Certified Information Privacy Technologist · every answer carries the reasoning, and why each
other option fails.
345 questions
9 chapters of notes
EN + ZH languages
Tap an option to see the answer, the reasoning, and why the other three fail.
Question 1 of 10
A BaaS provider backs up the corporate data and stores it in an outsider provider under contract with the organization. A researcher notifies the organization that he found unsecured data in the cloud. The organization looked into the issue and realized one of its backups was misconfigured on the outside provider's cloud and the data fully exposed to the open internet. They quickly secured the backup. Which is the best next step the organization should take?
AReview the content of the data exposed
BReview its contract with the outside providerReviewing the contract with the outside provider is a post-incident compliance and accountability step that should occur after the scope of the data exposure has been clarified, not as the first step.
CInvestigate how the researcher discovered the unsecured dataInvestigating how the researcher discovered the data is unrelated to the organization's own remediation and risk assessment, and is a secondary matter.
DInvestigate using alternate BaaS providers or on-premise backup systemsEvaluating alternative BaaS providers is a long-term strategic decision that should be considered only after completing the impact assessment of this incident, not an urgent next step.
Why A is correct
This item offers only two options (A, review the content of the exposed data; B, review the contract with the outside provider) that correspond to the actual real-world response sequence. The data was exposed to the open internet due to misconfiguration. Before the organization takes any further steps (such as notification, accountability, or switching providers), it must first determine the actual content of the exposed data (data content review) to assess whether it includes personally identifiable information (PII) or sensitive categories of data (such as health or financial information), so it can correctly evaluate the scope and severity of the exposure. This is the critical first step in the incident response process — only by clarifying "what data was exposed" can the organization decide whether regulatory notification obligations are triggered (such as breach notification under applicable law), whether affected individuals must be notified, and the scope of subsequent accountability. Reviewing the contract is a reasonable subsequent step, but it is not the "best next step."
Question 2 of 10
A user who owns a resource wants to give other individuals access to the resource. What control would apply?
AMandatory access control.Mandatory Access Control (MAC) mandatorily assigns and restricts permissions by the system according to uniform security classification labels, and the resource owner personally has no authority to decide, which does not match the question.
BRole-based access controls.Role-Based Access Control (RBAC) uniformly assigns permissions based on a user's role within the organization, rather than being granted at any time at the discretion of the specific resource's owner.
CDiscretionary access control.
DContext of authority controls."Context of authority controls" is not a standard access control model term, and does not match the scenario described in the question of the resource owner discretionarily granting authorization.
Why C is correct
The core feature of Discretionary Access Control (DAC) is that the owner of a resource has discretionary authority and can decide on their own which other individuals may be granted access to that resource. In this question, "a user who owns a resource wants to give other individuals access to the resource" is exactly the classic definition and application scenario of the DAC model — the authority to grant access rests with the resource owner personally, rather than being uniformly and mandatorily assigned by the system according to preset security levels (as in MAC) or roles (as in RBAC), which is entirely consistent with the owner's discretionary authorization mechanism commonly seen in operating system file permissions (such as Unix/Windows file sharing).
Question 3 of 10
An organization must terminate their cloud vendor agreement immediately What is the most secure way to delete the encrypted data stored in the cloud?
ATransfer the data to another locationTransferring the data to another location does not achieve the goal of deletion — it merely relocates the storage location, while the original copy on the cloud may still exist.
BInvoke the appropriate deletion clause in the cloud terms and conditions.Invoking the deletion clause in the cloud vendor's terms and conditions relies on unilateral execution by the vendor; the organization cannot independently verify or control the thoroughness or timeliness of its execution, making it less reliable and less controllable than independently destroying the encryption keys.
CObtain a destruction certificate from the cloud vendorObtaining a destruction certificate from the vendor is only an after-the-fact written statement, which cannot guarantee that the data has actually been irreversibly deleted at the technical level; it provides weaker security assurance than directly destroying the encryption keys.
DDestroy all encryption keys associated with the data
Why D is correct
When an organization needs to immediately terminate its cloud vendor agreement and ensure that encrypted data stored in the cloud is securely deleted, the most reliable approach is to **destroy all encryption keys** associated with that data. This method is known as crypto-shredding: as long as the keys used to encrypt the data are thoroughly and irrecoverably destroyed, the ciphertext itself — regardless of whether it still physically exists in cloud storage — becomes unreadable and undecryptable, which is equivalent to achieving effective deletion. This action can be independently controlled and executed by the data controller, without relying entirely on whether the cloud vendor actually carries out physical-level data erasure.
Question 4 of 10
In the realm of artificial intelligence, how has deep learning enabled greater implementation of machine learning?
ABy using hand-coded classifiers like edge detection filters so that a program can identify where an object starts and stops.Using hand-coded classifiers such as edge detection filters to identify object boundaries was the approach of traditional computer vision methods before the advent of deep learning — precisely the kind of manual feature engineering that deep learning sought to replace.
