Which of the following is NOT a workplace surveillance best practice?
Answer(s): B
Why option B is NOT a best practiceDiscreet surveillance can encourage covert monitoring – When surveillance is hidden from employees, they are unable to adjust their behavior consciously, which can lead to a climate of suspicion and may violate privacy expectations. Best-practice frameworks (e.g., ISO 27001, sector-specific guidance) emphasize transparency and clear communication about what is monitored, not concealment. It undermines the principle of minimal intrusion – Best practice dictates that monitoring measures should be as unobtrusive as possible while still achieving the legitimate business objective , but the goal is to balance minimized impact with the need for openness. Hiding the surveillance devices does not meet the “minimal intrusion” principle; it actually increases the intrusiveness by preventing users from self-regulating. Regulatory and reputational risk – Many privacy regulations require that data collectors inform data subjects about the existence of surveillance. Concealing monitoring can breach these legal obligations (e.g., GDPR, CCPA) and damage employee trust.Why the other options ARE best practicesA: Check local privacy laws before putting surveillance in place – Compliance with applicable statutes (e.g., GDPR Art. 87, U.S. state privacy acts) is a foundational step; ignoring legal obligations can make any surveillance initiative invalid and expose the organization to penalties.C: Once surveillance data has been gathered, limit exposure of the content – Access controls, need-to-know policies, and data-minimization controls ensure that collected footage or logs are only viewed by authorized personnel, reducing the risk of misuse or unauthorized disclosure. D. Ensure the minimal amount of surveillance is performed to meet the objective – This aligns with the “privacy by design” principle: only the data necessary to achieve the legitimate purpose should be collected, processed, and retained.ConclusionOption B is incorrect because covert surveillance contradicts established privacy-by-design and transparency best practices; the other choices reflect core compliance, data-minimization, and protection measures that are widely recognized as best practices for workplace surveillance.
International Association of Privacy Professionals (IAPP) – Guide to Monitoring Employee Activity https://iapp.org/resources/gdpr/employee-monitoring/European Data Protection Board (EDPB) – Guidance on the processing of personal data at work https://edpb.europa.eu/our-work/guidance-documents/employee-monitoring_en.pdf
A sensitive biometrics authentication system is particularly susceptible to?
Answer(s): D
Why D is the best answerBiometric systems capture highly personal characteristics (e.g., fingerprints, iris patterns) that are uniquely linked to an individual. Because these traits cannot be changed and are often stored as immutable templates, a breach results in permanent, finely individualized personal data exposure . The compromised data can be used for identity cloning, unauthorized access, and other high-risk attacks, making theft of biometric data a privacy-critical threat distinct from performance issues.Why the other options are less appropriateA: False positives – This is an operational error that may affect user experience but does not directly expose sensitive personal data. B. False negatives – Missing a legitimate user can inconvenience access but does not compromise privacy. C. Slow recognition speeds – Latency impacts system efficiency and usability; it does not have a privacy impact.Thus, the defining privacy vulnerability for a biometric authentication system is the potential theft of the meticulously individualized biometric data itself.
International Association of Privacy Professionals (IAPP) – “Biometric Data Privacy” https://iapp.org/resources/library/biometric-data-privacy/ NIST Special Publication 800-63B – “Digital Identity Guidelines” (Section on Biometric Data Protection) https://pages.nist.gov/800-63-3/sp800-63b.html
Which is the most accurate type of biometrics?
Answer(s): A
Why DNA is the most accurate biometric identifierDNA profiling uses the exact nucleotide sequence of a person’s genome, which is virtually unique (except for identical twins) and remains stable throughout life. The statistical probability of two unrelated individuals sharing the same profile at the required loci is on the order of 1 in 10¹⁶ to 1 in 10¹⁹, yielding an extremely low false-acceptance rate. Errors are limited mainly to sampling contamination or laboratory mistakes, both of which can be rigorously controlled; the underlying biological basis is unaffected by environmental conditions that can degrade other modalities (e.g., temperature, lighting). Unlike voice, fingerprint, or facial features, DNA does not change with age, health, or external factors, providing consistent performance across the entire population.Why the other options are less suitableVoiceprint – performance degrades with illness, accent, background noise, or aging; acoustic patterns can be spoofed and have higher false-acceptance rates. Fingerprint – quality can be compromised by wear, dirt, moisture, or injuries; ridge patterns can converge on a few common features, increasing identification ambiguity. Facial recognition – highly susceptible to lighting, expression, pose, occlusion, and cosmetic changes; algorithms rely on heuristics that can be fooled by deep-fake or imprinted images, and the inherent variability across a large population raises the risk of collisions.Conclusion Given its near-unique genetic code, stability over time, and extremely low error rates when properly processed, DNA is the most accurate biometric modality among the listed choices.
