IAPP CIPT Exam Dumps

How should the sharing of information within an organization be documented?

What risk is mitigated when routing video traffic through a company’s application servers,rather than sending the video traffic directly from one user to another?

During a transport layer security (TLS) session, what happens immediately after the webbrowser creates a random PreMasterSecret?

 SCENARIOCarol was a U.S.-based glassmaker who sold her work at art festivals. She kept things simple by only accepting cash and personal checks.As business grew, Carol couldn't keep up with demand, and traveling to festivals became burdensome. Carol opened a small boutique and hired Sam to run it while she worked in the studio. Sam was a natural salesperson, and business doubled. Carol told Sam, “I don'tknow what you are doing, but keep doing it!"But months later, the gift shop was in chaos. Carol realized that Sam needed help so she hired Jane, who had business expertise and could handle the back-office tasks. Sam would continue to focus on sales. Carol gave Jane a few weeks to get acquainted with the artisancraft business, and then scheduled a meeting for the three of them to discuss Jane's first impressions.At the meeting, Carol could not wait to hear Jane's thoughts, but she was unprepared for what Jane had to say. “Carol, I know that he doesn't realize it, but some of Sam’s efforts to increase sales have put you in a vulnerable position. You are not protecting customers’personal information like you should.”Sam said, “I am protecting our information. I keep it in the safe with our bank deposit. It's only a list of customers’ names, addresses and phone numbers that I get from their checks before I deposit them. I contact them when you finish a piece that I think they would like.That's the only information I have! The only other thing I do is post photos and information about your work on the photo sharing site that I use with family and friends. I provide my email address and people send me their information if they want to see more of your work.Posting online really helps sales, Carol. In fact, the only complaint I hear is about having to come into the shop to make a purchase.”Carol replied, “Jane, that doesn’t sound so bad. Could you just fix things and help us to post even more online?"‘I can," said Jane. “But it's not quite that simple. I need to set up a new program to make sure that we follow the best practices in data management. And I am concerned for our customers. They should be able to manage how we use their personal information. Wealso should develop a social media strategy.”Sam and Jane worked hard during the following year. One of the decisions they made was to contract with an outside vendor to manage online sales. At the end of the year, Carol shared some exciting news. “Sam and Jane, you have done such a great job that one ofthe biggest names in the glass business wants to buy us out! And Jane, they want to talk to you about merging all of our customer and vendor information with theirs beforehand."When initially collecting personal information from customers, what should Jane be guided by?

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing caraccident insurance claims. Individuals use the app to take pictures at the crash site,eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hostingprovider to store data collected by the app. EnsureClaim customer service employees alsoreceive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationWhat IT architecture would be most appropriate for this mobile platform?

What must be used in conjunction with disk encryption?

Which of the following are the mandatory pieces of information to be included in thedocumentation of records of processing activities for an organization that processespersonal data on behalf of another organization?

SCENARIOYou have just been hired by Ancillary.com, a seller of accessories for everything under thesun, including waterproof stickers for pool floats and decorative bands and cases forsunglasses. The company sells cell phone cases, e-cigarette cases, wine spouts, hangingair fresheners for homes and automobiles, book ends, kitchen implements, visors andshields for computer screens, passport holders, gardening tools and lawn ornaments, andcatalogs full of health and beauty products. The list seems endless. As the CEO likes tosay, Ancillary offers, without doubt, the widest assortment of low-price consumer productsfrom a single company anywhere.Ancillary's operations are similarly diverse. The company originated with a team of salesconsultants selling home and beauty products at small parties in the homes of customers,and this base business is still thriving. However, the company now sells online throughretail sites designated for industries and demographics, sites such as “My Cool Ride" forautomobile-related products or “Zoomer” for gear aimed toward young adults. Thecompany organization includes a plethora of divisions, units and outrigger operations, asAncillary has been built along a decentered model rewarding individual initiative andflexibility, while also acquiring key assets. The retail sites seem to all function differently,and you wonder about their compliance with regulations and industry standards. Providingtech support to these sites is also a challenge, partly due to a variety of logins andauthentication protocols.You have been asked to lead three important new projects at Ancillary:The first is the personal data management and security component of a multi-facetedinitiative to unify the company’s culture. For this project, you are considering using a seriesof third- party servers to provide company data and approved applications to employees.The second project involves providing point of sales technology for the home sales force,allowing them to move beyond paper checks and manual credit card imprinting.Finally, you are charged with developing privacy protections for a single web store housingall the company’s product lines as well as products from affiliates. This new omnibus sitewill be known, aptly, as “Under the Sun.” The Director of Marketing wants the site not onlyto sell Ancillary’s products, but to link to additional products from other retailers throughpaid advertisements. You need to brief the executive team of security concerns posed bythis approach.Which should be used to allow the home sales force to accept payments usingsmartphones?

