View Full IAPP CIPT Exam Dumps and Practice Test Dumps

 

Question 361.

A privacy engineer is reviewing a browser-based application that stores sensitive user data in localStorage even though the information is needed only during the current session. Which design is more appropriate?

1. Store the data permanently in localStorage
   2. Use session-scoped storage or avoid client-side persistence when feasible
   3. Copy the values into additional browser caches
   4. Expose the values through URL parameters

Correct Answer: 2. Use session-scoped storage or avoid client-side persistence when feasible

Explanation:

Client-side storage should match the duration and sensitivity of the information being processed. If data is needed only during one session, long-lived browser storage may create unnecessary persistence and increase exposure on shared or compromised devices. Privacy engineers should assess whether the data needs to be stored in the browser at all and, if so, choose a mechanism aligned with the required lifetime. Sensitive data should also be protected from unnecessary script access. Minimizing persistence supports storage limitation and reduces the amount of personal information that remains after the user finishes the activity.

Question 362.

A website uses several third-party scripts that can access page content and transmit network requests. Which privacy engineering activity is most important before deployment?

1. Review the scripts’ data access, network behavior, permissions, and downstream destinations
   2. Assume all third-party scripts are privacy safe
   3. Give every script access to all page data
   4. Disable monitoring of third-party requests

Correct Answer: 1. Review the scripts’ data access, network behavior, permissions, and downstream destinations

Explanation:

Third-party scripts can introduce privacy risks by collecting identifiers, page content, device information, or behavioral data that the host application did not intend to disclose. Privacy engineers should review what each script can access, inspect actual network traffic, verify configuration, understand downstream recipients, and determine whether collection aligns with the approved purpose. Dependency updates should also be monitored because behavior can change over time. Relying solely on documentation or contractual assumptions may miss runtime data flows. Third-party code should therefore be treated as part of the application’s privacy attack surface.

Question 363.

A mobile application includes a third-party SDK that begins transmitting a device identifier after a software update. Which control would most effectively help detect this change before release?

1. Longer data retention
   2. More administrator accounts
   3. Automated network inspection and privacy regression testing
   4. Broader production access

Correct Answer: 3. Automated network inspection and privacy regression testing

Explanation:

Third-party SDK behavior can change between versions, including the data collected or transmitted. Automated privacy regression tests can inspect network requests, compare expected endpoints and payloads, and flag newly introduced identifiers or transfers before deployment. Privacy engineers should combine this with dependency review and change management. Manual reviews alone may not scale when applications release frequently. Monitoring actual runtime behavior is particularly valuable because SDK documentation may not fully reflect what the code transmits under every configuration.

Question 364.

A website places a user’s email address in a URL query string during account recovery. Why should a privacy engineer recommend changing this design?

1. URLs cannot contain text
   2. Query strings are always deleted immediately
   3. HTTPS makes URL exposure impossible
   4. The email may appear in browser history, logs, analytics systems, and referrer information**

Correct Answer: 4. The email may appear in browser history, logs, analytics systems, and referrer information

Explanation:

Information embedded in URLs can propagate beyond the application itself. Query strings may be stored in browser history, web-server logs, proxy logs, monitoring platforms, analytics tools, screenshots, bookmarks, and referrer information. HTTPS protects the URL during transport from many network observers but does not prevent later storage or disclosure by application components. Privacy engineers should avoid putting unnecessary personal data or secrets in URLs and use safer mechanisms for passing state. Metadata leakage can create privacy exposure even when the underlying application is otherwise secure.

Question 365.

A company stores authentication tokens in ordinary application logs to simplify debugging. What should the privacy engineer recommend?

1. Exclude or securely redact authentication tokens from logs
   2. Retain the tokens indefinitely
   3. Share the logs broadly with developers
   4. Put additional credentials into the same log stream

Correct Answer: 1. Exclude or securely redact authentication tokens from logs

Explanation:

Authentication tokens can grant access to accounts or services and should not appear in routine logs. If logs are compromised, broadly accessible, or retained for long periods, exposed tokens may create both security and privacy risks. Privacy engineers should design logging schemas that exclude secrets and minimize personal data while retaining enough diagnostic information for operations. Redaction, structured logging, access controls, and retention limits can help. Logs are often copied into centralized systems, so accidental inclusion of credentials can greatly expand their exposure.

