This multiple choice assessment focuses on the new General Data Protection Regulation (GDPR).

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the CIPT.

Format: Multiple Choice

Time: 90 minutes

The result will be provided immediately, with details on all questions.

1. A company that provides tutoring services to school children developed a service that was intended to allow tutors to provide services to children virtually through their home computers. However, the program unintentionally allowed anyone to register and interact with these children. This made it possible for strangers to contact the children without parental consent. Based on Solove’s taxonomy of privacy model, which privacy problem exists in this scenario?


2. Jenny completed a purchase on a website and was presented with a pop-up box on the final page that read, “Thank you for your purchase! We will email you in the future about related product and services. Please select an option below to opt-out.” The three buttons below the message read, “Do Not Opt-Out,” “Decline” and “Skip This Step.” Jenny selected the option to “Skip This Step,” believing it was the best choice to continue her browsing experience. This is an example of which of the following?

3. A cloud service provider wants to advertise the benefits of its service by publishing information that shows how its users have interacted with the platform. It plans to publish only aggregated data to not identify its customers. What would be a best practice before publishing its aggregated data?

4. A utility company discovers that it is missing first names for some of its customers. It purchases householder data from a credit reference agency to obtain names and attempt to find a match in their customer database. The two companies will apply a logical rule that attributes the utility bills and assigns liability for such debts to the individual with the most active credit history at an address. What kind of privacy threat is most likely to occur based on this scenario?

5. An organization is using Scrum methodology to develop in-house solutions for customer support, which involves how personal data of its customers is processed. During each sprint, the team examines the implications the changes have on customer privacy and ensures the process remains compliant with their privacy program. When a change occurs in the system during development, there is a change management procedure that triggers an evaluation of whether the engineering, design, implementation or testing requirements needs to change within the development process. This example is a component of which of the below?

6. Beth’s client is keen on ensuring that her team considers privacy and data protection issues at every phase of each product’s lifecycle. Which of the following enables the team to test various phases of the lifecycle for potential risks?

7. A flaw in the requirements, design or implementation that occurs when one or more lines of computer source code do not correctly verify the authorization of an access attempt is known as a(n)?

8. Which of the following statements about aggregated data sets is TRUE?

9. Which of the following is a subset of artificial intelligence that learns through repetition of computational tasks and processes unstructured data such as text and images?


Please use the following scenario to answer the next THREE questions.

You work at a large multinational organization that operates a global online marketplace. The organization is headquartered in the U.S. but has operations in Ireland and Australia. Individuals in almost every country of the world can join the platform. Once a user is on the platform, they can sell items to other users around the world.


The platform facilitates the sending of items, but individuals making purchases don’t know from which country their items will arrive. The platform allows individuals to post reviews about both the items they buy and the sellers of the goods. Individuals must register and create an account to sell items or make purchases.


Traditionally, users have been able to mask certain elements of their identity to other users when they create an account. This includes selecting a nickname rather than using their real names, masking their locations, and hiding their contact details (phone numbers, email addresses, etc.). The real data is provided to your company but is masked to other users. At the time information was collected, users were assured that their personal details would not be shared with other users.


In the past few days there has been a significant drop in users and revenues. A new competitor is luring away your company’s users – and getting a significant number of new users who have never used a platform like this one in the past.


The head of product development thinks customers are leaving the platform and going to the competitor because the competitor does not permit users to be anonymous on the site. The head of product development has convinced the CEO that customers trust the competitor’s platform and products sold on the platform because they can see that the other customers are “real people” and know exactly who they are. You think that users are likely leaving the platform because your company suffered a massive data breach several months ago, and users have just received notices about the incident.

Your CEO now wants to remove the ability for new users to mask their identities. The CEO also wants to unmask existing users’ identities. You have been working hard to explain to the CEO why this is not feasible, and given the current post-breach climate, not an advisable step.

10. Which of the following statements is NOT correct with respect to the unmasking of user identities?

11. Allowing users the ability to mask their identities on the platform aligns with which of the FTC’s Five Fair Information Practice Principles?


12. A vulnerability in the customer relationship management (CRM) software is being exploited by malicious hackers. The CRM vendor indicated that a quick-fix to the software will not be available for a week. The patch management process will take another 3 days to complete after receiving the quick-fix. What compensating control should be put in place to protect the CRM system and customers’ personal data in the meantime?

13. A company is developing a web-based chatbot that will ask customers to input information about preferences and hobbies to direct them to relevant products and services. Which of the following is the first step software developers should take to ensure only the data needed is collected?

14. Jack is a privacy engineer working in a bank. DevOps is enhancing the user interface of the bank’s mobile application and contemplating the use of an open-source library module for facial recognition. DevOps approached Jack for his guidance. What is the first step that Jack must take?

