IAPP CIPT Practice Test - Questions Answers, Page 14
Question list
List of questions
Related questions
A company configures their information system to have the following capabilities:
Allow for selective disclosure of attributes to certain parties, but not to others.
Permit the sharing of attribute references instead of attribute values - such as "I am over 21" instead of birthday date.
Allow for information to be altered or deleted as needed.
These capabilities help to achieve which privacy engineering objective?
Predictability.
Manageability.
Disassociability.
Integrity.
Which of the following functionalities can meet some of the General Data Protection Regulation's (GDPR's) Data Portability requirements for a social networking app designed for users in the EU?
Allow users to modify the data they provided the app.
Allow users to delete the content they provided the app.
Allow users to download the content they have provided the app.
Allow users to get a time-stamped list of what they have provided the app.
Which of the following is the least effective privacy preserving practice in the Systems Development Life Cycle (SDLC)?
Conducting privacy threat modeling for the use-case.
Following secure and privacy coding standards in the development.
Developing data flow modeling to identify sources and destinations of sensitive data.
Reviewing the code against Open Web Application Security Project (OWASP) Top 10 Security Risks.
Between November 30th and December 2nd, 2013, cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent against such an attack.
Which of the following would best explain why the retailer's consumer data was still exfiltrated?
The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.
The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.
The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailer's system.
The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.
When analyzing user data, how is differential privacy applied?
By injecting noise into aggregated datasets.
By assessing differences between datasets.
By applying asymmetric encryption to datasets.
By removing personal identifiers from datasets.
What privacy risk is NOT mitigated by the use of encrypted computation to target and serve online ads?
The ad being served to the user may not be relevant.
The user's sensitive personal information is used to display targeted ads.
The personal information used to target ads can be discerned by the server.
The user's information can be leaked to an advertiser through weak de-identification techniques.
A company seeking to hire engineers in Silicon Valley ran an ad campaign targeting women in a specific age range who live in the San Francisco Bay Area.
Which Calo objective privacy harm is likely to result from this campaign?
Lost opportunity.
Economic loss.
Loss of liberty.
Social detriment.
Which of the following modes of interaction often target both people who personally know and are strangers to the attacker?
Spam.
Phishing.
Unsolicited sexual imagery.
Consensually-shared sexual imagery.
What logs should an application server retain in order to prevent phishing attacks while minimizing data retention?
Limited-retention, de-identified logs including only metadata.
Limited-retention, de-identified logs including the links clicked in messages as well as metadata.
Limited-retention logs including the identity of parties sending and receiving messages as well as metadata.
Limited-retention logs including the links clicked in messages, the identity of parties sending and receiving them, as well as metadata.
Which of the following would be the most appropriate solution for preventing privacy violations related to information exposure through an error message?
Configuring the environment to use shorter error messages.
Handing exceptions internally and not displaying errors to the user.
Creating default error pages or error messages which do not include variable data.
Logging the session name and necessary parameters once the error occurs to enable trouble shooting.
Question