IAPP CIPT Practice Test - Questions Answers, Page 17
Question list
List of questions
Related questions
When designing a new system, which of the following is a privacy threat that the privacy technologist should consider?
Encryption.
Social distancing.
Social engineering.
Identity and Access Management.
Ivan is a nurse for a home healthcare service provider in the US. The company has implemented a mobile application which Ivan uses to record a patient's vital statistics and access a patient's health care records during home visits. During one visitj^van is unable to access the health care application to record the patient's vitals. He instead records the information on his mobile phone's note-taking application to enter the data in the health care application the next time it is accessible. What would be the best course of action by the IT department to ensure the data is protected on his device?
Provide all healthcare employees with mandatory annual security awareness training with a focus on the health information protection.
Complete a SWOT analysis exercise on the mobile application to identify what caused the application to be inaccessible and remediate any issues.
Adopt mobile platform standards to ensure that only mobile devices that support encryption capabilities are used.
Implement Mobile Device Management (MDM) to enforce company security policies and configuration settings.
Which activity best supports the principle of data quality from a privacy perspective?
Ensuring the data is classified.
Protecting the data against unauthorized access.
Ensuring the data is available for use.
Protecting the data against unauthorized changes.
Which of the following is one of the fundamental principles of information security?
Accountability.
Accessibility.
Confidentiality.
Connectivity.
An organization's customers have suffered a number of data breaches through successful social engineering attacks. One potential solution to remediate and prevent future occurrences would be to implement which of the following?
Differential identifiability.
Multi-factor authentication.
Greater password complexity.
Attribute-based access control.
An organization is launching a new online subscription-based publication. As the service is not aimed at children, users are asked for their date of birth as part of the of the sign-up process. The privacy technologist suggests it may be more appropriate ask if an individual is over 18 rather than requiring they provide a date of birth. What kind of threat is the privacy technologist concerned about?
Identification.
Insecurity.
Interference.
Minimization.
Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?
Identification.
Insecurity.
Aggregation.
Exclusion.
A clinical research organization is processing highly sensitive personal data, including numerical attributes, from medical trial results. The organization needs to manipulate the data without revealing the contents to data users. This can be achieved by utilizing?
k-anonymity.
Microdata sets.
Polymorphic encryption.
Homomorphic encryption.
To meet data protection and privacy legal requirements that may require personal data to be disposed of or deleted when no longer necessary for the use it was collected, what is the best privacy-enhancing solution a privacy technologist should recommend be implemented in application design to meet this requirement?
Implement a process to delete personal data on demand and maintain records on deletion requests.
Implement automated deletion of off-site backup of personal data based on annual risk assessments.
Develop application logic to validate and purge personal data according to legal hold status or retention schedule.
Securely archive personal data not accessed or used in the last 6 months. Automate a quarterly review to delete data from archive once no longer needed.
An organization is reliant on temporary contractors for performing data analytics and they require access to personal data via software-as-a-service to perform their job. When the temporary contractor completes their work assignment, what woul^.be the most effective way to safeguard privacy and access to personal data when they leave?
Set a system-based expiry that requires management reauthorization for online access for accounts that have been active more than 6 months.
Establish a predetermined automatic account expiration date based on contract timescales.
Require temporary contractors to sign a non-disclosure agreement, security acceptable use policy, and online access authorizations by hiring managers.
Mandate hiring managers to email IT or Security team when the contractor leaves.
Question