Ivan is a nurse for a home healthcare service provider in the US. The company has implemented a mobile application which Ivan uses to record a patient's vital statistics and access a patient's health care records during home visits. During one visitj^van is unable to access the health care application to record the patient's vitals. He instead records the information on his mobile phone's note-taking application to enter the data in the health care application the next time it is accessible. What would be the best course of action by the IT department to ensure the data is protected on his device?

Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.

Provide all healthcare employees with mandatory annual security awareness training with a focus on the health information protection.

Complete a SWOT analysis exercise on the mobile application to identify what caused the application to be inaccessible and remediate any issues.

Adopt mobile platform standards to ensure that only mobile devices that support encryption capabilities are used.

Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.

Which activity best supports the principle of data quality from a privacy perspective?

Protecting the data against unauthorized changes.

Ensuring the data is classified.

Protecting the data against unauthorized access.

Ensuring the data is available for use.

Protecting the data against unauthorized changes.

An organization's customers have suffered a number of data breaches through successful social engineering attacks. One potential solution to remediate and prevent future occurrences would be to implement which of the following?

Attribute-based access control.

To meet data protection and privacy legal requirements that may require personal data to be disposed of or deleted when no longer necessary for the use it was collected, what is the best privacy-enhancing solution a privacy technologist should recommend be implemented in application design to meet this requirement?

Implement a process to delete personal data on demand and maintain records on deletion requests.

Implement automated deletion of off-site backup of personal data based on annual risk assessments.

Develop application logic to validate and purge personal data according to legal hold status or retention schedule.

Securely archive personal data not accessed or used in the last 6 months. Automate a quarterly review to delete data from archive once no longer needed.

An organization is reliant on temporary contractors for performing data analytics and they require access to personal data via software-as-a-service to perform their job. When the temporary contractor completes their work assignment, what woul^.be the most effective way to safeguard privacy and access to personal data when they leave?

Establish a predetermined automatic account expiration date based on contract timescales.

Set a system-based expiry that requires management reauthorization for online access for accounts that have been active more than 6 months.

Establish a predetermined automatic account expiration date based on contract timescales.

Require temporary contractors to sign a non-disclosure agreement, security acceptable use policy, and online access authorizations by hiring managers.

Mandate hiring managers to email IT or Security team when the contractor leaves.

Which of the following is a privacy consideration for NOT sending large-scale SPAM type emails to a database of email addresses?

Reduction in email deliverability score.

An organization has recently experienced a data breach where large amounts of personal data were compromised. As part of a post-incident review, the privacy technologist wants to analyze available data to understand what vulnerabilities may have contributed to the incident occurring. He learns that a key vulnerability had been flagged by the system but that detective controls were not operating effectively. Which type of web application security risk does this finding most likely point to?

Logging and Monitoring Failures.

Vulnerable and Outdated Components.

Logging and Monitoring Failures.

Data oriented strategies Include which of the following?

Minimize. Separate, Abstract, Hide.

Inform, Control, Enforce, Demonstrate.

Encryption, Hashing, Obfuscation, Randomization.

Consent. Contract, Legal Obligation, Legitimate interests.

There are two groups of users. In a company, where one group Is allowed to see credit card numbers, while the other group Is not. Both are accessing the data through the same application. The most effective and efficient way to achieve this would be?

Have the data encrypted at rest, and selectively decrypt It for the users who have the rights to see it.

Have two copies of the data, one copy where the credit card numbers are obfuscated, while the other copy has them in the clear. Serve up from the appropriate copy depending on the user accessing it.

Have the data encrypted at rest, and selectively decrypt It for the users who have the rights to see it.

Obfuscate the credit card numbers whenever a user who does not have the right to see them accesses the data.

Drop credit card numbers altogether whenever a user who does not have the right to see them accesses the data.

Which of the following is NOT a valid basis for data retention?

Last time the data was accessed.

SCENARIOPlease use the following to answer the next questions:Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub.This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:• "I consent to receive notifications and infection alerts";• "I consent to receive information on additional features or services, and new products";• "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";• "I consent to share my data for medical research purposes"; and• "I consent to share my data with healthcare providers affiliated to the company".For each choice, an ON* or OFF tab is available The default setting is ON for all Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:• Step 1 A photo of the user's face is taken.• Step 2 The user measures their temperature and adds the reading in the app• Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms• Step 4 The user is asked to answer questions on known symptoms• Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).) The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles What is likely to be the biggest privacy concern with the current 'Information Sharing and Consent' page?

The ON or OFF default setting for each item.

The navigation needed in the app to get to the consent page.

The option to consent to receive potential marketing information.

The information sharing with healthcare providers affiliated with the company.