In order to prevent others from identifying an individual within a data set, privacy engineersuse a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates theprivacy tactic known as what?

Which of the following entities would most likely be exempt from complying with theGeneral Data Protection Regulation (GDPR)?

SCENARIOKyle is a new security compliance manager who will be responsible for coordinating andexecuting controls to ensure compliance with the company's information security policy andindustry standards. Kyle is also new to the company, where collaboration is a core value.On his first day of new-hire orientation, Kyle's schedule included participating in meetingsand observing work in the IT and compliance departments.Kyle spent the morning in the IT department, where the CIO welcomed him and explainedthat her department was responsible for IT governance. The CIO and Kyle engaged in aconversation about the importance of identifying meaningful IT governance metrics.Following their conversation, the CIO introduced Kyle to Ted and Barney. Ted isimplementing a plan to encrypt data at the transportation level of the organization'swireless network. Kyle would need to get up to speed on the project and suggest ways tomonitor effectiveness once the implementation was complete. Barney explained that hisshort-term goals are to establish rules governing where data can be placed and to minimizethe use of offline data storage.Kyle spent the afternoon with Jill, a compliance specialist, and learned that she wasexploring an initiative for a compliance program to follow self-regulatory privacy principles.Thanks to a recent internship, Kyle had some experience in this area and knew where Jillcould find some support. Jill also shared results of the company’s privacy risk assessment,noting that the secondary use of personal information was considered a high risk.By the end of the day, Kyle was very excited about his new job and his new company. Infact, he learned about an open position for someone with strong qualifications andexperience with access privileges, project standards board approval processes, andapplication-level obligations, and couldn’t wait to recommend his friend Ben who would beperfect for the job.Ted's implementation is most likely a response to what incident?

Which of the following suggests the greatest degree of transparency?

What is the term for information provided to a social network by a member?

What tactic does pharming use to achieve its goal?

SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing caraccident insurance claims. Individuals use the app to take pictures at the crash site,eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hostingprovider to store data collected by the app. EnsureClaim customer service employees alsoreceive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationWhat would be the best way to supervise the third-party systems the EnsureClaim App willshare data with?

Which is the most accurate type of biometrics?

Which of the following most embodies the principle of Data Protection by Default? 

SCENARIOYou have just been hired by Ancillary.com, a seller of accessories for everything under thesun, including waterproof stickers for pool floats and decorative bands and cases forsunglasses. The company sells cell phone cases, e-cigarette cases, wine spouts, hangingair fresheners for homes and automobiles, book ends, kitchen implements, visors andshields for computer screens, passport holders, gardening tools and lawn ornaments, andcatalogs full of health and beauty products. The list seems endless. As the CEO likes tosay, Ancillary offers, without doubt, the widest assortment of low-price consumer productsfrom a single company anywhere.Ancillary's operations are similarly diverse. The company originated with a team of salesconsultants selling home and beauty products at small parties in the homes of customers,and this base business is still thriving. However, the company now sells online throughretail sites designated for industries and demographics, sites such as “My Cool Ride" forautomobile-related products or “Zoomer” for gear aimed toward young adults. Thecompany organization includes a plethora of divisions, units and outrigger operations, asAncillary has been built along a decentered model rewarding individual initiative andflexibility, while also acquiring key assets. The retail sites seem to all function differently,and you wonder about their compliance with regulations and industry standards. Providingtech support to these sites is also a challenge, partly due to a variety of logins andauthentication protocols.You have been asked to lead three important new projects at Ancillary:The first is the personal data management and security component of a multi-facetedinitiative to unify the company’s culture. For this project, you are considering using a seriesof third- party servers to provide company data and approved applications to employees.The second project involves providing point of sales technology for the home sales force,allowing them to move beyond paper checks and manual credit card imprinting.Finally, you are charged with developing privacy protections for a single web store housingall the company’s product lines as well as products from affiliates. This new omnibus sitewill be known, aptly, as “Under the Sun.” The Director of Marketing wants the site not onlyto sell Ancillary’s products, but to link to additional products from other retailers throughpaid advertisements. You need to brief the executive team of security concerns posed bythis approach.What technology is under consideration in the first project in this scenario?

Which is NOT a drawback to using a biometric recognition system?

A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account.What would be the best recommendation to minimize the potential privacy risk from this weakness?

A company seeking to hire engineers in Silicon Valley ran an ad campaign targetingwomen in a specific age range who live in the San Francisco Bay Area.Which Calo objective privacy harm is likely to result from this campaign?

What is typically NOT performed by sophisticated Access Management (AM) techniques?

What is the main benefit of using a private cloud?

Which is NOT a suitable method for assuring the quality of data collected by a third-partycompany?

Which of these actions is NOT generally part of the responsibility of an IT or softwareengineer?