Question 366.

A company wants to prevent sensitive personal data from leaving its network through unauthorized uploads or email attachments. Which class of control is most relevant?

1. Content delivery networking
   2. Data loss prevention and egress controls
   3. Screen-resolution management
   4. Database indexing

Correct Answer: 2. Data loss prevention and egress controls

Explanation:

Data loss prevention controls can identify and restrict unauthorized movement of sensitive information through channels such as email, file uploads, removable media, or cloud applications. Egress controls can further limit which destinations systems are allowed to communicate with. Privacy engineers should use these controls as part of a broader strategy that includes classification, least privilege, encryption, monitoring, and user education. DLP is not perfect and can produce false positives, but it can help detect or prevent large accidental or malicious disclosures of personal information.

Question 367.

A company wants applications to enforce different handling rules based on whether data is public, internal, confidential, or highly sensitive. Which foundational capability best supports this?

1. Faster processors
   2. Additional backups
   3. Data classification and sensitivity labeling
   4. Universal access permissions

Correct Answer: 3. Data classification and sensitivity labeling

Explanation:

Data classification provides a structured way to identify sensitivity and apply appropriate controls. Labels can drive access restrictions, encryption requirements, retention rules, monitoring, export limitations, and handling procedures. Privacy engineers should ensure classifications reflect both the content and context of the data rather than relying solely on field names. Automated discovery can help, but human governance may still be needed for ambiguous cases. Classification is foundational because many downstream privacy and security controls depend on knowing which information requires stronger protection.

Question 368.

A company must preserve certain backup snapshots for operational recovery, but individual records may later be deleted from active systems. Which approach best addresses privacy in immutable backups?

1. Pretend backup copies do not exist
   2. Restore backups regularly so deleted records return to production
   3. Make backups publicly accessible
   4. Restrict backup access, define retention, prevent deleted records from re-entering active use, and expire backups according to policy**

Correct Answer: 4. Restrict backup access, define retention, prevent deleted records from re-entering active use, and expire backups according to policy

Explanation:

Immutable backups can make immediate record-level deletion technically difficult. Privacy engineering should therefore focus on strong access controls, encryption, defined backup retention, and procedures that prevent deleted information from being restored into active processing without appropriate handling. When backups expire, they should be securely removed according to policy. The organization should document the lifecycle and ensure backups are used primarily for recovery rather than ordinary analytics. Backup architecture should support resilience without turning historical personal data into an uncontrolled permanent archive.

Question 369.

A company wants to understand which source system produced a customer attribute and how that value changed as it moved through analytics pipelines. Which capability is most relevant?

1. Data lineage and provenance
   2. Screen caching
   3. Password rotation
   4. Content delivery networks

Correct Answer: 1. Data lineage and provenance

Explanation:

Data lineage describes how information moves through systems, while provenance helps explain where a value originated and how it was transformed. These capabilities are valuable for privacy because they support correction, deletion, accountability, impact analysis, and troubleshooting. If a questionable attribute appears in a downstream model or report, lineage can help identify the original source and intermediate transformations. Privacy engineers should incorporate lineage metadata into complex data platforms so lifecycle controls are not dependent on manual guesswork.

Question 370.

An organization creates a detailed identity graph that links email addresses, devices, purchase records, and location events across multiple services. What privacy risk should receive particular attention?

1. Reduced screen performance
   2. Increased linkability and comprehensive profiling
   3. Slower password hashing
   4. Loss of database indexes

Correct Answer: 2. Increased linkability and comprehensive profiling

Explanation:

Identity graphs can combine fragmented information into a highly detailed view of an individual. While this may support legitimate functions, it also increases the ability to profile behavior across contexts and may enable sensitive inference. Privacy engineers should assess whether all linkages are necessary, whether identifiers can be scoped by context, who can access the graph, and how long mappings are retained. Centralized identity resolution can become a powerful privacy risk if purpose boundaries are weak. The architecture should therefore limit unnecessary linkage rather than treating maximum correlation as inherently desirable.

