CIPT Identity, Access Management, and Authentication for Privacy

Question 1

Which access control model grants permissions based on a user's role within the organization rather than their individual identity?

Accepted Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Attribute-based access control (ABAC)

Question 2

What is the 'principle of least privilege' as applied to personal data access?

Accepted Answer

Users and systems should only have access to the personal data required to perform their specific function

Answer

Administrators should have read-only access to all data

Answer

All employees should share a single account for simplicity

Answer

Data should be accessible to anyone within the corporate network

Question 3

An employee transfers to a new department. Which identity management process ensures their old access rights are removed and new ones are assigned?

Accepted Answer

Access recertification or provisioning/deprovisioning workflow

Answer

Password reset

Answer

Multi-factor authentication enrollment

Answer

Single sign-on configuration

Question 4

What privacy risk does 'orphaned accounts' (accounts of former employees that were not deprovisioned) create?

Accepted Answer

Unauthorized access to personal data by individuals who no longer have a legitimate need

Answer

Increased password reset ticket volume

Answer

Higher cloud storage costs

Answer

Degraded single sign-on performance

Question 5

Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented?

Accepted Answer

Multi-factor authentication (MFA)

Answer

Long password requirements alone

Answer

Security questions only

Answer

IP address allowlisting alone

Question 6

What is the privacy advantage of using 'single sign-on' (SSO) federated identity over separate credentials for each application?

Accepted Answer

Reduces the number of places where credentials and identity data are stored, lowering exposure

Answer

Allows users to access systems anonymously

Answer

Eliminates the need for access control policies

Answer

Requires no authentication for internal applications