modify the data they provided the app.

Allow users to delete the content they provided the app.

Allow users to download the content they have provided the app.

Allow users to get a time-stamped list of what they have provided the app.

Which of the following is the least effective privacy preserving practice in the Systems Development Life Cycle (SDLC)?

Developing data flow modeling to identify sources and destinations of sensitive data.

Conducting privacy threat modeling for the use-case.

Following secure and privacy coding standards in the development.

Developing data flow modeling to identify sources and destinations of sensitive data.

Reviewing the code against Open Web Application Security Project (OWASP) Top 10 Security Risks.

Between November 30th and December 2nd, 2013, cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent against such an attack.Which of the following would best explain why the retailer's consumer data was still exfiltrated?

The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.

The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.

The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.

The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailer's system.

The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.

When analyzing user data, how is differential privacy applied?

By injecting noise into aggregated datasets.

By assessing differences between datasets.

By applying asymmetric encryption to datasets.

By removing personal identifiers from datasets.

What privacy risk is NOT mitigated by the use of encrypted computation to target and serve online ads?

The user's information can be leaked to an advertiser through weak de-identification techniques.

The ad being served to the user may not be relevant.

The user's sensitive personal information is used to display targeted ads.

The personal information used to target ads can be discerned by the server.

The user's information can be leaked to an advertiser through weak de-identification techniques.

Which of the following modes of interaction often target both people who personally know and are strangers to the attacker?

Consensually-shared sexual imagery.

What logs should an application server retain in order to prevent phishing attacks while minimizing data retention?

Limited-retention, de-identified logs including the links clicked in messages as well as metadata.

Limited-retention, de-identified logs including only metadata.

Limited-retention, de-identified logs including the links clicked in messages as well as metadata.

Limited-retention logs including the identity of parties sending and receiving messages as well as metadata.

Limited-retention logs including the links clicked in messages, the identity of parties sending and receiving them, as well as metadata.

Which of the following would be the most appropriate solution for preventing privacy violations related to information exposure through an error message?

Creating default error pages or error messages which do not include variable data.

Configuring the environment to use shorter error messages.

Handing exceptions internally and not displaying errors to the user.

Creating default error pages or error messages which do not include variable data.

Logging the session name and necessary parameters once the error occurs to enable trouble shooting.

In day to day interactions with technology, consumers are presented with privacy choices. Which of the following best represents the Privacy by Design (PbD) methodology of letting the user choose a non-zero-sum choice?

Providing plain-language design choices that elicit privacy-related responses, helping users avoid errors and minimize the negative consequences of errors when they do occur.

Using images, words, and contexts to elicit positive feelings that result in proactive behavior, thus eliminating negativity and biases.

Providing plain-language design choices that elicit privacy-related responses, helping users avoid errors and minimize the negative consequences of errors when they do occur.

Displaying the percentage of users that chose a particular option, thus enabling the user to choose the most preferred option.

Using contexts, antecedent events, and other priming concepts to assist the user in making a better privacy choice.

What risk is mitigated when routing video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?

The user's identity is protected from the other user.

The user is protected against phishing attacks.

The user's identity is protected from the other user.

The user's approximate physical location is hidden from the other user.

The user is assured that stronger authentication methods have been used.

Which is likely to reduce the types of access controls needed within an organization?

Increased number of remote employees.

What is an Access Control List?

A list showing the resources that an individual has permission to access.

A list of steps necessary for an individual to access a resource.

A list that indicates the type of permission granted to each individual.

A list showing the resources that an individual has permission to access.

A list of individuals who have had their access privileges to a resource revoked.

Which of the following is an example of drone "swarming"?

Drones communicating with each other to perform a search and rescue.

A drone filming a cyclist from above as he rides.

A drone flying over a building site to gather data.

Drones delivering retailers' packages to private homes.

Drones communicating with each other to perform a search and rescue.

What is the most effective first step to take to operationalize Privacy by Design principles in new product development and projects?

Obtain leadership buy-in for a mandatory privacy review and approval process.

Implementing a mandatory privacy review and legal approval process.

Obtain leadership buy-in for a mandatory privacy review and approval process.

Set up an online Privacy Impact Assessment tool to facilitate Privacy by Design compliance.

Conduct annual Privacy by Design training and refreshers for all impacted personnel.

Which of the following would be an example of an "objective" privacy harm to an individual?

Receiving spam following the sale an of email address.

Negative feelings derived from government surveillance.

Social media profile views indicating unexpected interest in a person.

An organization must terminate their cloud vendor agreement immediately. What is the most secure way to delete the encrypted data stored in the cloud?

Destroy all encryption keys associated with the data.

Transfer the data to another location.

Invoke the appropriate deletion clause in the cloud terms and conditions.

Obtain a destruction certificate from the cloud vendor.

Destroy all encryption keys associated with the data.

A BaaS provider backs up the corporate data and stores it in an outsider provider under contract with the organization. A researcher notifies the organization that he found unsecured data in the cloud.The organization looked into the issue and realized $ne of its backups was misconfigured on the outside provider's cloud and the data fully exposed to the open internet. They quickly secured the backup. Which is the best next step the organization should take?

Review its contract with the outside provider.

Review the content of the data exposed.

Review its contract with the outside provider.

Investigate how the researcher discovered the unsecured data.

Investigate using alternate BaaS providers or on-premise backup systems.

When writing security policies, the most important consideration is to?

Ensure they are based on the organization's risk profile.

Require all employees to read and acknowledge their understanding.

Ensure they are based on the organization's risk profile.

Ensure they cover enough details for common situations.

Follow industry best practices.

Which activity should the privacy technologist undertake to reduce potential privacy risk when evaluating options to process data in a country other than where it would be collected?^

Recommend controls for data transfers.

Review data retention policies.

Create enterprise data flow diagrams.

Recommend controls for data transfers.

Information classification helps an organization protect confidential and nonpublic information primarily because?

It helps identify sensitive and critical information that require very strict safeguards.

It falls under the security principles of confidentiality, integrity, and availability.

It promotes employee accountability for safeguarding confidential information.

It is legally required under most regulations.

IAPP CIPT Practice Test 4 - Free Online Exam Questions 121-160

Properly configured databases and well-written website codes are the best protection against what online threat?

Become a Premium Member for full access

Unlock Premium Member

IAPP CIPT Practice Test 4

Question

IAPP CIPT Practice Tests

Practice Tests