CIPT Online Practice Questions and Answers

Organizations understand there are aggregation risks associated with the way the process their customer's data. They typically include the details of this aggregation risk in a privacy notice and ask that all customers acknowledge they

understand these risks and consent to the processing.

What type of risk response does this notice and consent represent?

A. Risk transfer.

B. Risk mitigation.

C. Risk avoidance.

D. Risk acceptance.

Why is first-party web tracking very difficult to prevent?

A. The available tools to block tracking would break most sites' functionality.

B. Consumers enjoy the many benefits they receive from targeted advertising.

C. Regulatory frameworks are not concerned with web tracking.

D. Most browsers do not support automatic blocking.

SCENARIO

Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.

You also recall a recent visit to the Records Storage Section, often termed "The Dungeon" in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.

Which cryptographic standard would be most appropriate for protecting patient credit card information in the records system?

A. Asymmetric Encryption

B. Symmetric Encryption

C. Obfuscation

D. Hashing

SCENARIO

You have just been hired by Ancillary.com, a seller of accessories for everything under the sun, including waterproof stickers for pool floats and decorative bands and cases for sunglasses. The company sells cell phone cases, e-cigarette

cases, wine spouts, hanging air fresheners for homes and automobiles, book ends, kitchen implements, visors and shields for computer screens, passport holders, gardening tools and lawn ornaments, and catalogs full of health and beauty

products. The list seems endless. As the CEO likes to say, Ancillary offers, without doubt, the widest assortment of low-price consumer products from a single company anywhere.

Ancillary's operations are similarly diverse. The company originated with a team of sales consultants selling home and beauty products at small parties in the homes of customers, and this base business is still thriving. However, the company

now sells online through retail sites designated for industries and demographics, sites such as "My Cool Ride" for automobile-related products or "Zoomer" for gear aimed toward young adults. The company organization includes a plethora of

divisions, units and outrigger operations, as Ancillary has been built along a decentered model rewarding individual initiative and flexibility, while also acquiring key assets. The retail sites seem to all function differently, and you wonder about

their compliance with regulations and industry standards. Providing tech support to these sites is also a challenge, partly due to a variety of logins and authentication protocols.

You have been asked to lead three important new projects at Ancillary:

The first is the personal data management and security component of a multi-faceted initiative to unify the company's culture. For this project, you are considering using a series of third- party servers to provide company data and approved

applications to employees.

The second project involves providing point of sales technology for the home sales force, allowing them to move beyond paper checks and manual credit card imprinting.

Finally, you are charged with developing privacy protections for a single web store housing all the company's product lines as well as products from affiliates. This new omnibus site will be known, aptly, as "Under the Sun." The Director of

Marketing wants the site not only to sell Ancillary's products, but to link to additional products from other retailers through paid advertisements. You need to brief the executive team of security concerns posed by this approach.

What technology is under consideration in the first project in this scenario?

A. Server driven controls.

B. Cloud computing

C. Data on demand

D. MAC filtering

Which of the following is most important to provide to the data subject before the collection phase of the data lifecycle?

A. Privacy Notice.

B. Disclosure Policy.

C. Consent Request.

D. Data Protection Policy.

What is typically NOT performed by sophisticated Access Management (AM) techniques?

A. Restricting access to data based on location.

B. Restricting access to data based on user role.

C. Preventing certain types of devices from accessing data.

D. Preventing data from being placed in unprotected storage.

In the realm of artificial intelligence, how has deep learning enabled greater implementation of machine learning?

A. By using hand-coded classifiers like edge detection filters so that a program can identify where an object starts and stops.

B. By increasing the size of neural networks and running massive amounts of data through the network to train it.

C. By using algorithmic approaches such as decision tree learning and inductive logic programming.

D. By hand coding software routines with a specific set of instructions to accomplish a task.

A company is implementing a new online application and the privacy technologist has advised about potential privacy implications. Who would most likely have final accountability if the recommendations made by the privacy technologist are implemented?

A. The Technology Owner.

B. The Privacy Legal Team.

C. The Risk (Business) Owner.

D. The Chief Information Security Officer.

One-way hash functions can be used is to?

A. Verify a password in a secure way.

B. Recover a credit card number at refund

C. Encrypt a document for confidentiality.

D. Secure an end-to-end communication.

What risk is mitigated when routing meeting video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?

A. The user's identity is protected from the other user

B. The user is protected against cyberstalking attacks

C. The user's IP address is hidden from the other user

D. The user is assured that stronger authentication methods have been used