Practice Test Geeks(CIPA) Certified Identity Protection Advisor Practice Test
← All CIPA Flashcard Decks

Data Security & Privacy Compliance Flashcards

7 cards from real CIPA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Data Security & Privacy Compliance flashcards as text

  1. A data breach notification under most US state laws must be sent to affected residents within a specific timeframe. What is the most commonly required window across US states?

    Answer: 30–90 days

    Most US state breach notification laws require notification to affected residents within 30 to 90 days of discovering the breach.

  2. Which concept ensures that a user or system is granted only the minimum level of access necessary to perform their job function?

    Answer: Principle of least privilege

    The principle of least privilege limits access rights to only what is strictly required for a user's role, reducing the attack surface.

  3. Under PCI DSS, what is the maximum number of days that audit logs must be retained?

    Answer: 1 year

    PCI DSS Requirement 10.7 mandates that audit logs be retained for at least one year, with three months immediately available for analysis.

  4. A company wants to share customer data with a marketing analytics vendor without exposing actual PII. Which technique replaces real data with fictional but realistic data?

    Answer: Data masking

    Data masking substitutes real PII with fictitious but realistic values, allowing analytics to proceed without exposing actual customer information.

  5. Which GDPR legal basis is most appropriate when a business processes personal data to fulfill a contract with the data subject?

    Answer: Contractual necessity

    GDPR Article 6(1)(b) allows processing without consent when it is necessary for the performance of a contract with the data subject.

  6. Under FERPA, which entity type is primarily responsible for protecting student education records?

    Answer: Educational institutions that receive federal funding

    FERPA applies to educational agencies and institutions that receive funds from the US Department of Education, making them the primary responsible parties.

  7. A company collects health data through a fitness app that is not covered by HIPAA. Which privacy framework or law is most likely to apply in the US?

    Answer: FTC Act Section 5 (unfair or deceptive practices)

    Non-HIPAA health apps fall under FTC jurisdiction; the FTC Act Section 5 prohibits unfair or deceptive acts, including mishandling health data.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. identitymanagementinstitute.org — Renewal, score validity, registration deadline, eligibility, fees, exam format, passing score, retake policy, test dates, test delivery · verified Oct 2026