CIPA Data Security & Privacy Compliance 4 — Questions and Answers
Question 1: A CIPA practitioner reviews a vendor contract and notices it lacks specific data security requirements. Which contract provision should they insist be added?
- Indemnification clause
- Data Processing Agreement (DPA) with security obligations (Correct answer)
- Limitation of liability cap
- Automatic renewal clause
Correct answer: Data Processing Agreement (DPA) with security obligations
A Data Processing Agreement specifies how a vendor must handle personal data, including security controls, breach notification duties, and sub-processor restrictions.
Question 2: Which attack type specifically targets the session token after a user has already authenticated?
- Credential stuffing
- Phishing
- Session hijacking (Correct answer)
- Brute force
Correct answer: Session hijacking
Session hijacking exploits a valid session token—often stolen via XSS or network interception—to impersonate an authenticated user.
Question 3: Under COPPA, what age threshold defines a 'child' for whom parental consent is required before collecting personal information online?
- Under 13 (Correct answer)
- Under 16
- Under 18
- Under 21
Correct answer: Under 13
COPPA defines a child as any person under the age of 13, and operators of websites directed to children must obtain verifiable parental consent before collection.
Question 4: Which security control is specifically designed to detect and alert on unauthorized changes to critical system files?
- Intrusion Prevention System (IPS)
- File Integrity Monitoring (FIM) (Correct answer)
- Data Loss Prevention (DLP)
- Security Information and Event Management (SIEM)
Correct answer: File Integrity Monitoring (FIM)
File Integrity Monitoring continuously checks system files against a known baseline and alerts administrators when unauthorized changes are detected.
Question 5: A privacy officer receives a data subject access request (DSAR). Under GDPR, what is the standard response deadline?
- 7 calendar days
- 30 calendar days (Correct answer)
- 60 business days
- 90 calendar days
Correct answer: 30 calendar days
GDPR Article 12 requires controllers to respond to DSARs without undue delay and at the latest within one month (approximately 30 days) of receipt.
Question 6: An organization implements a process to systematically identify, assess, and treat privacy risks before launching a new product. This process is known as a:
- Business Impact Analysis (BIA)
- Privacy Impact Assessment (PIA) (Correct answer)
- Risk Register Update
- Threat Modeling Exercise
Correct answer: Privacy Impact Assessment (PIA)
A Privacy Impact Assessment evaluates how a new project or product collects, uses, and protects personal data before it goes live.
Question 7: Which encryption mode is generally recommended for encrypting large datasets at rest because it encrypts each block independently and parallelizes well?
- CBC (Cipher Block Chaining)
- ECB (Electronic Codebook)
- XTS-AES (Correct answer)
- CFB (Cipher Feedback)
Correct answer: XTS-AES
XTS-AES is specifically designed for disk encryption and storage, providing strong security for large datasets at rest without the pattern-leakage weaknesses of ECB.
CIPA Data Security & Privacy Compliance 4
A CIPA practitioner reviews a vendor contract and notices it lacks specific data security requirements.
Which contract provision should they insist be added?