National Institute of Standards and Technology (NIST). Biometric Performance Testing: Fingerprint, Face, and Voice. https://doi.org/10.6028/NIST.IR.8195 International Biometrics + Identity Association. DNA Identification: Principles and Applications. https://www.ibia.org/resources/white-papers/dna-identification
What is true of providers of wireless technology?
Why option B is correctA wireless provider operates a network that carries traffic between endpoints; when that traffic is unencrypted , the provider’s routers, base stations, and intervening gateways can inspect every packet. This visibility is built-in to the protocol stack (e.g., clear-text IP, TCP, HTTP headers) and does not require special surveillance tools. The provider’s ability to read such data is a direct technical consequence of the lack of encryption, not a statutory privilege. Consequently, the provider can “see all unencrypted data that crosses the system,” which matches statement B.Why the other statements are inaccurateA: “They have the legal right in most countries to control and use any data on their systems.”Ownership of infrastructure does not confer unrestricted rights to process personal data. Applicable privacy regimes (e.g., GDPR, PIPEDA) impose purpose-limitation, consent, and security obligations that restrict how the provider may store, process, or disclose data. Control is governed by law, not by default ownership, so the claim overstates legal authority.C: “They are typically exempt from data security regulations.”No jurisdiction grants blanket exemptions to wireless carriers for data-security requirements. Even telecom operators are subject to sector-specific rules (e.g., NERC-CIP in the U.S., ENISA guidance in the EU) and must implement appropriate technical and organizational measures under general privacy statutes.D: “They routinely backup data that crosses their system.”Backup practices are a security/availability concern, not a routine function of data transport. Providers may back up logs or network-operational data for incident response, but they do not routinely back up every packet that traverses the network; doing so would be inefficient and unnecessary for service delivery.
IAPP – “Certified Information Privacy Technologist (CIPT) Exam Preparation Guide” – Chapter 3 discusses network-provider visibility and the distinction between technical visibility and legal authority. https://iapp.org/certification/cippt-exam-preparation-guide/ European Data Protection Board – “Guidelines 03/2020 on the security of personal data” – Paragraph 5.2 clarifies that telecom operators are bound by general data-protection rules and have no blanket exemption. https://edpb.europa.eu/law/guidelines/2020/03/edpb_guidelines_03_2020_security_en.pdf
What distinguishes a "smart" device?
Why option D is the correct definition of a “smart” deviceA “smart” device is characterized by its ability to extend its functional intelligence by pulling in external data – typically via APIs, web services, or network-based knowledge bases. This external information enables dynamic behavior (e.g., learning user preferences, updating firmware, accessing real-time weather or traffic data) that a static, self-contained device cannot provide. The essence of “smartness” therefore lies in augmented cognition : the device uses information received from the internet to make more informed decisions or actions than it could with only its internal logic.Why the other choices are less appropriateA: “It can perform multiple data functions simultaneously.”Multi-tasking is a capability of many processors, but it does not require the device to be “smart.” A simple microcontroller can execute several tasks in parallel without accessing external intelligence.B: “It is programmable by a user without specialized training.”Programmability is a design attribute, not a defining trait of “smartness.” Many embedded systems are user-configurable yet remain unsmart because they lack external data integration.C: “It can reapply access controls stored in its internal memory.”Managing internal access controls relates to security governance, not to the device’s intelligence. “Smart” devices may enforce such controls, but the defining feature is the external information source that enhances decision-making.Conclusion The distinguishing characteristic of a “smart” device is its integration with external data streams to augment its intrinsic capabilities , which aligns precisely with option D.
NIST definition of the Internet of Things (IoT) : https://csrc.nist.gov/publications/detail/sp/800-183/final ISO/IEC 30107 – Internet of Things (IoT) and related technologies – Vocabulary and taxonomy : https://www.iso.org/standard/75270.htmlThese sources describe “smart” objects as entities that leverage network-based information to enhance functionality, confirming the rationale behind option D.
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.