15. When implementing privacy by design, the processing and use of personal data should not be obscured or obfuscated. Notice and disclosure regarding the use or personal data should consider the needs of the audience. Which of the following is a foundational privacy principle that best reflects this statement?

16. Chatbots can interact with users through natural language and can provide guidance in a conversational manner, using human-like cues such as warm greetings with a real name. How are such tools categorized from a privacy perspective?

17. Peter works for SipCorp and is renewing a service level agreement (SLA) with a third-party vendor that he has procured for a critical IT project. Which of the following should NOT be included in the SLA?

18. Which activity will most help a controller ensure the operations of a processor are within the scope of the personal data processing agreement?

19. Which of the following are required to implement effective privacy engineering?

20. Value-sensitive design is an iterative process that involves many types of investigations. Which investigation type focuses on how stakeholders configure, use or are otherwise affected by the technology involved?

21. A company provides training to its employees about customer privacy rights and company privacy policies. The company wants to assess the impact of its training as well as find areas for improvement. Which is the best way to evaluate the effectiveness of training in achieving the company’s privacy objectives?

22. Kyle and Maggie installed an electronic thermostat in their home so they could control indoor temperature and track their energy use. It required an internet connection to a webserver, which stored the data necessary for the usage reports. Kyle consented to the website’s privacy policy and understood the data is well protected. The electronic thermostat is an example of which of the following?

23. ABC Company provides technical white papers to interested consumers who register on their website. The website requires a user to enter their mobile phone number as a condition of registration, although the website’s primary function does not require phone numbers and there is no statutory or regulatory requirement to do so. Using Daniel Solove’s Taxonomy of Privacy model, this is an example of which problem?

24. Which of the following is a main goal of using the Factor Analysis of Information Risk (FAIR) methodology?


Please use the following scenario to answer the next THREE questions.

A U.S.-based national retail store chain is looking to expand its business and has recently hired its first chief privacy officer (CPO) and a new chief marketing officer (CMO) to help it drive greater marketing efforts in a way that protects privacy.


The company already operates in several states but currently does not operate in other countries. In addition to its brick-and-mortar retail locations, the company has a website where people are able to order items for home delivery.


The CPO has been asked to review the company’s existing practices related to personal data and to remediate any significant issues they identify. One of the first areas that the CPO reviewed was practices related to marketing to existing and potential customers.


The organization used to rely on non-personalized marketing techniques, such as TV and radio advertising and physical billboards, as well as personalized marketing to individuals who have joined their loyalty program. The new CMO is looking to develop and deliver more personalized marketing experiences using personal data to target specific groups and individuals, with the goals of increasing both the customer base and increasing the total amount that existing customers spend per year.

The CMO meets with the CPO and relays that the marketing team has several analyses they would like to run to assist with the marketing efforts:


First, they would like to identify potential new store locations to meet the needs of online customers who might prefer to shop in-person. The sites must meet the following criteria: (a) they do not have an existing store within 20 miles, and (b) there are a minimum number of people with similar demographics to their existing customers. Before they commence this analysis, they would like to gain a baseline understanding of where their current online customers live.


Second, the CMO would like to run a joint marketing campaign with another company. To do this, they would like to identify customers the two companies have in common so they can target them for this campaign.


After the meeting, the CMO emails the CPO and tells them that as part of their analysis, the marketing team has identified an old customer dataset which has not been updated for several years and does not appear to be in use.


25. Which of the following should the marketing team do to understand the profile of their current customers’ locations to meet the CMO’s ob?jective while preserving customer’s privacy

26. Which technique would allow the identification of regular customers to be performed in a way that does not require either company to directly share customers’ personal data with the other?

27. Which of the following actions could the company take with respect to the old customer data set identified by the CMO that will provide the most privacy protection?

28. Which of the following is an example of the predictability objective in privacy engineering?

29. Which of the following privacy technologists’ activities is recognized as part of the software evolution process?


30. Artificial intelligence can potentially introduce privacy harms to individuals in which of the following ways?

31. To sign up for a retailer’s loyalty program, Peter must complete a form asking for his name, contact information, income and other demographic information. Peter completing and submitting the form to the retailer is an example of what type of data collection?

32. The use of data aggregation can aid in protecting the privacy of individuals while executing statistical analysis. Which of the following is the most aggregated result?

33. A company has hired a marketing company to identify past website visitors who revisit its site for future marketing. This is an example of what type of activity?

34. Encryption protects the confidentiality of digital data transmitted through a network, such as the internet, or at rest on computer systems by scrambling text into an unreadable format or code. What is the new text format called?


