Security & Access Control Flashcards

Which technique replaces a user identifier with a one-way irreversible value before sending it to analytics?

Answer: Hashing

Hashing turns identifiers into fixed values that cannot be directly reversed, though salting is advised for emails.

Why is a hashed email still potentially considered personal data under GDPR?

Answer: It can still single out an individual and be re-linked

Hashed identifiers are pseudonymous, not anonymous, because they can be matched to a person.

What does a Data Processing Agreement (DPA) with an analytics vendor establish?

Answer: How the vendor processes personal data on the company's behalf

A DPA defines processor obligations required under GDPR.

Which action best limits the impact of a compromised analytics account?

Answer: Scoping permissions to specific properties or views

Scoped access contains the damage to only the properties that account could reach.

What is the purpose of audit or change-history logs in analytics tools?

Answer: Record who changed settings and when

Change logs support accountability and troubleshooting after unexpected configuration changes.

A Consent Management Platform (CMP) is used primarily to do what?

Answer: Collect and enforce visitors' privacy choices

A CMP captures consent and signals which tags may fire accordingly.

When a visitor declines analytics cookies, what should the tracking setup do?

Answer: Prevent non-essential analytics tags from setting identifiers or firing per the choice

Tags must respect the visitor's choice, being blocked or run in a restricted cookieless mode.