CIPT Identity, Access Management, and Authentication for Privacy 2

Question 1

Which privacy-enhancing identity technique allows a user to prove they meet a requirement (e.g., age over 18) without revealing their actual attribute value?

Accepted Answer

Zero-knowledge proof

Answer

Digital certificate

Answer

SAML assertion

Answer

OAuth access token

Question 2

What is the difference between 'authentication' and 'authorization' in the context of personal data access?

Accepted Answer

Authentication verifies who you are; authorization determines what you are permitted to access

Answer

Authentication grants access; authorization verifies identity

Answer

They are interchangeable terms for the same process

Answer

Authorization verifies identity using biometrics; authentication uses passwords

Question 3

A company uses attribute-based access control (ABAC) to restrict access to medical records. What makes ABAC more privacy-protective than simple RBAC?

Accepted Answer

ABAC can incorporate contextual attributes (time, location, data sensitivity) for finer-grained, purpose-aware access decisions

Answer

ABAC requires no user training

Answer

ABAC eliminates the need for encryption

Answer

ABAC automatically deletes access logs after 30 days

Question 4

What is an 'access log' used for from a privacy accountability perspective?

Accepted Answer

Creating an auditable record of who accessed personal data, when, and from where

Answer

Blocking unauthorized users in real time

Answer

Encrypting data transfers between systems

Answer

Measuring application performance

Question 5

Which federated identity standard is widely used for delegating authorization to third-party applications without sharing user credentials?

Accepted Answer

OAuth 2.0

Answer

SAML 1.1

Answer

Kerberos

Answer

LDAP

Question 6

A healthcare organization conducts quarterly 'access reviews' where managers certify which employees need continued access to patient records. What privacy risk does this address?

Accepted Answer

Privilege creep — accumulation of unnecessary access rights over time

Answer

Data breach notification delays

Answer

Excessive data collection at point of entry

Answer

Insecure data transmission protocols