View Full IAPP CIPT Exam Dumps and Practice Test Dumps

 

Question 341.

A privacy engineer is designing a public statistics service and wants to reduce the ability to determine whether a particular individual contributed to the dataset. Which privacy-enhancing technique is specifically designed to provide mathematically bounded privacy loss by adding controlled randomness?

1. Differential privacy
   2. Full-text indexing
   3. Role-based access control
   4. Data replication

Correct Answer: 1. Differential privacy

Explanation:

Differential privacy is designed to limit how much the presence or absence of one individual can influence a released result. It generally achieves this by introducing carefully calibrated randomness into queries or statistical outputs. A privacy parameter controls the tradeoff between privacy protection and analytical accuracy. Differential privacy does not eliminate the need for access controls or data governance, but it can provide stronger protection against inference attacks than simply removing direct identifiers. Privacy engineers should understand the privacy budget, query composition, and utility tradeoffs when applying it to real systems.

Question 342.

A company applies differential privacy to repeated statistical queries. What concept is most important for controlling cumulative privacy risk across those queries?

1. Database sharding
   2. Privacy budget
   3. Password rotation
   4. Network segmentation

Correct Answer: 2. Privacy budget

Explanation:

In differential privacy, repeated queries can accumulate privacy loss. A privacy budget provides a way to track and limit that cumulative exposure. Each query consumes some portion of the available budget depending on the mechanism and parameters used. Once too much budget is consumed, additional queries may need to be blocked, modified, or answered with greater noise. Privacy engineers therefore need to consider query composition rather than evaluating each query independently. A privacy budget is distinct from ordinary access control or infrastructure concepts and is central to operationalizing differential privacy safely.

Question 343.

A dataset satisfies k-anonymity, but every person within one equivalence group has the same sensitive diagnosis. What privacy weakness does this illustrate?

1. Weak transport encryption
   2. Poor authentication
   3. Attribute disclosure despite k-anonymity
   4. Excessive database replication

Correct Answer: 3. Attribute disclosure despite k-anonymity

Explanation:

K-anonymity can reduce identity disclosure by ensuring each record is indistinguishable from at least k−1 others based on selected quasi-identifiers. However, it does not guarantee diversity in sensitive attributes. If everyone in an equivalence group has the same diagnosis, an observer who can place someone in that group may infer the diagnosis even without identifying the exact row. Techniques such as l-diversity and t-closeness were developed to address some of these limitations conceptually. Privacy engineers should therefore avoid treating k-anonymity as complete protection against all forms of inference.

Question 344.

A research consortium wants several organizations to compute a joint statistical result without each organization revealing its raw input data to the others. Which technology is most directly suited to this goal?

1. Data warehousing
   2. Public-key directories
   3. Content delivery networks
   4. Secure multiparty computation**

Correct Answer: 4. Secure multiparty computation

Explanation:

Secure multiparty computation allows multiple parties to jointly compute a function over their inputs while limiting disclosure of the underlying inputs to the other participants. This can support collaborative analytics where organizations want a combined result but cannot or should not pool their raw data centrally. Privacy engineers must still consider protocol assumptions, implementation quality, output leakage, participant behavior, and performance. The technique can reduce the need for centralized raw-data sharing and is an important privacy-enhancing technology for multi-organization computation.

Question 345.

A company wants a cloud service to perform certain computations on encrypted data without first decrypting the underlying values. Which cryptographic approach is designed for this purpose?

1. Homomorphic encryption
   2. Ordinary hashing
   3. Data masking
   4. Access logging

Correct Answer: 1. Homomorphic encryption

Explanation:

Homomorphic encryption allows selected computations to be performed directly on encrypted values, producing an encrypted result that can later be decrypted by an authorized party. This can reduce exposure of plaintext data during processing. Different schemes support different operations and may involve significant computational overhead, so the technology is not appropriate for every workload. Privacy engineers should assess performance, supported operations, key management, and whether output data can still reveal sensitive information. It is conceptually distinct from hashing, masking, or logging because it enables computation while data remains encrypted.

Question 346.

A company uses federated learning so mobile devices train locally and send model updates instead of raw records. Which statement best describes the privacy benefit and limitation?

