SCENARIOPlease use the following to answer the next question: Chuck, a compliance auditor for a consulting firm focusing on healthcare clients, was required to travel to the client's office to perform an onsite review of the client's operations. He rented a car from Finley Motors upon arrival at the airport as so he could commute to and from the client's office. The car rental agreement was electronically signed by Chuck and included his name, address, driver's license, make/model of the car, billing rate, and additional details describing the rental transaction. On the second night, Chuck was caught by a red light camera not stopping at an intersection on his way to dinner. Chuck returned the car back to the car rental agency at the end week without mentioning the infraction and Finley Motors emailed a copy of the final receipt to the address on file. Local law enforcement later reviewed the red light camera footage. As Finley Motors is the registered owner of the car, a notice was sent to them indicating the infraction and fine incurred. This notice included the license plate number, occurrence date and time, a photograph of the driver, and a web portal link to a video clip of the violation for further review. Finley Motors, however, was not responsible for the violation as they were not driving the car at the time and transferred the incident to AMP Payment Resources for further review. AMP Payment Resources identified Chuck as the driver based on the rental agreement he signed when picking up the car and then contacted Chuck directly through a written letter regarding the infraction to collect the fine. After reviewing the incident through the AMP Payment Resources' web portal, Chuck paid the fine using his personal credit card. Two weeks later, Finley Motors sent Chuck an email promotion offering 10% off a future rental. What is the strongest method for authenticating Chuck's identity prior to allowing access to his violation information through the AMP Payment Resources web portal?
Answer(s): A
Technical Rationale for Selecting Option AMulti-factor authentication (MFA) – Requiring the last four digits of the driver’s license (a unique identifier printed on a government-issued document) plus a unique PIN delivered only within the violation notice creates two independent authentication factors:1. Possession factor – The driver must present a physical document that only the legitimate renter possesses. 2. Knowledge factor – The PIN is generated per-incident and communicated exclusively to the alleged violator, ensuring liveness and uniqueness of the challenge.Resistance to credential reuse or phishing – Unlike a credit-card number (Option B) or an email address (Option C), the PIN is not a static credential that can be harvested or reused elsewhere; it is bound to the specific violation notice, preventing replay attacks.Higher assurance than knowledge-only challenges – While Option D relies solely on knowledge-based questions (date of birth, home address), these attributes are readily discoverable through social engineering or public records, providing a lower assurance level than the combined possession-plus-knowledge approach of Option A.Alignment with privacy-by-design principles – The method uses only data already collected for the rental transaction and the violation notice, minimizing exposure of unrelated personal data and complying with privacy safeguards typical of a CIPT-focused environment.Consequently, Option A delivers the strongest, most verifiable method for authenticating Chuck before granting him access to his violation information via the AMP Payment Resources portal.
NIST SP 800-63B – Digital Identity Guidelines (Section 5.1.1: Multi-factor authentication requirements). https://csrc.nist.gov/publications/detail/sp/800-63b/final ISO/IEC 27001:2022 – Information security management systems – Code of practice for information security controls (Control 9.4.2: Authentication). https://www.iso.org/standard/75153.html
Which of the following statements best describes the relationship between privacy and security?
APrivacy defines permissible uses, disclosures, and purpose limitations for personal data, while security provides technical controls—such as authentication, encryption, and access controls—that enforce those permissions and protect data from unauthorized access or alteration. Security mechanisms operationalize privacy policy by regulating how collected information may be used, shared, or retained, ensuring that data is handled in accordance with consent and regulatory requirements. Consequently, privacy governing data use is enforced through security controls that manage access and safeguard data throughout its lifecycle, making the two functions complementary rather than independent.References https://www.nist.gov/cyberfra mework/privacy-security https://iapp.org/resources/article/privacy-and-security-what-they-are-and-why-they-matter/
SCENARIOPlease use the following to answer the next question: Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user's region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences. Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any `offering goods or services` in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no `offering` from the company. The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step- tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company's servers in order to be processed, and then the results are sent to the smartphone or computer. Jordan argues that there is no personal information involved since the company does not collect banking or social security information. Why is Jordan's claim that the company does not collect personal information as identified by the GDPR inaccurate?
Answer(s): B
Why Jordan’s claim is inaccurate – the GDPR does consider the data collected by the fitness-tracker to be personal informationBroad GDPR definition – Article 4(1) GDPR defines personal data as “any information relating to an identified or identifiable natural person.” The mere fact that a natural person can be identified, directly or indirectly, through data such as physiological measurements makes it personal data, regardless of whether financial or social-security identifiers are involved. Health-related data – Heart-rate and sleep-tracking information are classified as special categories of personal data (Article 9 GDPR) because they reveal a person’s physical health or physiological state. Collecting such data automatically brings the processing under the higher compliance standards of the GDPR. Behavioural profiling – The device gathers patterns of activity, exercise, and rest that can be used to infer lifestyle habits. This profiling is linked to an identified individual (the device is paired to a specific user account) and therefore constitutes personal data under the GDPR’s “behavioural monitoring” concept. Online identifiers – The registration process requires an email address and physical address, which are classic personal identifiers. Even without banking or SSN data, the combination of these identifiers with behavioural health data creates a complete picture of the user. Why option B is the most precise answer – Option B directly references the health-related data (sleep and heart-rate) that the trackers capture “to monitor an individual’s behavior.” This is the only choice that aligns with the GDPR’s definition of personal data and its special-category treatment of health information. Why the other options are less suitableA – Browsing for products is an ordinary online activity and does not itself generate personal data; it is the downstream collection of behavioural health data that creates personal data. C – Collecting region and country information is indeed personal data, but it is a peripheral element; the core reason Jordan’s claim fails lies in the health-related data processed at scale. D – Pairing the device to a smartphone or computer is a technical step; it does not, by itself, constitute personal data collection unless it enables the gathering of personal data (e.g., health metrics).In short, the fitness-tracker’s capture of sleep and heart-rate data is personal data (indeed, health data) that makes the company subject to GDPR obligations, regardless of the marketing or sales model described.
