CIPT Privacy by Design and Engineering 2 — Questions and Answers
Question 1: A privacy engineer is asked to implement a technique that replaces real user identifiers with pseudonyms in a dataset. What technique is being used?
- Pseudonymization (Correct answer)
- Anonymization
- Tokenization of payment data
- Data masking for testing
Correct answer: Pseudonymization
Pseudonymization replaces direct identifiers with artificial identifiers (pseudonyms) so that data can no longer be attributed to a specific individual without additional information.
Question 2: Which engineering technique adds statistical noise to datasets to protect individual privacy while preserving overall data utility?
- Differential privacy (Correct answer)
- Homomorphic encryption
- Access control lists
- Data tokenization
Correct answer: Differential privacy
Differential privacy injects calibrated noise into query results so that individual records cannot be inferred from aggregate outputs.
Question 3: A company wants to allow third-party analysis of its customer database without revealing individual records. Which technique best enables this?
- Homomorphic encryption (Correct answer)
- Transport Layer Security
- Role-based access control
- Multi-factor authentication
Correct answer: Homomorphic encryption
Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, preserving privacy during analysis.
Question 4: In the context of Privacy by Design, what is a 'privacy impact assessment' (PIA) primarily used for during system development?
- Identifying and mitigating privacy risks before system deployment (Correct answer)
- Documenting data breaches after they occur
- Auditing user consent records quarterly
- Measuring website analytics performance
Correct answer: Identifying and mitigating privacy risks before system deployment
A PIA evaluates how a proposed system or process will affect individual privacy and enables teams to address risks before launch.
Question 5: What is the primary purpose of data minimization as a privacy engineering control?
- Collect only the data necessary for the specified purpose (Correct answer)
- Reduce storage costs by compressing files
- Delete all data older than 90 days
- Minimize the number of database tables
Correct answer: Collect only the data necessary for the specified purpose
Data minimization limits the collection of personal data to what is strictly necessary for a defined purpose, reducing privacy risk.
Question 6: Which concept describes designing systems so that a user's identity is not required to access a service when only a credential or attribute is needed?
- Identity minimization (Correct answer)
- Multi-factor authentication
- Zero-trust architecture
- Single sign-on
Correct answer: Identity minimization
Identity minimization (or attribute-based access) ensures systems request only the minimal identity information required rather than full identification.
CIPT Privacy by Design and Engineering 2
A privacy engineer is asked to implement a technique that replaces real user identifiers with pseudonyms in a dataset.
What technique is being used?