Question 371.

An account-recovery process asks users to submit a passport scan even when a lower-risk verification method would be sufficient. Which privacy principle is most relevant?

1. Data minimization
   2. Data replication
   3. Universal logging
   4. Indefinite retention

Correct Answer: 1. Data minimization

Explanation:

Account recovery should verify the user while collecting the least additional personal information necessary. A passport contains far more information than many recovery scenarios require. If a lower-risk verification method can provide sufficient assurance, collecting a full identity document creates unnecessary exposure and lifecycle obligations. Privacy engineers should also consider retention, access restrictions, redaction, and whether temporary verification data can be deleted promptly. Security needs are important, but they should be balanced with minimization rather than automatically driving collection of the most sensitive evidence available.

Question 372.

A company stores biometric templates for authentication. Which design can reduce exposure compared with centrally storing reusable raw biometric images?

1. Publish the raw biometric images
   2. Store copies in multiple unrelated databases
   3. Use the same unprotected template across all systems
   4. Prefer protected templates and on-device matching where appropriate**

Correct Answer: 4. Prefer protected templates and on-device matching where appropriate

Explanation:

Biometric information is difficult or impossible to replace if compromised, so architecture should minimize centralized exposure. Protected templates and on-device matching can reduce the need to transmit or store raw biometric images centrally. Privacy engineers should also evaluate template revocability, unlinkability across systems, device security, fallback authentication, and retention. No biometric system is risk free, but designs that avoid unnecessary central repositories can reduce breach impact. Raw biometric data should not be retained merely because it is convenient.

Question 373.

A service wants to verify that a user meets an age threshold while collecting as little identity information as possible. Which design approach best supports this goal?

1. Use an age-assurance method that returns only the required eligibility result where feasible
   2. Require a full identity profile from every user
   3. Retain government documents permanently
   4. Share exact birth dates with all relying services

Correct Answer: 1. Use an age-assurance method that returns only the required eligibility result where feasible

Explanation:

Privacy-preserving age assurance focuses on proving the required property without collecting or sharing more identity information than necessary. If the service needs only to know whether a threshold is met, a derived eligibility result can reduce disclosure compared with sharing an exact birth date or full identity document. Privacy engineers should still evaluate the reliability of the method, retention, security, and potential for linkage across services. Selective disclosure is generally preferable when the relying service does not need the underlying source attributes.

Question 374.

A user changes a privacy preference on one device, but the old setting remains active on other devices and backend services. Which capability should the system improve?

1. Screen rendering
   2. Preference-state synchronization and propagation
   3. Database compression
   4. Printer management

Correct Answer: 2. Preference-state synchronization and propagation

Explanation:

Privacy choices should be represented consistently across the systems that enforce them. If a preference changes on one device but remains stale elsewhere, the user may experience processing that contradicts their current choice. Privacy engineers should define a reliable source of truth, propagation mechanism, conflict-handling logic, and validation process for preference state. Distributed caches, mobile clients, event pipelines, and third-party systems may all need updates. Effective user control depends on synchronized technical enforcement, not merely on one local settings screen.

Question 375.

A user requests a copy of personal data in a form that can be reused in another service. Which engineering capability best supports portability?

1. Export data in a structured, commonly usable machine-readable format
   2. Provide screenshots only
   3. Print the data and mail it
   4. Return only an internal database identifier

Correct Answer: 1. Export data in a structured, commonly usable machine-readable format

Explanation:

Portability is easier to support when systems can export relevant information in a structured format that other software can process. Privacy engineers should design data models and export services so records can be collected accurately from appropriate systems and represented consistently. The export process should also authenticate the requester and avoid including information belonging to other people unnecessarily. Screenshots or proprietary internal identifiers provide little practical reuse. A well-designed portability function treats the requirement as an engineering capability rather than an ad hoc manual task.

Question 376.