1. Federated learning guarantees complete anonymity
   2. It reduces central collection of raw data, but model updates can still leak information and may require additional protections
   3. It eliminates the need for security controls
   4. It requires all raw data to be centralized before training

Correct Answer: 2. It reduces central collection of raw data, but model updates can still leak information and may require additional protections

Explanation:

Federated learning can reduce the need to centralize raw training data by performing training locally on participating devices or systems. However, model updates may still reveal information through attacks or unintended leakage. Additional protections such as secure aggregation, differential privacy, strong authentication, and careful update handling may therefore be necessary. Privacy engineers should avoid assuming federated learning automatically makes a system private. It changes the data architecture and can reduce certain risks, but it introduces its own threat model and operational considerations.

Question 347.

A mobile application wants to collect usage statistics while limiting how much the server can learn about any individual user’s exact response. Which technique can add randomized noise on the user’s device before the data is transmitted?

1. Data replication
   2. Tokenization
   3. Local differential privacy
   4. Backup encryption

Correct Answer: 3. Local differential privacy

Explanation:

Local differential privacy applies randomization before data leaves the user’s device, meaning the server receives a perturbed value rather than the original response. This can reduce trust requirements because the central collector does not necessarily observe each user’s exact input. The challenge is that substantial noise may be needed to achieve strong protection, which can reduce analytical utility. Privacy engineers must therefore carefully choose mechanisms, parameters, sample sizes, and aggregation strategies. Local differential privacy is especially useful when the server itself should not learn precise individual responses.

Question 348.

A user needs to prove that they are over a required age without revealing their exact date of birth. Which privacy-enhancing concept is most relevant?

1. Full identity disclosure
   2. Shared administrator accounts
   3. Public-key logging
   4. Selective disclosure or zero-knowledge-style proof**

Correct Answer: 4. Selective disclosure or zero-knowledge-style proof

Explanation:

Selective disclosure allows a person to prove a specific property, such as meeting an age threshold, without necessarily revealing the underlying attribute in full. Zero-knowledge proof techniques can support certain forms of verification where the verifier learns that a statement is true without learning the secret information used to prove it. Privacy engineers should choose an implementation appropriate to the trust model, credential ecosystem, and performance requirements. The central privacy benefit is minimizing disclosure by proving only what the relying party actually needs to know.

Question 349.

A company hashes email addresses without a salt and then claims the resulting values are anonymous. Why should a privacy engineer challenge this conclusion?

1. Predictable identifiers can often be guessed and hashed for comparison, enabling reidentification
   2. Hashing always increases data precision
   3. Hashing automatically makes data public
   4. Hashing prevents all record linkage

Correct Answer: 1. Predictable identifiers can often be guessed and hashed for comparison, enabling reidentification

Explanation:

Unsalted hashes of predictable values such as email addresses can often be reversed indirectly through dictionary-style attacks. An attacker can generate likely email addresses, hash them using the same algorithm, and compare the outputs. Hashing also preserves deterministic equality, which can enable linkage across datasets using the same scheme. Privacy engineers should therefore distinguish hashing from true anonymization. Depending on the use case, keyed hashing, tokenization, pseudonymization, or other techniques may provide stronger protection, but the residual ability to reidentify or link records must still be assessed.

Question 350.

A company wants to reduce cross-system linkability while still using stable identifiers within each application. Which design is best?

1. Use one global identifier across every service
   2. Use different scoped identifiers for different contexts and protect any mapping between them
   3. Put direct identifiers in all event streams
   4. Publish the identifier mapping internally

Correct Answer: 2. Use different scoped identifiers for different contexts and protect any mapping between them

Explanation:

Context-specific identifiers reduce the ability to correlate a person’s activity automatically across unrelated systems. Each application can maintain stable identity within its own context while a controlled mapping service handles legitimate cross-context needs. Privacy engineers should tightly restrict access to that mapping and monitor its use because it becomes a sensitive linkage point. A single global identifier makes broad profiling and correlation easier. Scoped identifiers therefore support the privacy design strategy of separation while preserving necessary application functionality.

Question 351.

A privacy threat-modeling team wants a framework focused specifically on threats such as linkability, identifiability, detectability, disclosure, unawareness, and non-compliance. Which framework is most relevant?

