IAPP CIPT Exam Questions Instant Access - No Installation Required

Question 1

SCENARIO

Please use the following to answer the next questions:

Your company is launching a new track and trace health app during the outbreak of a virus pandemic in the US. The developers claim the app is based on privacy by design because personal data collected was considered to ensure only necessary data is captured, users are presented with a privacy notice, and they are asked to give consent before data is shared. Users can update their consent after logging into an account, through a dedicated privacy and consent hub. This is accessible through the 'Settings' icon from any app page, then clicking 'My Preferences', and selecting 'Information Sharing and Consent' where the following choices are displayed:

* "I consent to receive notifications and infection alerts";

* "I consent to receive information on additional features or services, and new products";

* "I consent to sharing only my risk result and location information, for exposure and contact tracing purposes";

* "I consent to share my data for medical research purposes"; and

* "I consent to share my data with healthcare providers affiliated to the company".

For each choice, an ON* or OFF tab is available The default setting is ON for all

Users purchase a virus screening service for USS29 99 for themselves or others using the app The virus screening

service works as follows:

* Step 1 A photo of the user's face is taken.

* Step 2 The user measures their temperature and adds the reading in the app

* Step 3 The user is asked to read sentences so that a voice analysis can detect symptoms

* Step 4 The user is asked to answer questions on known symptoms

* Step 5 The user can input information on family members (name date of birth, citizenship, home address, phone number, email and relationship).)

The results are displayed as one of the following risk status "Low. "Medium" or "High" if the user is deemed at "Medium " or "High" risk an alert may be sent to other users and the user is Invited to seek a medical consultation and diagnostic from a healthcare provider.

A user's risk status also feeds a world map for contact tracing purposes, where users are able to check if they have been or are in dose proximity of an infected person If a user has come in contact with another individual classified as "medium' or 'high' risk an instant notification also alerts the user of this. The app collects location trails of every user to monitor locations visited by an infected individual Location is collected using the phone's GPS functionary, whether the app is in use or not however, the exact location of the user is "blurred' for privacy reasons Users can only see on the map circles

What is likely to be the biggest privacy concern with the current 'Information Sharing and Consent' page?

AThe ON or OFF default setting for each item.

BThe navigation needed in the app to get to the consent page.

CThe option to consent to receive potential marketing information.

DThe information sharing with healthcare providers affiliated with the company.

Answer : A

The biggest privacy concern with the current 'Information Sharing and Consent' page is that all consent options are set to ON by default. According to privacy by design principles and data protection regulations, such as the General Data Protection Regulation (GDPR), consent should be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not constitute valid consent because they do not provide a clear affirmative action from the user. The default ON setting could lead to unintentional data sharing and potential privacy breaches, making this a significant concern. (Reference: IAPP CIPT Study Guide, Chapter on Privacy by Design and Default)

Question 2

Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?

AIdentification.

BInsecurity.

CAggregation.

DExclusion.

Answer : C

Aggregation involves the combination of various data points to create a more comprehensive profile or dataset that provides greater insight than the individual pieces alone. This technique can pose privacy risks because it may reveal patterns and personal information that were not apparent when the data points were viewed separately. This practice is often discussed in privacy and data protection contexts where it can lead to inadvertent breaches of privacy if not managed properly.

NIST Special Publication 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).

Question 3

What risk is mitigated when routing video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?

AThe user is protected against phishing attacks.

BThe user's identity is protected from the other user.

CThe user's approximate physical location is hidden from the other user.

DThe user is assured that stronger authentication methods have been used.

Answer : C

Option A: Phishing attacks are typically related to email or messaging security rather than direct video traffic.

Option B: While identity protection can be a factor, routing through company servers primarily obfuscates the user's IP address and other metadata, which reveals physical location rather than identity specifics.

Option C: Routing video traffic through a company's servers hides the users' IP addresses from each other, which prevents them from determining each other's physical location.

Option D: Stronger authentication methods are related to access control but not necessarily to the routing of video traffic.

IAPP CIPT Study Guide

Network security principles related to traffic routing

Question 4

Which of the following statements best describes the relationship between privacy and security?

ASecurity systems can be used to enforce compliance with privacy policies.

BPrivacy and security are independent; organizations must decide which should by emphasized.

CPrivacy restricts access to personal information; security regulates how information should be used.

DPrivacy protects data from being viewed during collection and security governs how collected data should be shared.

Answer : A

Security systems are essential for protecting data and ensuring that privacy policies are followed. Effective security measures can enforce access controls, encryption, and other protections that help maintain data confidentiality, integrity, and availability. By implementing robust security systems, organizations can ensure that personal information is handled according to privacy policies and regulatory requirements. The IAPP highlights that security is a foundational component for achieving privacy compliance.

