CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 2 — Questions and Answers
Question 1: Which de-identification technique replaces direct identifiers with artificial keys while retaining a mapping table for re-identification?
- Anonymization
- Pseudonymization (Correct answer)
- Tokenization
- Data masking
Correct answer: Pseudonymization
Pseudonymization replaces identifiers with pseudonyms while keeping a mapping table, allowing re-identification by authorized parties.
Question 2: A company collects only the data fields strictly required to fulfill a transaction. Which Privacy by Design principle does this practice reflect?
- Privacy as the default
- Data minimization (Correct answer)
- End-to-end security
- Full functionality
Correct answer: Data minimization
Data minimization means collecting only the personal data that is adequate, relevant, and limited to what is necessary.
Question 3: Differential privacy protects individual privacy by adding what to query results?
- Encryption keys
- Calibrated statistical noise (Correct answer)
- Pseudonymous identifiers
- Access control lists
Correct answer: Calibrated statistical noise
Differential privacy injects carefully calibrated noise into outputs so that no single individual's data can be inferred from results.
Question 4: Which attack re-identifies anonymized data by combining it with publicly available auxiliary datasets?
- Brute-force attack
- Linkage attack (Correct answer)
- Side-channel attack
- SQL injection
Correct answer: Linkage attack
A linkage attack cross-references anonymized records with external data to re-identify individuals.
Question 5: Under the GDPR, which role is responsible for processing personal data on behalf of the data controller?
- Data subject
- Data processor (Correct answer)
- Data protection officer
- Supervisory authority
Correct answer: Data processor
A data processor processes personal data only on the documented instructions of the data controller.
Question 6: A privacy impact assessment (PIA) is most valuable when conducted at which stage of a project?
- After product launch
- During routine maintenance
- Early in the design phase (Correct answer)
- When a breach occurs
Correct answer: Early in the design phase
Conducting a PIA early in design allows privacy risks to be mitigated before costly system changes are required.
Question 7: Which cryptographic approach allows computations on encrypted data without decrypting it first?
- Symmetric encryption
- Homomorphic encryption (Correct answer)
- Hashing
- TLS
Correct answer: Homomorphic encryption
Homomorphic encryption enables arithmetic operations on ciphertext, yielding an encrypted result that decrypts to the correct answer.
CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 2
Which de-identification technique replaces direct identifiers with artificial keys while retaining a mapping table for re-identification?