CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 5 — Questions and Answers
Question 1: Which privacy principle holds that the same level of privacy protection applies whether a user is interacting anonymously or under a verified identity?
- Data minimization
- Full functionality (positive-sum) (Correct answer)
- Visibility and transparency
- Respect for user privacy
Correct answer: Full functionality (positive-sum)
The full functionality (positive-sum) principle rejects the false trade-off between privacy and usability, aiming to accommodate all legitimate interests.
Question 2: A web application assigns a random session token instead of embedding the user's account number in the URL. This is an example of which PET?
- Data minimization
- Tokenization (Correct answer)
- Differential privacy
- Homomorphic encryption
Correct answer: Tokenization
Tokenization replaces sensitive values like account numbers with random tokens, reducing the exposure of real identifiers.
Question 3: Under the California Consumer Privacy Act (CCPA), which right allows consumers to prevent a business from selling their personal information?
- Right to access
- Right to opt-out of sale (Correct answer)
- Right to deletion
- Right to non-discrimination
Correct answer: Right to opt-out of sale
The CCPA gives California residents the right to opt out of the sale of their personal information to third parties.
Question 4: Which data anonymization weakness occurs when a dataset has only a few records per combination of quasi-identifiers, making individuals easy to re-identify?
- Data sparsity re-identification (Correct answer)
- L-diversity failure
- Attribute inference
- Membership inference
Correct answer: Data sparsity re-identification
Data sparsity re-identification happens when rare combinations of quasi-identifiers (e.g., ZIP code, birth date, sex) uniquely or nearly uniquely identify individuals.
Question 5: Which control requires that a minimum number of authorized personnel must cooperate to perform a sensitive operation, preventing unilateral action?
- Separation of duties
- Multi-party authorization (M-of-N control) (Correct answer)
- Role-based access control
- Mandatory access control
Correct answer: Multi-party authorization (M-of-N control)
M-of-N (multi-party authorization) requires M out of N designated individuals to approve an action, guarding against insider abuse.
Question 6: A company automatically deletes personal data after a defined retention period using an automated policy engine. Which privacy principle does this technical control enforce?
- Purpose limitation
- Integrity and confidentiality
- Storage limitation (Correct answer)
- Lawfulness of processing
Correct answer: Storage limitation
Automated deletion enforces storage limitation by ensuring personal data is not kept longer than necessary for its stated purpose.
Question 7: Which term describes the risk that a machine learning model trained on sensitive data can inadvertently memorize and reveal specific training examples?
- Model poisoning
- Membership inference risk
- Adversarial example attack
- Data leakage through overfitting (Correct answer)
Correct answer: Data leakage through overfitting
Overfitted models can memorize training data, allowing adversaries to extract sensitive records through carefully crafted queries.
CIPT Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles 5
Which privacy principle holds that the same level of privacy protection applies whether a user is interacting anonymously or under a verified identity?