IAPP Certification Textbooks, specifically the sections on the relationship between privacy and security.

'Privacy and Data Protection: An Integrated Approach,' IAPP White Paper.

Question 5

A vendor has been collecting data under an old contract, not aligned with the practices of the organization.

Which is the preferred response?

ADestroy the data

BUpdate the contract to bring the vendor into alignment.

CContinue the terms of the existing contract until it expires.

DTerminate the contract and begin a vendor selection process.

Answer : B

When a vendor collects data under an outdated contract that does not align with current organizational practices, the preferred response is to update the contract. This approach ensures that the vendor's data practices align with the current privacy standards and requirements of the organization, maintaining compliance and protecting data subjects. Terminating the contract or destroying the data may be extreme steps that could disrupt business operations or lead to data loss. Continuing the existing contract without any updates leaves the organization exposed to non-compliance risks.

Question 6

SCENARIO

WebTracker Limited is a cloud-based online marketing service located in London. Last year, WebTracker migrated its IT infrastructure to the cloud provider AmaZure, which provides SQL Databases and Artificial Intelligence services to WebTracker. The roles and responsibilities between the two companies have been formalized in a standard contract, which includes allocating the role of data controller to WebTracker.

The CEO of WebTracker, Mr. Bond, would like to assess the effectiveness of AmaZure's privacy controls, and he recently decided to hire you as an independent auditor. The scope of the engagement is limited only to the marketing services provided by WebTracker, you will not be evaluating any internal data processing activity, such as HR or Payroll.

This ad-hoc audit was triggered due to a future partnership between WebTracker and SmartHome --- a partnership that will not require any data sharing. SmartHome is based in the USA, and most recently has dedicated substantial resources to developing smart refrigerators that can suggest the recommended daily calorie intake based on DNA information. This and other personal data is collected by WebTracker.

To get an idea of the scope of work involved, you have decided to start reviewing the company's documentation and interviewing key staff to understand potential privacy risks.

The results of this initial work include the following notes:

There are several typos in the current privacy notice of WebTracker, and you were not able to find the privacy notice for SmartHome.

You were unable to identify all the sub-processors working for SmartHome. No subcontractor is indicated in the cloud agreement with AmaZure, which is responsible for the support and maintenance of the cloud infrastructure.

There are data flows representing personal data being collected from the internal employees of WebTracker, including an interface from the HR system.

Part of the DNA data collected by WebTracker was from employees, as this was a prototype approved by the CEO of WebTracker.

All the WebTracker and SmartHome customers are based in USA and Canada.

Based on the initial assessment and review of the available data flows, which of the following would be the most important privacy risk you should investigate first?

AVerify that WebTracker's HR and Payroll systems implement the current privacy notice (after the typos are fixed).

BReview the list of subcontractors employed by AmaZure and ensure these are included in the formal agreement with WebTracker.

CEvaluate and review the basis for processing employees' personal data in the context of the prototype created by WebTracker and approved by the CEO.

DConfirm whether the data transfer from London to the USA has been fully approved by AmaZure and the appropriate institutions in the USA and the European Union.

Answer : C

The most significant privacy risk identified in the scenario relates to the processing of employees' personal data, specifically DNA information, as part of a prototype approved by the CEO. This activity requires a careful assessment of the legal basis for processing such sensitive data, compliance with data protection principles, and ensuring adequate safeguards are in place. Given the sensitivity of DNA data and the potential impact on employees' privacy, this should be the first priority in the audit. Reference: IAPP Certification Textbooks, Section on Data Protection Impact Assessments (DPIAs) and Sensitive Data Processing.

Question 7

Aadhaar is a unique-identity number of 12 digits issued to all Indian residents based on their biometric and demographic data. The data is collected by the Unique Identification Authority of India. The Aadhaar database contains the Aadhaar number, name, date of birth, gender and address of over 1 billion individuals.

Which of the following datasets derived from that data would be considered the most de-identified?

AA count of the years of birth and hash of the person' s gender.

BA count of the month of birth and hash of the person's first name.

CA count of the day of birth and hash of the person's first initial of their first name.

DAccount of the century of birth and hash of the last 3 digits of the person's Aadhaar number.

Answer : A

A significant privacy concern with chatbots is related to the data they handle and how it is processed:

Option A: While code audits are important, this is not the most significant privacy concern for users.

Option B: Chatbots typically do not have robust identity verification mechanisms, but this is not the primary privacy issue.

Option C: Encryption in transit is crucial, but many modern chatbots do encrypt data during transmission.

Option D: Chatbot technology providers may be able to read chatbot conversations with users.

This is the most significant privacy concern because it involves the potential access and misuse of personal data by the service providers. The conversations can include sensitive information that users may not expect to be accessible to third parties.

IAPP Certified Information Privacy Technologist CIPT Exam Questions