CIPA Data Security & Privacy Compliance 3

Question 1

A data breach notification under most US state laws must be sent to affected residents within a specific timeframe. What is the most commonly required window across US states?

Accepted Answer

30–90 days

Answer

Most US state breach notification laws require notification to affected residents within 30 to 90 days of discovering the breach.

Question 2

Which concept ensures that a user or system is granted only the minimum level of access necessary to perform their job function?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege limits access rights to only what is strictly required for a user's role, reducing the attack surface.

Question 3

Under PCI DSS, what is the maximum number of days that audit logs must be retained?

Accepted Answer

1 year

Answer

PCI DSS Requirement 10.7 mandates that audit logs be retained for at least one year, with three months immediately available for analysis.

Question 4

A company wants to share customer data with a marketing analytics vendor without exposing actual PII. Which technique replaces real data with fictional but realistic data?

Accepted Answer

Data masking

Answer

Data masking substitutes real PII with fictitious but realistic values, allowing analytics to proceed without exposing actual customer information.

Question 5

Which GDPR legal basis is most appropriate when a business processes personal data to fulfill a contract with the data subject?

Accepted Answer

Contractual necessity

Answer

GDPR Article 6(1)(b) allows processing without consent when it is necessary for the performance of a contract with the data subject.

(CIPA) Certified Identity Protection Advisor Practice Test

(CIPA) Certified Identity Protection Advisor Practice Test

CIPA Data Security & Privacy Compliance 3