CIPT Identity, Access Management, and Authentication for Privacy 2 — Questions and Answers
Question 1: Which privacy-enhancing identity technique allows a user to prove they meet a requirement (e.g., age over 18) without revealing their actual attribute value?
- Zero-knowledge proof (Correct answer)
- Digital certificate
- SAML assertion
- OAuth access token
Correct answer: Zero-knowledge proof
Zero-knowledge proofs enable verification of a claim without disclosing the underlying data, directly applying identity minimization in authentication flows.
Question 2: What is the difference between 'authentication' and 'authorization' in the context of personal data access?
- Authentication verifies who you are; authorization determines what you are permitted to access (Correct answer)
- Authentication grants access; authorization verifies identity
- They are interchangeable terms for the same process
- Authorization verifies identity using biometrics; authentication uses passwords
Correct answer: Authentication verifies who you are; authorization determines what you are permitted to access
Authentication confirms identity (who are you?), while authorization enforces access control (what are you allowed to do?); both are required to protect personal data.
Question 3: A company uses attribute-based access control (ABAC) to restrict access to medical records. What makes ABAC more privacy-protective than simple RBAC?
- ABAC can incorporate contextual attributes (time, location, data sensitivity) for finer-grained, purpose-aware access decisions (Correct answer)
- ABAC requires no user training
- ABAC eliminates the need for encryption
- ABAC automatically deletes access logs after 30 days
Correct answer: ABAC can incorporate contextual attributes (time, location, data sensitivity) for finer-grained, purpose-aware access decisions
ABAC evaluates multiple attributes — user role, resource sensitivity, time of day, location — enabling dynamic, context-sensitive access decisions that align more precisely with the need-to-know principle.
Question 4: What is an 'access log' used for from a privacy accountability perspective?
- Creating an auditable record of who accessed personal data, when, and from where (Correct answer)
- Blocking unauthorized users in real time
- Encrypting data transfers between systems
- Measuring application performance
Correct answer: Creating an auditable record of who accessed personal data, when, and from where
Access logs enable post-hoc detection of unauthorized access, support breach investigations, and demonstrate accountability for personal data access to regulators.
Question 5: Which federated identity standard is widely used for delegating authorization to third-party applications without sharing user credentials?
- OAuth 2.0 (Correct answer)
- SAML 1.1
- Kerberos
- LDAP
Correct answer: OAuth 2.0
OAuth 2.0 provides an authorization framework allowing users to grant third-party apps limited access to their resources without exposing their passwords.
Question 6: A healthcare organization conducts quarterly 'access reviews' where managers certify which employees need continued access to patient records. What privacy risk does this address?
- Privilege creep — accumulation of unnecessary access rights over time (Correct answer)
- Data breach notification delays
- Excessive data collection at point of entry
- Insecure data transmission protocols
Correct answer: Privilege creep — accumulation of unnecessary access rights over time
Access reviews identify and remediate privilege creep, ensuring that only individuals with a current, legitimate need retain access to sensitive personal data.
CIPT Identity, Access Management, and Authentication for Privacy 2
Which privacy-enhancing identity technique allows a user to prove they meet a requirement (e.g., age over 18) without revealing their actual attribute value?