1. LINDDUN
   2. RAID
   3. RAID-10
   4. DNSSEC

Correct Answer: 1. LINDDUN

Explanation:

LINDDUN is a privacy threat-modeling methodology focused on privacy-specific threat categories such as linkability, identifiability, non-repudiation, detectability, disclosure of information, unawareness, and non-compliance. It helps engineering teams systematically identify privacy threats in data flows and system architecture. Privacy engineers may use it alongside security-focused approaches rather than as a replacement for them. Frameworks such as STRIDE are more focused on security threats, while LINDDUN emphasizes privacy harms and information relationships that may occur even when traditional security controls are functioning correctly.

Question 352.

A team has already performed a STRIDE security threat model. Why might it still perform a separate privacy-focused threat analysis?

1. STRIDE guarantees that all privacy risks are already covered
   2. Privacy risks can arise from legitimate, authorized processing even when traditional security controls work correctly
   3. Privacy analysis is only necessary when encryption is absent
   4. Security threat modeling makes data minimization unnecessary

Correct Answer: 2. Privacy risks can arise from legitimate, authorized processing even when traditional security controls work correctly

Explanation:

Security and privacy overlap, but they are not identical. A system can be secure against unauthorized access while still creating privacy risks through excessive collection, unnecessary linkage, profiling, sensitive inference, or unexpected secondary use. Privacy-focused threat analysis helps teams evaluate these authorized-but-harmful scenarios. STRIDE is useful for security threats such as spoofing, tampering, and elevation of privilege, while privacy methods focus more directly on information relationships and user impact. Mature engineering programs therefore consider both security and privacy threat models.

Question 353.

A company wants every new feature to demonstrate how its privacy requirements were implemented and tested. Which engineering practice best supports this goal?

1. Requirements traceability from privacy requirements to design, implementation, and test evidence
   2. Informal verbal agreements
   3. Removing acceptance criteria
   4. Testing only after production incidents

Correct Answer: 1. Requirements traceability from privacy requirements to design, implementation, and test evidence

Explanation:

Requirements traceability connects privacy requirements to system architecture, implementation tasks, test cases, and evidence that the controls work. This makes privacy expectations measurable and easier to validate throughout the software development lifecycle. For example, a deletion requirement can be linked to APIs, data stores, automated tests, and operational monitoring. Privacy engineers can use traceability to detect gaps when systems change. Informal requirements are more easily lost or misunderstood. Traceability therefore supports accountability, regression prevention, and continuous privacy engineering.

Question 354.

A development team wants to ensure a new release does not accidentally begin logging email addresses after a refactor. Which control is most effective?

1. Manual review once per year
   2. Automated privacy regression tests in the CI/CD pipeline
   3. Longer log retention
   4. Broader developer access to production logs

Correct Answer: 2. Automated privacy regression tests in the CI/CD pipeline

Explanation:

Automated privacy regression tests can detect whether software changes reintroduce behaviors that violate established privacy requirements. In this scenario, tests could inspect log output for prohibited identifiers or validate approved logging schemas. Integrating these checks into CI/CD provides feedback before deployment and helps prevent privacy controls from silently degrading as code evolves. Manual reviews remain useful but may not scale to frequent releases. Privacy requirements are stronger when they are encoded as repeatable technical tests rather than relying only on documentation or developer memory.

Question 355.

A privacy engineer discovers that customer identifiers are being included in URLs as query parameters. Why is this risky?

1. URLs can be exposed through browser history, server logs, analytics tools, and referrer information
   2. URLs are always encrypted permanently
   3. Query parameters cannot be logged
   4. Identifiers in URLs automatically become anonymous

Correct Answer: 1. URLs can be exposed through browser history, server logs, analytics tools, and referrer information

Explanation:

Sensitive information in URLs can propagate through many systems beyond the application itself. Query strings may appear in browser history, reverse-proxy logs, analytics platforms, screenshots, bookmarks, monitoring tools, and referrer headers. Privacy engineers should avoid placing unnecessary personal or secret values in URLs and instead use safer state-management or request-body mechanisms when appropriate. Even when HTTPS protects transport, URLs may still be stored or exposed after transmission. Metadata leakage through URLs is therefore an important privacy engineering concern.

Question 356.

A crash-reporting service automatically collects application memory and diagnostic context. What should a privacy engineer do before enabling it in production?