BBy increasing the size of neural networks and running massive amounts of data through the network to train it.
CBy using algorithmic approaches such as decision tree learning and inductive logic programming.Algorithmic approaches such as decision tree learning and inductive logic programming are classic branches of traditional machine learning, a different path from deep learning's reliance on large-scale neural networks trained on massive data.
DBy hand coding software routines with a specific set of instructions to accomplish a task.Hand-coding software routines with a specific set of instructions is the traditional rule-based programming paradigm, the opposite of deep learning's data-driven approach to automatically learning features.
Why B is correct
Deep learning has enabled greater implementation of machine learning by substantially increasing the size of neural networks (i.e., their depth) and training these large networks on massive amounts of data. This allows models to automatically learn multi-level feature representations from raw data, rather than relying on manually designed feature-extraction rules. This approach of scaling up network size combined with training on massive data has greatly enhanced machine learning models' ability to handle complex tasks such as images, speech, and natural language, and is the key to the breakthrough progress deep learning has achieved over traditional machine learning methods.
Question 5 of 10
Truncating the last octet of an IP address because it is NOT needed is an example of which privacy principle?
AUse LimitationThe Use Limitation principle concerns whether data may only be used for the purpose declared at the time of collection, not the precision or quantity of the data itself as collected or retained.
BData Minimization
CPurpose LimitationThe Purpose Limitation principle concerns whether data collection must have a clear, lawful purpose and not be used beyond that purpose, which addresses a different issue from truncating a field to reduce data precision.
DSecurity SafeguardsThe Security Safeguards principle concerns technical and organizational measures to prevent unauthorized access to or disclosure of data, not whether the amount or precision of data collected is necessary.
Why B is correct
Truncating the last octet of an IP address is a common technique aimed at retaining sufficiently coarse-grained information (such as an approximate geographic region) for statistical analysis while removing the portion that would allow precise identification of a specific user or device, thereby retaining only the minimum amount of information needed for the business purpose. This precisely embodies the core requirement of the Data Minimization principle: only collecting and retaining the minimum data necessary to achieve a specific purpose, and any degree of data precision beyond what is necessary (in this case, a complete, precise IP address) should be removed. This is also a typical example within CIPT of privacy engineering techniques (such as truncation, generalization, and aggregation) implementing the data minimization principle.
Question 6 of 10
What is the key idea behind the "flow" component of Nissenbaum's contextual integrity model?
AThe flow of information from one actor to another.This description is too generic and fails to capture the core qualifier emphasized by contextual integrity theory — that information flows under context-specific norms — omitting the key element of "context."
BThe integrity of information during each stage of the data lifecycle.Maintaining the integrity of each stage of the data life cycle belongs to the concept of data quality/data governance, not the meaning of the "flow" element in Nissenbaum's theory.
CThe maintenance of accuracy when personal information is transmitted.Maintaining accuracy during information transmission belongs to the data quality principle, which is a different concept from the "flow under contextual norms" described in contextual integrity theory.
DThe movement of personal information within a particular context or domain.
Why D is correct
Helen Nissenbaum's theory of contextual integrity holds that the core of information privacy lies not in whether information is "public" or "private," but in whether the flow of information conforms to the appropriate context-relative informational norms of its original context. The "flow" element in this model specifically refers to the movement of personal information within a particular context or domain — for example, the norms governing the flow of medical information within a doctor-patient context differ from those governing its flow within an insurance-review context. Once information leaves its original contextual norms and is transferred to an incompatible new context (a context violation), even if the content of the information is unchanged, this may still constitute a privacy violation. The theory emphasizes "context" rather than a mere "transfer from one party to another" in a physical sense (option A is too generic and omits this key qualifier), nor does it refer to the integrity of each stage of the data life cycle (B) or to maintaining accuracy during information transmission (C) — neither of which is the core definition of the "flow" element in this theory.
Question 7 of 10
What type of encryption uses one key for encryption and another key for decryption?
AApplication"Application" is not a standard classification term for encryption algorithm types; it is typically used to describe the layer at which encryption is applied (such as application-layer encryption), not whether encryption and decryption use different keys.
BField"Field" (field-level encryption) describes the data granularity to which encryption is applied, not whether encryption and decryption use different keys, which is the algorithmic feature at issue.
CSymmetricSymmetric encryption is precisely the case where encryption and decryption use the same key, which is the opposite of the stem's description of "one key for encryption and another for decryption."
DAsymmetric
Why D is correct
Asymmetric encryption (also known as public key encryption) uses a pair of keys — a public key for encryption and a private key for decryption. The two keys are mathematically related but cannot be derived from one another, thereby achieving a mechanism in which encryption and decryption use different keys. This contrasts with symmetric encryption, where the same key is used for both encryption and decryption, and that key must be securely shared between the communicating parties. Asymmetric encryption is commonly used in key exchange, digital signatures, and authentication, and is an important component of protocols such as TLS/SSL. Options A, "Application," and B, "Field," are not dimensions used to classify encryption algorithms, but rather non-standard terms describing the layer at which encryption is applied. Option C, symmetric encryption, is precisely the opposite of what is described in the stem.
