IAPP CIPT Exam Questions and Answers 2025, Certified Information Privacy Technologists

Question #1

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobileapplication that collects personal health information from electronic patient health records. Theapplication will use machine learning to recommend potential medical treatments and medicationsbased on information collected from anonymized electronic health records. Patient users may alsoshare health data collected from other mobile apps with the LBH app.The a

A. he app asks income level to determine the treatment of care

B. he app sells aggregated data to an advertising company without prior consent

C. he app has a pop-up ad requesting sign-up for a pharmaceutical company newsletter

D. he app asks questions during account set-up to disclose family medical history that is not necessary for the treatment of the individuals symptoms

View answer

Correct Answer: D

Question #2

Between November 30th and December 2nd, 2013, cybercriminals successfully infected the creditcard payment systems and bypassed security controls of a United States-based retailer with malwarethat exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detectionsoftware installed to prevent against such an attack.Which of the following would best explain why the retailers consumer data was still exfiltrated?

A. he detection software alerted the retailers security operations center per protocol, but the information security personnel failed to act upon the alerts

B. he U

C. he IT systems and security measures utilized by the retailers third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailers system

D. he retailers network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information

View answer

Correct Answer: B

Question #3

What Privacy by Design (PbD) element should include a de-identification or deletion plan?

A. ategorization

B. emediation

C. etention

D. ecurity

View answer

Correct Answer: C

Question #4

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobileapplication that collects personal health information from electronic patient health records. Theapplication will use machine learning to recommend potential medical treatments and medicationsbased on information collected from anonymized electronic health records. Patient users may alsoshare health data collected from other mobile apps with the LBH app.The a

A. revent the downloading of photos stored in the app

B. issociate the patient health data from the personal data

C. xclude the collection of personal information from the health record

D. reate a policy to prevent combining data with external data sources

View answer

Correct Answer: D

Question #5

A company configures their information system to have the following capabilities:Allow for selective disclosure of attributes to certain parties, but not to others.Permit the sharing of attribute references instead of attribute values - such as I am over 21 insteadof birthday date.Allow for information to be altered or deleted as needed.These capabilities help to achieve which privacy engineering objective?

A. redictability

B. anageability

C. isassociability

D. ntegrity

View answer

Correct Answer: C

Question #6

What privacy risk is NOT mitigated by the use of encrypted computation to target and serve onlineads?

A. he ad being served to the user may not be relevant

B. he user’s sensitive personal information is used to display targeted ads

C. he personal information used to target ads can be discerned by the server

D. he user’s information can be leaked to an advertiser through weak de-identification techniques

View answer

Correct Answer: D

Question #7

When analyzing user data, how is differential privacy applied?

A. y injecting noise into aggregated datasets

B. y assessing differences between datasets

C. y applying asymmetric encryption to datasets

D. y removing personal identifiers from datasets

View answer

Correct Answer: A

Question #8

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobileapplication that collects personal health information from electronic patient health records. Theapplication will use machine learning to recommend potential medical treatments and medicationsbased on information collected from anonymized electronic health records. Patient users may alsoshare health data collected from other mobile apps with the LBH app.The a

A. imiting access to the app to authorized personnel

B. ncluding non-transparent policies, terms and conditions in the app

C. nsufficiently deleting personal data after an account reaches its retention period

D. ot encrypting the health record when it is transferred to the Light Blue Health servers

View answer

Correct Answer: A

Question #9

Which of the following functionalities can meet some of the General Data Protection Regulation’s(GDPR’s) Data Portability requirements for a social networking app designed for users in the EU?

A. llow users to modify the data they provided the app

B. llow users to delete the content they provided the app

C. llow users to download the content they have provided the app

D. llow users to get a time-stamped list of what they have provided the app

View answer

Correct Answer: C

Question #10

A privacy engineer reviews a newly developed on-line registration page on a companys website. Thepurpose of the page is to enable corporate customers to submit a returns / refund request forphysical goods. The page displays the following data capture fields: company name, accountreference, company address, contact name, email address, contact phone number, product name,quantity, issue description and company bank account details.After her review, the privacy engineer recommends setting certain capture field

A. he contact phone number field

B. he company address and name

C. he contact name and email address

D. he company bank account detail field

View answer

Correct Answer: B

Question #11

When should code audits be concluded?

A. t code check-in time

B. t engineering design time

C. hile code is being sent to production

D. efore launch after all code for a feature is complete

View answer

Correct Answer: D

Question #12

Which of the following would be the best method of ensuring that Information Technology projectsfollow Privacy by Design (PbD) principles?

A. evelop a technical privacy framework that integrates with the development lifecycle

B. tilize Privacy Enhancing Technologies (PETs) as a part of product risk assessment and management

C. dentify the privacy requirements as a part of the Privacy Impact Assessment (PIA) process during development and evaluation stages

D. evelop training programs that aid the developers in understanding how to turn privacy requirements into actionable code and design level specifications

View answer

Correct Answer: D

Question #13

Which of the following is the least effective privacy preserving practice in the Systems DevelopmentLife Cycle (SDLC)?

A. onducting privacy threat modeling for the use-case

B. ollowing secure and privacy coding standards in the development

C. eveloping data flow modeling to identify sources and destinations of sensitive data

D. eviewing the code against Open Web Application Security Project (OWASP) Top 10 Security Risks

View answer

Correct Answer: C

Question #14

Not updating software for a system that processes human resources data with the latest securitypatches may create what?

A. uthentication issues

B. rivacy vulnerabilities

C. rivacy threat vectors

D. eportable privacy violations

View answer

Correct Answer: B

Question #15

SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobileapplication that collects personal health information from electronic patient health records. Theapplication will use machine learning to recommend potential medical treatments and medicationsbased on information collected from anonymized electronic health records. Patient users may alsoshare health data collected from other mobile apps with the LBH app.The a

A. btain consent before using personal health information for data analytics purposes

B. rovide the user with an option to select which personal data the application may collect

C. isclose what personal data the application the collecting in the company Privacy Policy posted online

D. ocument each personal category collected by the app and ensure it maps to an app function or feature

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

IAPP CIPT Exam Questions and Answers 2025, Certified Information Privacy Technologists | SPOTO

View The Updated CIPT Exam Questions

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

IAPP CIPT Exam Questions and Answers 2025, Certified Information Privacy Technologists | SPOTO

View The Updated CIPT Exam Questions

View The Updated IAPP Exam Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now