General Data Privacy and Security 5 — Questions and Answers
Question 1: What is a 'data breach notification' requirement?
- An obligation to inform employees when their files are accessed
- A legal requirement to notify affected individuals and/or authorities when personal data is compromised (Correct answer)
- A policy requiring companies to report all IT incidents to management
- A rule mandating that all emails be logged for security audits
Correct answer: A legal requirement to notify affected individuals and/or authorities when personal data is compromised
Data breach notification laws require organizations to inform affected individuals and relevant regulatory authorities within a specified timeframe when personal data has been unlawfully accessed or disclosed.
Question 2: What does 'end-to-end encryption' mean?
- Encrypting data only while it is stored on a server
- Encrypting data so only the communicating parties can read it, preventing access by intermediaries (Correct answer)
- Securing both the start and end points of a network connection
- Using two separate encryption keys for a single message
Correct answer: Encrypting data so only the communicating parties can read it, preventing access by intermediaries
End-to-end encryption ensures that data is encrypted on the sender's side and can only be decrypted by the intended recipient, making it unreadable to service providers or interceptors.
Question 3: Which of the following is an example of 'personally identifiable information' (PII)?
- Aggregated website traffic statistics
- A user's Social Security number (Correct answer)
- Anonymous customer satisfaction scores
- General weather data for a city
Correct answer: A user's Social Security number
PII is any information that can be used to identify a specific individual; a Social Security number is a direct identifier and a classic example of PII.
Question 4: What is the California Consumer Privacy Act (CCPA) primarily designed to do?
- Regulate cybersecurity practices for California businesses
- Give California residents rights over the personal data businesses collect about them (Correct answer)
- Establish encryption standards for financial institutions in California
- Set penalties for hacking California government systems
Correct answer: Give California residents rights over the personal data businesses collect about them
The CCPA grants California residents rights to know, delete, and opt out of the sale of their personal information collected by businesses.
Question 5: What is 'vishing'?
- A phishing attack conducted over video calls
- Voice-based phishing where attackers call victims to extract sensitive information (Correct answer)
- A phishing technique using SMS text messages
- An attack targeting voice-command assistants like smart speakers
Correct answer: Voice-based phishing where attackers call victims to extract sensitive information
Vishing (voice phishing) is a social engineering attack where fraudsters use phone calls to impersonate legitimate organizations and trick victims into revealing sensitive information.
Question 6: What does 'secure by design' mean in software development?
- Adding security features as a last step before product launch
- Building security considerations and controls into a product from the very beginning of development (Correct answer)
- Requiring users to configure security settings manually
- Designing systems that can only be accessed in secure locations
Correct answer: Building security considerations and controls into a product from the very beginning of development
Secure by design means that security is integrated into every phase of the software development lifecycle rather than added as an afterthought.
Question 7: What is the purpose of a 'Virtual Private Network' (VPN)?
- To increase internet browsing speed by caching web pages
- To create an encrypted tunnel for secure data transmission over a public network (Correct answer)
- To block websites from tracking user behavior with cookies
- To store sensitive data in a virtual secure container
Correct answer: To create an encrypted tunnel for secure data transmission over a public network
A VPN encrypts internet traffic and routes it through a secure server, protecting data from interception and masking the user's IP address when using public networks.
General Data Privacy and Security 5
What is a 'data breach notification' requirement?