Question 8 of 10
Which of the following CANNOT be effectively determined during a code audit?
AWhether access control logic is recommended in all cases.Whether access control logic is correctly invoked across all code paths is typical content that can be directly checked through static analysis in a code audit.
BWhether data is being incorrectly shared with a third-party.Whether data is being improperly shared with a third party can be discovered by reviewing the data flows, API calls, and third-party SDK integrations in the code, and falls within the routine scope of a code audit.
CWhether consent is durably recorded in the case of a server crash.
DWhether the differential privacy implementation correctly anonymizes data.Whether the specific implementation logic of an anonymization algorithm such as differential privacy is correct can be determined by reviewing the algorithm code and parameter configuration, which falls within what a code audit can cover.
Why C is correct
A code audit primarily uses static or dynamic analysis of source code logic to determine whether access control logic has been correctly implemented, whether data is being improperly shared with a third party, and whether an anonymization algorithm (such as differential privacy) has been correctly implemented — all conclusions that can be reached by reviewing the code logic itself. However, whether consent is durably recorded in the event of a server crash involves runtime fault-tolerance behavior, the persistence guarantees of the storage system, and actual system behavior in failure scenarios. Such questions often require fault injection testing, disaster recovery drills, or system operation monitoring to verify, and are difficult to determine with certainty through code review alone.
Question 9 of 10
Which of the following is an example of a just-in-time notice?
AA browser warning that a website may be unsafeA browser warning that a website is unsafe is a security alert mechanism, not a contextual privacy information prompt, so it does not constitute a just-in-time notice.
BAn SMS sent to authorize access to an appSending an SMS code to authorize access is part of an authentication process, not the display of privacy information.
CA credit card company using Multi-Factor Authentication (MFA) to authorize a purchaseA credit card company using multi-factor authentication to authorize a transaction is a security verification mechanism, distinct in nature from the "information disclosure" purpose of a privacy notice.
DPrivacy information given to a user when he attempts to comment on an online article
Why D is correct
A just-in-time notice is a concise privacy notice displayed at the moment a user is about to take a specific action — exactly when that information is needed for the decision — rather than all privacy policy content being bundled together into one lengthy privacy notice. When a user attempts to comment on an online article, the system presents privacy information relevant to the commenting function at that exact moment (such as how the comment content will be used or whether it will be displayed publicly), which is a typical example of providing a timely, contextually relevant privacy notice at the key moment a user performs a specific action — the essence of a just-in-time notice. Option A is a security warning, and B and C are authentication/authorization mechanisms; none of these constitute a just-in-time notice in the sense of displaying privacy information.
Question 10 of 10
Which of the following statements describes an acceptable disclosure practice?
AAn organization's privacy policy discloses how data will be used among groups within the organization itself.
BWith regard to limitation of use, internal disclosure policies override contractual agreements with third parties.With regard to limiting data use, the contractual obligations an organization enters into with a third party (such as a data processing agreement) should generally be strictly observed; internal disclosure policy cannot override these legally binding external commitments.
CIntermediaries processing sensitive data on behalf of an organization require stricter disclosure oversight than vendors.Intermediaries handling sensitive data generally require stricter, not more lenient, disclosure oversight, because a breach of sensitive data causes greater harm, so the level of oversight should be strengthened rather than reduced.
DWhen an organization discloses data to a vendor, the terms of the vendor' privacy notice prevail over the organization' privacy notice.When an organization discloses data to a vendor, the commitments made in the organization's own privacy notice (its obligations to the data subject) should generally continue to apply and remain binding, rather than being simply replaced or overridden by the terms of the vendor's privacy notice.
Why A is correct
An acceptable disclosure practice is one in which an organization clearly states in its privacy policy how personal data will be shared and used among groups or departments within the organization itself. This aligns with the core requirement of the transparency principle — individuals have the right to know the scope and manner in which their data flows within the organization, and this is also one of the most basic functions of a privacy policy or notice. In contrast, internal disclosure policies overriding contractual obligations with third parties, a vendor's privacy notice terms taking precedence over the organization's own privacy notice, and intermediaries handling sensitive data requiring more lenient oversight than ordinary vendors — all of these statements violate the basic principle that a data controller bears primary responsibility for the data it discloses and must use means such as contracts to ensure that third-party processors comply with equal or stricter protective obligations.
These 10 are a sample
✓345 questions, each with the full reasoning
✓Every wrong option explained, not just the right one
✓9 chapters of syllabus notes, written from a cold start
✓Full-length mock exam with per-domain scoring
✓Printable PDF included — one purchase, no renewal