1. Send all memory contents without review
   2. Retain every crash report permanently
   3. Make crash reports publicly accessible
   4. Evaluate and minimize personal data captured in diagnostics, then apply access and retention controls**

Correct Answer: 4. Evaluate and minimize personal data captured in diagnostics, then apply access and retention controls

Explanation:

Crash reports can unintentionally capture names, message content, authentication tokens, identifiers, URLs, or other sensitive information. Privacy engineers should review what the diagnostic tooling collects, configure redaction or filtering, and limit captured data to what is necessary for debugging. Access should be restricted, retention periods defined, and third-party diagnostic services reviewed carefully. Diagnostic usefulness does not justify indiscriminate collection. Privacy-aware observability requires deliberate control over what operational tooling records and where that information flows.

Question 357.

A multi-tenant SaaS application stores data for many customers in the same database. Which control is especially important to prevent one tenant from accessing another tenant’s records?

1. Strong tenant isolation enforced through authorization and data-access controls
   2. Shared customer credentials
   3. One unrestricted administrator token for all tenants
   4. Public database endpoints

Correct Answer: 1. Strong tenant isolation enforced through authorization and data-access controls

Explanation:

Multi-tenant systems require reliable separation between tenants even when they share infrastructure. Privacy engineers should ensure tenant identity is enforced at every relevant access layer, such as application authorization, database queries, row-level security, APIs, caches, and background jobs. Tests should verify that manipulating identifiers cannot expose another tenant’s information. A single authorization defect can create large-scale cross-customer disclosure. Tenant isolation is therefore a core privacy and security requirement for SaaS architectures.

Question 358.

A company wants a small emergency operations team to gain temporary access to sensitive data during a critical incident, while preventing ordinary use of that access. Which design is most appropriate?

1. Permanent administrator access for the entire team
   2. Controlled break-glass access with strong authentication, limited duration, justification, and audit logging
   3. Shared passwords stored in a document
   4. Anonymous emergency accounts

Correct Answer: 2. Controlled break-glass access with strong authentication, limited duration, justification, and audit logging

Explanation:

Break-glass access provides exceptional privileges for genuine emergencies while preserving accountability and least privilege during normal operations. A strong design should require authenticated individual identities, explicit justification, time-limited access, monitoring, and post-event review. The mechanism should be difficult to use casually but available when operationally necessary. Permanent broad access would expose sensitive information unnecessarily, while shared or anonymous emergency accounts weaken accountability. Privacy engineers should treat exceptional access as a tightly governed workflow rather than a standing privilege.

Question 359.

A public analytics interface allows users to run many overlapping aggregate queries. An attacker subtracts the results of two queries to infer information about one individual. What type of attack is this?

1. Differencing attack
   2. Phishing attack
   3. Denial-of-service attack
   4. Password-spraying attack

Correct Answer: 1. Differencing attack

Explanation:

A differencing attack compares results from overlapping queries to isolate information that is not directly displayed. For example, if one result contains a group and another contains the same group except for one person, subtracting the results may reveal that person’s value. Simple minimum group-size thresholds may not be sufficient against this technique. Privacy engineers can consider query auditing, suppression, differential privacy, noise addition, rate limits, or restrictions on overlapping queries. Statistical interfaces should therefore be evaluated for cumulative inference risk rather than only individual query safety.

Question 360.

A company wants privacy protections to remain effective as systems evolve through frequent software releases. Which approach provides the strongest foundation?

1. Depend on developer memory
   2. Review privacy only after incidents
   3. Document requirements but never test them
   4. Integrate privacy requirements, automated tests, dependency review, monitoring, change management, and regression checks into the development lifecycle**

Correct Answer: 4. Integrate privacy requirements, automated tests, dependency review, monitoring, change management, and regression checks into the development lifecycle

Explanation:

Privacy controls can degrade as code, dependencies, infrastructure, and data flows change. A mature program treats privacy as part of continuous engineering rather than a one-time design exercise. Requirements should be traceable, important behaviors should be automatically tested, new SDKs and dependencies should be reviewed, and monitoring should identify unexpected data collection or transfer. Change management should trigger reassessment when architecture or purposes change. Continuous validation helps prevent privacy debt and ensures previously implemented safeguards remain effective as the product evolves.