35. A game app available on a popular app store wants to add functionality to have players sign into their social media accounts. The game app will receive marketing leads from this functionality, and players will get to display their scores and interact with other players. Which of the following would cause a privacy concern?

36. Julia decided to reformat her company’s website privacy notice by bringing critical elements to the foreground and then supplementing those elements with additional related detail. Her goal is to make the privacy notice easier for users to navigate and comprehend. This is an example of utilizing which of the following?

37. An organization is looking to outsource part of its business operations to a third party. As part of the outsourcing, some employees from the third party will require access to the organization’s physical locations and some IT systems that contain personal data. Which of the following should an organization do first to provide the highest level of security and work to ensure the outsourcing company is granted only appropriate access to personal data?

38. When a company is setting up an anonymous ethical complaints system, which of the following privacy controls is most important to implement?

39. When an application uses data features such as user location, display preferences or audio volume levels, this is known as which of the following?

40. Which IT framework is held up as the de facto for IT service management worldwide?

41. Which of the following is an example of a privacy threat during data collection?

42. As part of a major rebranding effort, a social media company is adding new features to its mobile app, including embedded application programming interfaces (APIs) that easily give users access to other social media services. Before rolling out these changes, what should the company’s privacy team do?

43. Which security mechanism would be the most reliable technology to keep data confidential at rest, in-transit, or when processing real-time analytics?

44. Which of the following events is a trigger to update a data protection impact assessment or privacy impact assessment (DPIA/PIA) for a system?




Please use the following scenario to answer the next SIX questions.

Shop4Electronics, a large electronics retailer has a website and a mobile app where its customers can make purchases, see their order history and start returns.


Shop4Electronics uses a variety of tracking technologies on its website and app. The Shop4Electronic website uses several pieces of web code that in turn leverage cookies for the purposes of internal analytics, fraud detection and digital advertising.


When a user visits the Shop4Electronics website they are assigned several different cookie IDs. The code on the website collects the cookie ID of each user and associates that data to any completed

purchases together with any browsing behavior on the website. In addition, information about the user’s device is collected and associated to their cookie IDs. This information includes their IP address, device operating system, device type, browser name, screen size, browser language and list of browser plugins installed.


A user visits the Shop4Electronics website and completes an order for two new laptops. The user later receives an email that their order was rejected as their fraud vendor, FraudNoMore, marked the transaction as fraudulent.

FraudNoMore uses their third-party cookie IDs collected from the Shop4Electronics website and associated device data described above to make their determination of fraud. However, if their third- party code is unable to set and collect cookies and other device information about the user, it automatically considers that transaction fraudulent.


In addition to the website, the Shop4Electronics mobile application uses the browsing behavior of its users for the same set of uses cases as their website. The use cases are analytics, fraud detection, and digital advertising.


To deliver digital advertising, the Shop4Electronics mobile app collects the mobile adverting identifier in combination with the browsing activity and sends that data to its social media and advertising partners. Those social media and advertising partners in turn use those mobile advertising identifiers to serve digital advertisements for Shop4Electronics.


A user downloads and installs the Shop4Electronics Mobile App to their new iPhone. Upon opening the app, Shop4Electronics asks for permission to track the user via the Apple-provided App Track Transparency (ATT) dialog, which requires consent. This dialog is required to access the advertising identifier on any iPhone or iPad running iOS 14.5 or later. The user rejects the request to be tracked by selecting ‘Ask App Not to Track’ in the dialog. Despite declining to be tracked, the user can use to app as normal.

45. There has been an increase in calls to the customer service department of Shop4Electronics with complaints that orders were rejected incorrectly due to fraud. Which recommendation should be provided to reduce the number of false positives identified by FraudNoMore?

46. Shop4Electronics runs internal analytics to identify unique users using their mobile application. Can a user who declined to be tracked via Apple’s App Tracking Transparency (ATT) dialog be included in the internal analytics report?

47. If a guest visitor on the Shop4Electronics website cleared their cookies, which technique could be used to continue to uniquely identify that user, based on the data collected by Shop4Electronics and its partners?

48. Shop4Electronics wants to identify users who have made purchases on both their website and mobile application. Which of the following methods best serves this purpose?

49. A Shop4Electronics customer signs-up to receive email marketing. This customer is concerned about privacy and wants to take steps to ensure Shop4Electronics is not notified when they open a Shop4Electronics email. Which method would limit email open tracking?

50. The Shop4Eletronics website requests a user’s location via their browser upon first visit to the site. This location data is used to determine a zip code to calculate shipping cost and tax. Upon navigating to checkout, the user notices their zip code has been pre-populated. Which mechanism was likely used to determine location if the user rejected to share location via their browser?