CIPT Identity, Access Management, and Authentication for Privacy

Question 1

Which access control model grants permissions based on a user's role within the organization rather than their individual identity?

Accepted Answer

Role-based access control (RBAC)

Answer

RBAC assigns permissions to roles (e.g., HR analyst, system admin), and users inherit those permissions by being assigned to a role, simplifying least-privilege enforcement.

Question 2

What is the 'principle of least privilege' as applied to personal data access?

Accepted Answer

Users and systems should only have access to the personal data required to perform their specific function

Answer

Least privilege minimizes the number of people and systems with access to personal data, reducing insider threat risk and limiting breach scope.

Question 3

An employee transfers to a new department. Which identity management process ensures their old access rights are removed and new ones are assigned?

Accepted Answer

Access recertification or provisioning/deprovisioning workflow

Answer

A role-change provisioning workflow automatically deactivates the employee's previous role permissions and grants those appropriate to their new function.

Question 4

What privacy risk does 'orphaned accounts' (accounts of former employees that were not deprovisioned) create?

Accepted Answer

Unauthorized access to personal data by individuals who no longer have a legitimate need

Answer

Orphaned accounts can be used by former employees or attackers to access personal data without authorization, directly violating data access controls.

Question 5

Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented?

Accepted Answer

Multi-factor authentication (MFA)

Answer

MFA requires a second factor (e.g., TOTP code, hardware token) in addition to the password, significantly reducing the risk of unauthorized access from credential theft.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Identity, Access Management, and Authentication for Privacy