CIPT Identity, Access Management, and Authentication for Privacy 3

Question 1

From a privacy perspective, why is collecting biometric data for authentication considered higher risk than password-based authentication?

Accepted Answer

Biometric data is immutable — if compromised, the individual cannot change their fingerprint or iris scan

Answer

Biometrics are slower to verify than passwords

Answer

Biometric systems are always less accurate than passwords

Answer

Biometric data is not covered by privacy laws

Question 2

What is the 'need-to-know' principle as applied to personal data access in identity management?

Accepted Answer

Individuals should only access personal data that is necessary for their specific, current task

Answer

All senior managers should have unrestricted data access

Answer

Data should be accessible to any authenticated employee

Answer

Access rights should be granted once and never reviewed

Question 3

An organization implements 'just-in-time' (JIT) privileged access, granting elevated permissions only for the duration of a specific task. What privacy benefit does this provide?

Accepted Answer

Minimizes the window of exposure for sensitive data by eliminating persistent privileged access

Answer

Eliminates the need for audit logs

Answer

Reduces the cost of identity management systems

Answer

Allows users to bypass MFA for privileged tasks

Question 4

Under the US Health Insurance Portability and Accountability Act (HIPAA), what access control requirement applies to electronic protected health information (ePHI)?

Accepted Answer

Covered entities must implement technical policies to allow access only to authorized persons or software programs

Answer

All employees must have full access to ePHI to provide care

Answer

ePHI must be accessible without authentication on internal networks

Answer

Access logs for ePHI are optional for small providers

Question 5

What is 'identity proofing' and why is it important for privacy?

Accepted Answer

Verifying that a person is who they claim to be before creating an account, preventing fraudulent or duplicate identities

Answer

Verifying the accuracy of data in a database

Answer

Proving ownership of a domain for SSL certification

Answer

Checking that a software identity library has no vulnerabilities

Question 6

Which privacy risk is specifically introduced when an organization relies on a social login provider (e.g., 'Login with Facebook') for authentication?

Accepted Answer

The social provider may receive data about the user's activity across the organization's applications

Answer

Users can no longer change their passwords

Answer

Multi-factor authentication becomes unavailable

Answer

The organization loses all control over session management