CIPA Data Security & Privacy Compliance 4

Question 1

A CIPA practitioner reviews a vendor contract and notices it lacks specific data security requirements. Which contract provision should they insist be added?

Accepted Answer

Data Processing Agreement (DPA) with security obligations

Answer

A Data Processing Agreement specifies how a vendor must handle personal data, including security controls, breach notification duties, and sub-processor restrictions.

Question 2

Which attack type specifically targets the session token after a user has already authenticated?

Accepted Answer

Session hijacking

Answer

Session hijacking exploits a valid session token—often stolen via XSS or network interception—to impersonate an authenticated user.

Question 3

Under COPPA, what age threshold defines a 'child' for whom parental consent is required before collecting personal information online?

Accepted Answer

Under 13

Answer

COPPA defines a child as any person under the age of 13, and operators of websites directed to children must obtain verifiable parental consent before collection.

Question 4

Which security control is specifically designed to detect and alert on unauthorized changes to critical system files?

Accepted Answer

File Integrity Monitoring (FIM)

Answer

File Integrity Monitoring continuously checks system files against a known baseline and alerts administrators when unauthorized changes are detected.

Question 5

A privacy officer receives a data subject access request (DSAR). Under GDPR, what is the standard response deadline?

Accepted Answer

30 calendar days

Answer

GDPR Article 12 requires controllers to respond to DSARs without undue delay and at the latest within one month (approximately 30 days) of receipt.

(CIPA) Certified Identity Protection Advisor Practice Test

(CIPA) Certified Identity Protection Advisor Practice Test

CIPA Data Security & Privacy Compliance 4