IAPP CIPT Practice Test - Questions Answers, Page 10
Question list
List of questions
Related questions
Users of a web-based email service have their accounts breached through compromised login credentials. Which possible consequences of the breach illustrate the two categories of Calo's Harm Dimensions?
Financial loss and blackmail.
Financial loss and solicitation.
Identity theft and embarrassment.
Identity theft and the leaking of information.
Implementation of privacy controls for compliance with the requirements of the Children's Online Privacy Protection Act (COPPA) is necessary for all the following situations EXCEPT?
A virtual jigsaw puzzle game marketed for ages 5-9 displays pieces of the puzzle on a handheld screen. Once the child completes a certain level, it flashes a message about new themes released that day.
An interactive toy copies a child's behavior through gestures and kid-friendly sounds. It runs on battery power and automatically connects to a base station at home to charge itself.
A math tutoring service commissioned an advertisement on a bulletin board inside a charter school. The service makes it simple to reach out to tutors through a QR-code shaped like a cartoon character.
A note-taking application converts hard copies of kids' class notes into audio books in seconds. It does so by using the processing power of idle server farms.
Which of the following does NOT illustrate the 'respect to user privacy' principle?
Implementing privacy elements within the user interface that facilitate the use of technology by any visually-challenged users.
Enabling Data Subject Access Request (DSARs) that provide rights for correction, deletion, amendment and rectification of personal information.
Developing a consent management self-service portal that enables the data subjects to review the details of consent provided to an organization.
Filing breach notification paperwork with data protection authorities which detail the impact to data subjects.
Value Sensitive Design (VSD) focuses on which of the following?
Quality and benefit.
Ethics and morality.
Principles and standards.
Privacy and human rights.
SCENARIO
Looking back at your first two years as the Director of Personal Information Protection and Compliance for the St. Anne's Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on-hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.
You recall a recent visit to the Records Storage Section in the basement of the old hospital next to the modern facility, where you noticed paper records sitting in crates labeled by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. On the back shelves of the section sat data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the records storage section, you noticed a man leaving whom you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.
You quickly realize that you need a plan of action on the maintenance, secure storage and disposal of data.
Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system at St. Anne's Regional Medical Center?
Symmetric Encryption
Tokenization
Obfuscation
Certificates
A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account.
What would be the best recommendation to minimize the potential privacy risk from this weakness?
Implement a CAPTCHA system.
Develop server-side input validation checks.
Enforce strong password and account credentials.
Implement strong Transport Layer Security (TLS) to ensure an encrypted link.
Which of these actions is NOT generally part of the responsibility of an IT or software engineer?
Providing feedback on privacy policies.
Implementing multi-factor authentication.
Certifying compliance with security and privacy law.
Building privacy controls into the organization's IT systems or software.
Which of the following are the mandatory pieces of information to be included in the documentation of records of processing activities for an organization that processes personal data on behalf of another organization?
Copies of the consent forms from each data subject.
Time limits for erasure of different categories of data.
Contact details of the processor and Data Protection Offer (DPO).
Descriptions of the processing activities and relevant data subjects.
After downloading and loading a mobile app, the user is presented with an account registration page requesting the user to provide certain personal details. Two statements are also displayed on the same page along with a box for the user to check to indicate their confirmation:
Statement 1 reads: "Please check this box to confirm you have read and accept the terms and conditions of the end user license agreement" and includes a hyperlink to the terms and conditions.
Statement 2 reads: "Please check this box to confirm you have read and understood the privacy notice" and includes a hyperlink to the privacy notice.
Under the General Data Protection Regulation (GDPR), what lawful basis would you primarily except the privacy notice to refer to?
Consent.
Vital interests.
Legal obligation.
Legitimate interests.
Which of the following is the best method to minimize tracking through the use of cookies?
Use 'private browsing' mode and delete checked files, clear cookies and cache once a day.
Install a commercially available third-party application on top of the browser that is already installed.
Install and use a web browser that is advertised as 'built specifically to safeguard user privacy'.
Manage settings in the browser to limit the use of cookies and remove them once the session completes.
Question