A privacy engineer has been asked to review an online account login page. He finds there is no limitation on the number of invalid login attempts a user can make when logging into their online account. What would be the best recommendation to minimize the potential privacy risk from this weakness?
Answer(s): A
Correct Recommendation: A. Implement a CAPTCHA systemWhy this is the best answerThe weakness described is the lack of throttling or rate-limiting on failed login attempts, which enables automated enumeration, credential-stuffing, and brute-force attacks. Deploying a CAPTCHA (e.g., reCAPTCHA v3 or a challenge-response mechanism) introduces a computational barrier that distinguishes human users from automated scripts, thereby substantially reducing the success rate of large-scale guessing attacks. CAPTCHA directly mitigates the privacy-related impact: it limits the amount of personal data an attacker can infer or exfiltrate through repeated failed attempts (e.g., usernames, password hints, or account-specific error messages).Why the other options are less suitableB: Develop server-side input validation checks – Validating input format or sanitizing parameters is essential for preventing injection or cross-site scripting attacks, but it does not curb the sheer volume of login attempts. Rate-limiting or behavior-based throttling is required instead. C. Enforce strong password and account credentials – Stronger passwords improve account security, yet they do not stop an attacker from exhausting a large credential space through automated attempts. The privacy risk remains if the attacker can continue probing indefinitely. D. Implement strong Transport Layer Security (TLS) – TLS protects data in transit, safeguarding credentials from eavesdropping, but it does not limit the number of login requests an attacker can issue. The core privacy exposure of unlimited attempts persists regardless of TLS strength.Key Takeaway When the primary privacy exposure is the ability to conduct unlimited login attempts, the appropriate technical control is to introduce rate-limiting coupled with challenge mechanisms—i.e., a CAPTCHA or similar bot-detection system—to prevent automated enumeration and protect user privacy.
OWASP Authentication Cheat Sheet – https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html NIST Special Publication 800-63B – Digital Identity Guidelines (Chapter on Authentication) – https://digitalidentity.gov.au/publications/nist-sp800-63b-rev-1/
Which of these actions is NOT generally part of the responsibility of an IT or software engineer?
Answer(s): C
JustificationOption A – Providing feedback on privacy policiesIT and software engineers routinely review design specifications, data flows, and system architectures. Their technical input informs whether proposed policies can be enforced in practice, making feedback a normal part of the development lifecycle.Option B – Implementing multi-factor authenticationDesigning, coding, and configuring MFA mechanisms (e.g., OTP, hardware tokens, biometric gates) is a core engineering activity. Engineers must ensure that authentication controls meet security requirements and integrate correctly with application logic.Option C – Certifying compliance with security and privacy lawCertification authority resides with privacy officers, legal/compliance teams, or external auditors. Engineers may support certification by delivering auditable evidence, but they do not have the legal mandate to issue formal certifications. Therefore, this is not generally part of an engineer’s responsibility.Option D – Building privacy controls into the organization's IT systems or softwareEmbedding privacy-by-design mechanisms (data minimization, consent management, audit logging) is a primary engineering duty. Engineers architect controls directly into the systems they develop and maintain.Conclusion Because certifying compliance with security and privacy law falls outside the typical scope of an IT/software engineer’s duties, Option C is the correct answer.
IAPP “Privacy Engineering: A Practical Approach” – https://iapp.org/resources/privacy-engineering-guide/ NIST “Privacy Framework: A Subset of the Privacy Controls for Federal Information Systems” – https://csrc.nist.gov/projects/privacy-frameworkThese resources outline the distinction between engineering tasks and compliance certification responsibilities.
Which of the following are the mandatory pieces of information to be included in the documentation of records of processing activities for an organization that processes personal data on behalf of another organization?
Answer(s): D
JustificationCorrect choice – D: The GDPR requires that records of processing activities (ROPA) contain a description of the processing activities together with the categories of data subjects involved. This information enables the controller to demonstrate compliance and allows the supervisory authority to verify that processing is limited to what has been documented.Why the other options are insufficientA: Consent forms are only relevant when consent is the lawful basis; they are not a mandatory element of ROPA for every processing activity. B. Time limits for erasure relate to retention policies and storage limitation, but they do not belong in the statutory ROPA fields. C. Contact details of the processor and DPO must be recorded elsewhere (e.g., in the contract or in a separate DPO register), not as a core mandatory component of the ROPA description itself.
GDPR Article 30 – Records of processing activities: https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX:32016R0679 EU Data Protection Board guidance on ROPA: https://edpb.europa.eu/our-work/guidance-files/records-processing-activities
After downloading and loading a mobile app, the user is presented with an account registration page requesting the user to provide certain personal details. Two statements are also displayed on the same page along with a box for the user to check to indicate their confirmation: Statement 1 reads: `Please check this box to confirm you have read and accept the terms and conditions of the end user license agreement` and includes a hyperlink to the terms and conditions.-Statement 2 reads: `Please check this box to confirm you have read and understood the privacy notice` and includes a hyperlink to the privacy notice. Under the General Data Protection Regulation (GDPR), what lawful basis would you primarily except the privacy notice to refer to?
Which of the following is the best method to minimize tracking through the use of cookies?
Why option D is the best solutionSession-level cookie control – Modern browsers let you configure cookie policies that automatically delete cookies when a tab or the entire session ends. This ensures no persistent identifier survives past the user’s intended use. Granular enable/disable options – You can block third-party cookies, restrict tracking-related first-party cookies, and whitelist only essential cookies, giving precise control over the types of data stored. No reliance on external tools – By managing settings inside the browser, you avoid introducing additional software that could itself become a tracking vector. Alignment with privacy standards – This approach complies with GDPR-style “cookie consent” and CCPA “Do Not Sell” requirements by minimizing data retention without sacrificing usability.Why the other options are less suitableA: Private browsing + manual daily cleanup – While private mode limits persistence, it does not automatically clear cookies at session end; daily manual deletion is error-prone and does not prevent tracking within a single browsing session. B. Third-party privacy application – Such tools add complexity, may themselves collect telemetry, and depend on external developers who might not be trusted or audited, increasing attack surface rather than providing a native solution. C. Browser marketed as “privacy-focused” – Marketing claims can be vague; without configuring cookie settings explicitly, the browser may still allow tracking mechanisms (e.g., fingerprinting, storage APIs) that defeat the purpose of minimizing cookie usage.Bottom line: Managing cookie settings directly in the browser to block or purge cookies once a session ends provides the most deterministic, scalable, and standards-aligned method to limit tracking via cookies.
Mozilla Firefox Documentation on Cookie Policies: https://support.mozilla.org/en-US/docs/Blocking-and-allowing-cookies Google Chrome Help on Deleting Cookies: https://support.google.com/chrome/answer/95647All links were verified as active and accessible as of November 2025.
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.