CIPT Identity, Access Management, and Authentication for Privacy 2

Question 1

Which privacy-enhancing identity technique allows a user to prove they meet a requirement (e.g., age over 18) without revealing their actual attribute value?

Accepted Answer

Zero-knowledge proof

Answer

Zero-knowledge proofs enable verification of a claim without disclosing the underlying data, directly applying identity minimization in authentication flows.

Question 2

What is the difference between 'authentication' and 'authorization' in the context of personal data access?

Accepted Answer

Authentication verifies who you are; authorization determines what you are permitted to access

Answer

Authentication confirms identity (who are you?), while authorization enforces access control (what are you allowed to do?); both are required to protect personal data.

Question 3

A company uses attribute-based access control (ABAC) to restrict access to medical records. What makes ABAC more privacy-protective than simple RBAC?

Accepted Answer

ABAC can incorporate contextual attributes (time, location, data sensitivity) for finer-grained, purpose-aware access decisions

Answer

ABAC evaluates multiple attributes — user role, resource sensitivity, time of day, location — enabling dynamic, context-sensitive access decisions that align more precisely with the need-to-know principle.

Question 4

What is an 'access log' used for from a privacy accountability perspective?

Accepted Answer

Creating an auditable record of who accessed personal data, when, and from where

Answer

Access logs enable post-hoc detection of unauthorized access, support breach investigations, and demonstrate accountability for personal data access to regulators.

Question 5

Which federated identity standard is widely used for delegating authorization to third-party applications without sharing user credentials?

Accepted Answer

OAuth 2.0

Answer

OAuth 2.0 provides an authorization framework allowing users to grant third-party apps limited access to their resources without exposing their passwords.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Identity, Access Management, and Authentication for Privacy 2