SCENARIOPlease use the following to answer the next questions:Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub.This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:• "I consent to receive notifications and infection alerts";• "I consent to receive information on additional features or services, and new products";• "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";• "I consent to share my data for medical research purposes"; and• "I consent to share my data with healthcare providers affiliated to the company".For each choice, an ON* or OFF tab is available The default setting is ON for all Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:• Step 1 A photo of the user's face is taken.• Step 2 The user measures their temperature and adds the reading in the app• Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms• Step 4 The user is asked to answer questions on known symptoms• Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).)The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles Which of the following is likely to be the most important issue with the choices presented in the 'InformationSharing and Consent' pages?

The data and recipients for medical research are not specified

Insufficient information is provided on notifications and infection alerts

The sharing of information with an affiliated healthcare provider is too risky

Allowing users to share risk result information for exposure and contact tracing purposes

SCENARIOPlease use the following to answer the next questions:Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub.This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:• "I consent to receive notifications and infection alerts";• "I consent to receive information on additional features or services, and new products";• "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";• "I consent to share my data for medical research purposes"; and• "I consent to share my data with healthcare providers affiliated to the company".For each choice, an ON* or OFF tab is available The default setting is ON for all Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:• Step 1 A photo of the user's face is taken.• Step 2 The user measures their temperature and adds the reading in the app• Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms• Step 4 The user is asked to answer questions on known symptoms• Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).) The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles The location data collected and displayed on the map should be changed for which of the following reasons?

The location data is loo precise

The blurriness does not allow users to know how close they are to an infected person

The radius used for location data exceeds official social distancing rules

The location data has not been pseudonymized

The location data is loo precise

SCENARIOPlease use the following to answer the next questions:Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub.This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:• "I consent to receive notifications and infection alerts";• "I consent to receive information on additional features or services, and new products";• "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";• "I consent to share my data for medical research purposes"; and• "I consent to share my data with healthcare providers affiliated to the company".For each choice, an ON* or OFF tab is available The default setting is ON for all Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening service works as follows:• Step 1 A photo of the user's face is taken.• Step 2 The user measures their temperature and adds the reading in the app• Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms• Step 4 The user is asked to answer questions on known symptoms• Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).) The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles Which technology is best suited for the contact tracing feature of the app1?

Radio-Frequency Identification (RFID)

An organization needs to be able to manipulate highly sensitive personal information without revealing the contents of the data to the users. The organization should investigate the use of?

Advanced Encryption Standard (AES)

Which of these is considered an ethical dark pattern on privacy?

Rewarding users for providing more personal information

Using attractive designs to influence an individual.

Rewarding users for providing more personal information

Giving users more privacy options in relation to their personal information

Providing dear and simple privacy notices to users

What is the main privacy threat posed by Radio Frequency Identification (RFID)?

RFID can be utilized to track people or consumer products

RFID can be utilized to gam unauthorized access to an individual's device

RFID can be utilized to spoof identification details

RFID can be utilized to read information from a device without the user's knowledge

An organization is using new technologies that will target and process personal data of EU customers.In which of the following circumstances would a privacy technologist need to support a data protection impact assessment (DPIA)?

If data processing is a high risk to an individual's rights and freedoms

If a privacy notice and opt-m consent box are not displayed to the individual

If security of data processing has not been evaluated

If a large amount of personal data will be collected.

If data processing is a high risk to an individual's rights and freedoms

Which of the following activities would be considered the best method for an organization to achieve the privacy principle of data quality'?

Build a system with user access controls and approval workflows to edit customer data

Clash customer information with information from a data broker

Build a system with user access controls and approval workflows to edit customer data

Set a privacy notice covering the purpose for collection of a customer's data

Provide a customer with a copy of their data in a machine-readable format

What risk is mitigated when routing meeting video traffic through a company's application servers rather than sending the video traffic directly from one user to another?

The user's IP address is hidden from the other user

The user's identity is protected from the other user

The user is protected against cyberstalking attacks

The user's IP address is hidden from the other user

The user is assured that stronger authentication methods have been used

An organization is evaluating a number of Machine Learning (ML) solutions to help automate a customer-facing part of its business From a privacy perspective, the organization should first?

Define how data subjects may object to the processing

Define their goals for fairness

Document the distribution of bias scores

Document the False Positive Rates (FPR).

Define how data subjects may object to the processing

How does browser fingerprinting compromise privacy?

By differentiating users based upon parameters.

By creating a security vulnerability.

By differentiating users based upon parameters.

By persuading users to provide personal information.

By customizing advertising based on the geographic location.

IAPP CIPT Practice Test 5 - Free Online Exam Prep & Questions

When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?

Become a Premium Member for full access

Unlock Premium Member

IAPP CIPT Practice Test 5

Question

IAPP CIPT Practice Tests

Practice Tests