CIPT sample questions

Question 1

Which of the following entities would most likely be exempt from complying with the General Data Protection Regulation (GDPR)?

Accepted Answer

A Chinese company that has opened a satellite office in a European Union (EU) member state to service European customers.

Answer

A South American company that regularly collects European customers’ personal data.

Answer

A company that stores all customer data in Australia and is headquartered in a European Union (EU) member state.

Answer

A North American company servicing customers in South Africa that uses a cloud storage system made by a European company.

Question 2

What is the main function of the Amnesic Incognito Live System or TAILS device?

Accepted Answer

It allows the user to run a self-contained computer from a USB device.

Answer

It accesses systems with a credential that leaves no discernable tracks.

Answer

It encrypts data stored on any computer on a network.

Answer

It causes a system to suspend its security protocols.

Question 3

You are a wine collector who uses the web to do research about your hobby. You navigate to a news site and an ad for wine pops up. What kind of advertising is this?

Accepted Answer

Behavioral.

Answer

Remnant.

Answer

Contextual.

Answer

Demographic.

Question 4

What is a main benefit of data aggregation?

Accepted Answer

It allows one to draw valid conclusions from small data samples.

Answer

It is a good way to perform analysis without needing a statistician.

Answer

It applies two or more layers of protection to a single data record.

Answer

It is a good way to achieve de-identification and unlinkabilty.

Question 5

A software development team is building a new application and wants to integrate privacy checks into their CI/CD pipeline. The goal is to automatically scan for potential privacy risks before code is deployed to production. Which of the following is an example of a practical, automated check that could be added to the pipeline to enforce privacy by design? ```mermaid flowchart TD A[Developer Commits Code] --> B{CI/CD Pipeline Triggered} B --> C[Build & Unit Tests] C --> D{Automated Privacy Scan} D -- No Issues --> E[Deploy to Staging] D -- Issues Found --> F[Fail Build & Notify Dev] E --> G[Manual QA] G --> H[Deploy to Production] ```

Accepted Answer

A static analysis rule that detects and flags new data fields being written to application logs.

Answer

A manual review of the privacy policy by the legal team.

Answer

A static analysis scan that flags the use of hardcoded secrets or API keys.

Answer

A dependency checker that verifies all third-party libraries have a published privacy policy.

Question 6

Which of the following became a foundation for privacy principles and practices of countries and organizations across the globe?

Accepted Answer

The Organization for Economic Co-operation and Development (OECD) Privacy Principles.

Answer

The Personal Data Ordinance.

Answer

The EU Data Protection Directive.

Answer

The Code of Fair Information Practices.

Question 7

Which of the following most embodies the principle of Data Protection by Default?

Accepted Answer

A website that has an opt-in form for marketing emails when registering to download a whitepaper.

Answer

A messaging app for high school students that uses HTTPS to communicate with the server.

Answer

An electronic teddy bear with built-in voice recognition that only responds to its owner's voice.

Answer

An internet forum for victims of domestic violence that allows anonymous posts without registration.

Question 8

How can a hacker gain control of a smartphone to perform remote audio and video surveillance?

Accepted Answer

By installing a roving bug on the phone.

Answer

By performing cross-site scripting.

Answer

By manipulating geographic information systems.

Answer

By accessing a phone's global positioning system satellite signal.

Question 9

Which is NOT a suitable action to apply to data when the retention period ends?

Accepted Answer

Deletion.

Answer

Aggregation.

Answer

De-identification.

Answer

Retagging.

Question 10

Based on the initial assessment and review of the available data flows, which of the following would be the most important privacy risk you should investigate first?

Accepted Answer

Evaluate and review the basis for processing employees’ personal data in the context of the prototype created by WebTracker and approved by the CEO.

Answer

Verify that WebTracker's HR and Payroll systems^hplement the current privacy notice (after the typos are fixed).

Answer

Review the list of subcontractors employed by AmaZure and ensure these are included in the formal agreement with WebTracker.

Answer

Confirm whether the data transfer from London to the USA has been fully approved by AmaZure and the appropriate institutions in the USA and the European Union.

CIPT Certified Information Privacy Technologist Practice Questions

Create an account to continue.

Create an account to continue.

Related exams