CIPT practice questions 101–110

1. Question 101 · 284 in bank

   Which of the following is NOT relevant to a user exercising their data portability rights?

   • ANotice and consent for the downloading of data.
   • BDetection of phishing attacks against the portability interface.
   • CRe-authentication of an account, including two-factor authentication as appropriate.
   • DValidation of users with unauthenticated identifiers (e.g. IP address, physical address).

   Show answer

   Answer: B

   Next question

2. Question 102 · 284 in bank

   In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?

   • AIsolation.
   • BObfuscation.
   • CPerturbation.
   • DStripping.

   Show answer

   Answer: B

   Next question

3. Question 103 · 284 in bank

   An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls. Before implementation, a privacy technologist should conduct which of the following?

   • AA Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.
   • BA privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.
   • CA Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.
   • DA security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.

   Show answer

   Answer: C

   Next question

4. Question 104 · 284 in bank

   Which technique is most likely to facilitate the deletion of every instance of data associated with a deleted user account from every data store held by an organization?

   • AAuditing the code which deletes user accounts.
   • BBuilding a standardized and documented retention program for user data deletion.
   • CMonitoring each data store for presence of data associated with the deleted user account.
   • DTraining engineering teams on the importance of deleting user accounts their associated data from all data stores when requested.

   Show answer

   Answer: B

   Next question

5. Question 105 · 284 in bank

   Which of the following CANNOT be effectively determined during a code audit?

   • AWhether access control logic is recommended in all cases.
   • BWhether data is being incorrectly shared with a third-party.
   • CWhether consent is durably recorded in the case of a server crash.
   • DWhether the differential privacy implementation correctly anonymizes data.

   Show answer

   Answer: D

   Next question

6. Question 106 · 284 in bank

   An EU marketing company is planning to make use of personal data captured to make automated decisions based on profiling. In some cases, processing and automated decisions may have a legal effect on individuals, such as credit worthiness. When evaluating the implementation of systems making automated decisions, in which situation would the company have to accommodate an individual's right NOT to be subject to such processing to ensure compliance under the General Data Protection Regulation (GDPR)?

   • AWhen an individual's legal status or rights are not affected by the decision.
   • BWhen there is no human intervention or influence in the decision-making process.
   • CWhen the individual has given explicit consent to such processing and suitable safeguards exist.
   • DWhen the decision is necessary for entering into a contract and the individual can contest the decision.

   Show answer

   Answer: B

   Next question

7. Question 107 · 284 in bank

   SCENARIO - Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: ✑ First and last name ✑ Date of birth (DOB) ✑ Mailing address ✑ Email address ✑ Car VIN number ✑ Car model ✑ License plate ✑ Insurance card number ✑ Photo ✑ Vehicle diagnostics ✑ Geolocation The app is designed to collect and transmit geolocation data. How can data collection best be limited to the necessary minimum?

   • AAllow user to opt-out geolocation data collection at any time.
   • BAllow access and sharing of geolocation data only after an accident occurs.
   • CPresent a clear and explicit explanation about need for the geolocation data.
   • DObtain consent and capture geolocation data at all times after consent is received.

   Show answer

   Answer: B

   Next question

8. Question 108 · 284 in bank

   SCENARIO - Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: ✑ First and last name ✑ Date of birth (DOB) ✑ Mailing address ✑ Email address ✑ Car VIN number ✑ Car model ✑ License plate ✑ Insurance card number ✑ Photo ✑ Vehicle diagnostics ✑ Geolocation All of the following technical measures can be implemented by EnsureClaim to protect personal information that is accessible by third-parties EXCEPT?

   • AEncryption.
   • BAccess Controls.
   • CDe-identification.
   • DMulti-factor authentication.

   Show answer

   Answer: C

   Next question

9. Question 109 · 284 in bank

   SCENARIO - Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: ✑ First and last name ✑ Date of birth (DOB) ✑ Mailing address ✑ Email address ✑ Car VIN number ✑ Car model ✑ License plate ✑ Insurance card number ✑ Photo ✑ Vehicle diagnostics ✑ Geolocation What IT architecture would be most appropriate for this mobile platform?

   • APeer-to-peer architecture.
   • BClient-server architecture.
   • CPlug-in-based architecture.
   • DService-oriented architecture.

   Show answer

   Answer: D

   Next question

10. Question 110 · 284 in bank

    SCENARIO - Please use the following to answer next question: EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters. The app collects the following information: ✑ First and last name ✑ Date of birth (DOB) ✑ Mailing address ✑ Email address ✑ Car VIN number ✑ Car model ✑ License plate ✑ Insurance card number ✑ Photo ✑ Vehicle diagnostics ✑ Geolocation What would be the best way to supervise the third-party systems the EnsureClaim App will share data with?

    • AReview the privacy notices for each third-party that the app will share personal data with to determine adequate privacy and data protection controls are in place.
    • BConduct a security and privacy review before onboarding new vendors that collect personal data from the app.
    • CAnonymize all personal data collected by the app before sharing any data with third-parties.
    • DDevelop policies and procedures that outline how data is shared with third-party apps.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPT practice, question 101. 284 questions available.