CIPT Privacy by Design and Engineering 3

Question 1

Which software development practice integrates privacy requirements into each sprint or iteration of an Agile project?

Accepted Answer

Privacy by Design in Agile (privacy user stories)

Answer

Waterfall privacy gate reviews

Answer

Post-launch privacy audits

Answer

Annual privacy policy updates

Question 2

A CIPT is reviewing a new mobile app. She recommends that the app request location permission only when a location-based feature is actively used. Which principle does this reflect?

Accepted Answer

Context-aware data collection (purpose limitation)

Answer

End-to-end encryption

Answer

Full functionality

Answer

Data portability

Question 3

What is the main goal of applying 'data separation' or 'compartmentalization' as a privacy engineering technique?

Accepted Answer

Limiting the combination of data that could re-identify individuals

Answer

Speeding up database queries

Answer

Encrypting data at rest

Answer

Reducing cloud storage costs

Question 4

Which type of architecture ensures that no single server or administrator can access a user's complete personal data, distributing trust across multiple parties?

Accepted Answer

Distributed or decentralized privacy architecture

Answer

Centralized identity management

Answer

Monolithic database design

Answer

Single sign-on federation

Question 5

A privacy engineer proposes using 'k-anonymity' when publishing a dataset. What does this guarantee?

Accepted Answer

Each record is indistinguishable from at least k-1 other records on quasi-identifiers

Answer

Data is encrypted with k encryption keys

Answer

k users must consent before any data is published

Answer

Each field is masked with k random characters

Question 6

When building a consent management platform, which engineering requirement is most critical from a Privacy by Design perspective?

Accepted Answer

Granular, revocable consent with clear audit logs

Answer

Storing consent in the same table as behavioral analytics

Answer

Defaulting all marketing preferences to opted-in

Answer

Requiring consent only for sensitive data categories