CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 4 — Questions and Answers
Question 1: Which privacy-enhancing technology allows a user to prove they meet a criterion (e.g., age over 18) without revealing the underlying data?
- Data masking
- Zero-knowledge proofs (Correct answer)
- Tokenization
- Salted hashing
Correct answer: Zero-knowledge proofs
Zero-knowledge proofs let one party prove knowledge of a fact to another party without conveying any information beyond the validity of the claim.
Question 2: Which data governance document formally describes what personal data an organization collects, how it is used, and with whom it is shared?
- Data retention schedule
- Records of processing activities (RoPA) (Correct answer)
- Incident response plan
- Cookie consent banner
Correct answer: Records of processing activities (RoPA)
A Records of Processing Activities (RoPA) documents all personal data processing operations and is required under GDPR Article 30.
Question 3: A healthcare app encrypts data in transit using TLS but stores it in plaintext on the server. Which threat does this configuration leave unaddressed?
- Network eavesdropping
- Server-side data breach (Correct answer)
- Certificate spoofing
- Man-in-the-browser attacks
Correct answer: Server-side data breach
Encrypting only data in transit leaves stored data vulnerable to server compromise; encryption at rest is also required.
Question 4: Which US federal law specifically governs the privacy of student educational records and restricts their disclosure without consent?
- HIPAA
- COPPA
- FERPA (Correct answer)
- GLBA
Correct answer: FERPA
FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records and gives parents rights over those records.
Question 5: Federated learning improves privacy by training machine learning models in what manner?
- Centralizing all training data on a secure server
- Training locally on devices and sharing only model updates (Correct answer)
- Encrypting the entire training dataset before use
- Replacing real data with synthetic data for training
Correct answer: Training locally on devices and sharing only model updates
Federated learning keeps raw data on local devices and aggregates only model gradient updates, preventing raw data exposure.
Question 6: Which concept describes the practice of collecting consent that is freely given, specific, informed, and unambiguous under GDPR?
- Implied consent
- Valid consent (Correct answer)
- Opt-out consent
- Blanket consent
Correct answer: Valid consent
GDPR Article 7 defines valid consent as freely given, specific, informed, and indicated by a clear affirmative action.
Question 7: Which threat model considers the scenario where a cloud provider's employees could access customer data stored on their platform?
- External attacker model
- Insider threat model (Correct answer)
- Supply chain attack model
- Nation-state threat model
Correct answer: Insider threat model
The insider threat model accounts for risks from individuals with legitimate system access, such as employees of a cloud or SaaS provider.
CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 4
Which privacy-enhancing technology allows a user to prove they meet a criterion (e.g., age over 18) without revealing the underlying data?