Free Certified Information Privacy Technologist (CIPT) practice test: 30 questions with answers

Collecting only what the feature needs, and only when it is needed, is the minimization step in this scenario. Encrypting precise location still collects too much, and keeping it for marketing or collecting it silently adds risk without serving the feature.

Dropping fields the service does not use and deleting data once its purpose has ended both reduce the amount of personal data held. Indefinite retention and extra tracking increase the data held without a stated need, which runs against minimization.

Purpose limitation requires that data collected for one stated purpose is not reused for an incompatible one without a legal basis and notice. Accuracy, portability and breach notification are real concerns but do not describe the reuse problem in this scenario.

Differential privacy adds calibrated noise to query results so that the presence of any one person has a limited effect on the output. Tokenization and encryption protect stored values but do not perturb released statistics, and unsalted hashing of email addresses can be reversed by guessing common addresses.

Sharing de-identified data under an agreement that forbids re-identification limits what the partner can learn and do with it. A full table, production credentials and public release each expose identifiable data well beyond what the study requires.

A processor acts on the controller's instructions, and the contract, such as a GDPR Article 28 data processing agreement, defines security, confidentiality and sub-processing duties. Ownership is not transferred, privacy notices are still needed, and the processor cannot reuse the data for its own purposes without taking on controller duties.

Intrusion covers unwanted disturbances that interrupt a person's life, such as unsolicited night-time alerts. Re-identification, exclusion and aggregation describe other privacy problems that do not centre on unwanted disruption.

Decisional interference occurs when data-driven influence shapes a person's decisions about their own life, as the steering here does. Unauthorized disclosure, unwanted contact and aggregation describe different risks, since the app is neither leaking data nor contacting anyone.

Fingerprinting builds an identifier from the combination of device and browser characteristics, which allows tracking without storing anything on the device. Session fixation and cross-site request forgery are attacks, and certificate pinning is a control, so none of them describes identifying visitors.

Measuring what leaves the app when tracking is off confirms whether the SDK matches its documented behaviour before any remedy is chosen. Asking the vendor, updating the notice or removing the SDK are later steps that depend on that evidence.

Linking data from many city systems can expose where people go and when, which is a serious profiling risk. Battery life, staff training and Wi-Fi coverage are operational concerns and do not describe a privacy harm.

Assessments evaluate how likely and how harmful problematic data actions are, and they start from documented data flows and processing purposes. Release scheduling and revenue forecasting are business planning tasks that do not measure privacy risk.

A technical control enforces the requirement without depending on individual behaviour, so automated retention rules that purge data at the end of its purpose are the right translation. A policy alone relies on manual compliance, an annual legal review changes no system, and a queryable archive keeps the data and still breaches the requirement.

Containment comes first, and the access logs must be preserved so the team can determine who read the data. Deleting the bucket destroys evidence needed for the investigation, notifying customers before the facts are known is premature, and waiting for a quarterly review delays containment of an active exposure.

Individual participation gives people the right to access and correct their data, which is the core of this principle. Data quality concerns keeping data accurate, use limitation restricts how data is reused, and security safeguards protect data from unauthorized access, so none of those is mainly about visibility and control for the individual.

Identify-P is the function that builds understanding of data processing and the privacy risk it creates for individuals. Govern-P sets organizational policies and oversight, Communicate-P covers transparency and awareness, and Protect-P covers the safeguards applied to data processing.

The central ethical issue is that the company draws sensitive conclusions people never shared and acts on them, which goes beyond what they would reasonably expect. Accuracy, storage and portability matter too, but they are secondary to the fairness and expectations concern.

Translating a legal requirement into product behaviour, such as recording consent and honouring withdrawal, is the technologist's core task. Choosing the legal basis and interpreting the law belong to counsel, and approving campaigns is a marketing governance decision rather than a technical one.

NISTIR 8062 defines predictability, manageability and disassociability as privacy engineering objectives that complement security goals. Availability, integrity and confidentiality form the security triad, while the other sets describe ethics or general system qualities.

Data flow mapping records where personal data is collected, stored, used and shared, which gives engineers and reviewers the picture needed for privacy controls. Login testing, press releases and verbose logging do not reveal the data lifecycle, and verbose logging can itself create new exposure.

The privacy office sets enterprise policy and standards and runs organization-wide awareness training. Writing consent code and choosing database engines are engineering tasks that the privacy office may advise on but does not normally own.

Secure multi-party computation lets parties jointly compute a result while keeping their inputs private from each other. Shared spreadsheets expose raw records, disk encryption protects stored data only, and sequential numbers are weak pseudonymization that does not hide inputs from the other party.

Attaching classification and retention metadata to data lets downstream systems enforce deletion without manual steps. Manual checklists, more storage and per-record approval do not automate enforcement and in some cases keep data longer.

LINDDUN is a privacy threat modeling method whose categories include linkability, identifiability and unawareness. STRIDE targets security threats, OCTAVE is a risk assessment method and ISO/IEC 27005 is a security risk management standard, so none is privacy-focused threat modeling.

Privacy as the default is one of the seven principles, meaning personal data is protected without any action by the individual. The other options describe practices the principles reject, such as maximal retention, notices written after launch and opt-out consent for sensitive data.

Privacy by design favours protective defaults and placing controls where users need them, since most people do not change defaults. Keeping the sharing default with more text, removing the setting and forcing policy reading all leave the burden on users.

Pre-checked boxes that opt users into sharing rely on inaction rather than a clear choice, which is a dark pattern that undermines consent. Layered notices, accurate toggle labels and just-in-time prompts support informed choices rather than undermining them.

The proactive, preventive principle anticipates privacy risks and prevents them before harm occurs, rather than fixing them after a breach. Maximal collection, post-breach notice and regulator-only controls are reactive or contrary to the principle.

The usability test revealed a gap in understanding, so the fix is clearer wording validated with real users. Legal approval, footnotes that people skip and a blanket agreement checkbox do not close the gap in understanding.

Task-based testing with representative users shows whether people understand the choice and what they expect it to do, before release. Developer sign-off, reading documents aloud and post-launch page views do not measure whether users understand the choice.