A company needs to verify the identity of someone making a data-access request. Which approach best balances security and privacy?

1. Collect the maximum possible identification information every time
   2. Publish the requester’s account details
   3. Skip identity verification entirely
   4. Use verification proportionate to the risk while minimizing additional personal-data collection**

Correct Answer: 4. Use verification proportionate to the risk while minimizing additional personal-data collection

Explanation:

Identity verification is important because releasing personal data to the wrong person creates serious privacy risk. However, the verification process should not automatically require more sensitive information than necessary. Privacy engineers should use a method proportionate to the sensitivity of the requested data and available account context. Existing authenticated channels may sometimes provide sufficient assurance. Additional documents should be collected only when justified and retained no longer than necessary. The goal is to prevent unauthorized disclosure without creating a second, excessive identity-collection problem.

Question 377.

A multi-tenant SaaS product relies only on application code to separate tenants. Which additional database control can provide defense in depth against cross-tenant access?

1. Row-level security or equivalent tenant-aware database enforcement
   2. Shared administrator credentials
   3. Public database access
   4. Removing tenant identifiers from queries

Correct Answer: 1. Row-level security or equivalent tenant-aware database enforcement

Explanation:

Application-level authorization is important, but database-level controls can add defense in depth. Row-level security can restrict which records a session or service is allowed to access based on tenant context. This reduces the risk that a coding error in one query exposes another tenant’s records. Privacy engineers should still test tenant isolation across APIs, caches, background jobs, exports, and administrative tools. Strong multi-tenant privacy requires consistent enforcement at multiple layers rather than relying on a single application check.

Question 378.

A company wants access decisions to consider a user’s role, department, data sensitivity, location, and the purpose of access. Which authorization model is especially suitable?

1. Anonymous access
   2. Attribute-based access control
   3. One shared administrator account
   4. Public-read permissions

Correct Answer: 2. Attribute-based access control

Explanation:

Attribute-based access control can make authorization decisions using multiple characteristics of the user, resource, environment, and requested action. This can support fine-grained privacy policies, such as allowing access only when a person’s role, department, purpose, and data sensitivity align with defined rules. Privacy engineers should keep policy logic understandable, testable, and auditable because overly complex rules can become difficult to manage. ABAC is particularly useful when simple role membership cannot express the context required for privacy-aware access decisions.

Question 379.

An attacker repeatedly tests an account-recovery endpoint to determine which email addresses are registered. What privacy issue does this represent?

1. User enumeration
   2. Differential privacy
   3. Homomorphic encryption
   4. Data compression

Correct Answer: 1. User enumeration

Explanation:

User enumeration occurs when system responses reveal whether a particular identifier corresponds to an existing account. Attackers may exploit different error messages, response times, or recovery behavior to build lists of registered users. This can expose membership in a service and support phishing or other attacks. Privacy engineers should use consistent responses, appropriate rate limits, monitoring, and careful recovery workflows. The goal is to provide legitimate account assistance without turning the endpoint into a directory of user identities.

Question 380.

A company wants privacy controls to remain effective as infrastructure, code, dependencies, and data flows change continuously. Which engineering approach is strongest?

1. Perform a privacy review once at initial launch
   2. Depend on policy documents without technical verification
   3. Allow configuration changes without monitoring
   4. Integrate privacy checks into CI/CD, infrastructure changes, dependency review, runtime monitoring, and regression testing**

Correct Answer: 4. Integrate privacy checks into CI/CD, infrastructure changes, dependency review, runtime monitoring, and regression testing

Explanation:

Modern systems change constantly, so privacy safeguards can degrade through code updates, new SDKs, configuration drift, infrastructure changes, or altered data flows. A mature privacy engineering program continuously validates important requirements. Automated tests can detect forbidden logging or excessive collection, dependency reviews can identify new data behavior, and runtime monitoring can reveal unexpected transfers. Infrastructure and configuration changes should also trigger appropriate review. Continuous privacy engineering reduces privacy debt and helps ensure protections remain effective throughout the operational lifecycle rather than only at initial launch.