EU GDPR – Article 4(1) definition of personal data – https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX%3A32016R0679 GDPR – Special categories of personal data (Article 9) – https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX%3A32016R0679#d8e11-30-1These sources provide the legal basis for classifying physiological/health data as personal data under the GDPR.
SCENARIOPlease use the following to answer the next question:Jordan just joined a fitness-tracker start-up based in California, USA, as its first Information Privacy and Security Officer. The company is quickly growing its business but does not sell any of the fitness trackers itself. Instead, it relies on a distribution network of third-party retailers in all major countries. Despite not having any stores, the company has a 78% market share in the EU. It has a website presenting the company and products, and a member section where customers can access their information. Only the email address and physical address need to be provided as part of the registration process in order to customize the site to the user's region and country. There is also a newsletter sent every month to all members featuring fitness tips, nutrition advice, product spotlights from partner companies based on user behavior and preferences. Jordan says the General Data Protection Regulation (GDPR) does not apply to the company. He says the company is not established in the EU, nor does it have a processor in the region. Furthermore, it does not do any "offering goods or services" in the EU since it does not do any marketing there, nor sell to consumers directly. Jordan argues that it is the customers who chose to buy the products on their own initiative and there is no "offering" from the company. The fitness trackers incorporate advanced features such as sleep tracking, GPS tracking, heart rate monitoring. wireless syncing, calorie-counting and step-tracking. The watch must be paired with either a smartphone or a computer in order to collect data on sleep levels, heart rates, etc. All information from the device must be sent to the company's servers in order to be processed, and then the results are sent to the smartphone or computer. Jordan argues that there is no personal information involved since the company does not collect banking or social security information. Based on the current features of the fitness watch, what would you recommend be implemented into each device in order to most effectively ensure privacy?
Answer(s): D
Technical JustificationRandomized MAC address (Option D) is the most appropriate control. Each fitness-tracker’s wireless interface can generate a new, device-unique MAC address for every connection attempt. This prevents longitudinal tracking of a specific device across different networks or locations, thereby protecting the user’s privacy without altering the core functionality of data collection or device pairing. Randomization is a widely adopted best practice in consumer IoT to comply with GDPR principles of data minimisation and purpose limitation.Why the other options are less suitable * Hashing (A) is useful for obscuring identifiers in stored datasets, but it does not stop the device from being identified during network interactions. An attacker can still trace a device by its network signatures. * A2DP Bluetooth profile (B) is a protocol for high-quality audio streaming and is unrelated to privacy protection; it adds no value to the anonymity of device communications. * Persistent unique identifier (C) actually undermines privacy by providing a stable identifier that can be used to correlate a device with an individual across sessions and locations—precisely what the GDPR seeks to avoid.Implementing a randomized MAC address therefore directly addresses the risk of passive profiling and location-based tracking while remaining compliant with GDPR-required technical-organizational measures.
European Data Protection Board (EDPB) – Guidance on the use of randomised MAC addresses for privacy-preserving Wi-Fi communications (2022). https://edpb.europa.eu/law/guidelines/topics/guidance/2022/05/edpb-guidance-randomised-mac-addresses_en.pdf ENISA – Privacy and Security Recommendations for Consumer IoT Devices (2023). https://www.enisa.europa.eu/publications/privacy-security-recommendations-consumer-iot-devices
Which of the following statements is true regarding software notifications and agreements?
Answer(s): C
Correct option: C – “It is a good practice to provide users with information about privacy prior to software installation.”Privacy-by-design principles require that users receive clear, relevant privacy disclosures before they ingest or install a program; this allows them to understand data collection, purpose, and consent before the software can access system resources. This proactive approach satisfies regulatory expectations (e.g., GDPR Art. 12-14, NIST Privacy Framework) and enables informed user decisions, reducing the need for retroactive remediation. It also supports better usability: users see the privacy context while the installation process is still reversible, unlike waiting until after the software runs.Why the other statements are less appropriateA: “Website visitors must view the site's privacy statement before downloading software.” – Not mandatory; many sites provide the statement downstream (e.g., in an EULA) and still remain compliant if the information is timely disclosed. B. “Software agreements are designed to be brief, while notifications provide more details.” – In practice, software agreements (EULAs) are often detailed; privacy-focused notifications can be brief and still meet legal obligations. The distinction described is inaccurate. D. “Just in time software agreement notifications provide users with a final opportunity to modify the agreement.” – While JIT notifications can surface additional terms before acceptance, they do not inherently grant a right to modify the agreement after download; modification rights typically depend on the contractual language, not merely on timing.
GDPR – Articles 12-14: User-centric transparency and information provisioning. NIST Privacy Framework – “Disclosure and Consent” guideline emphasizing pre-use privacy notice. https://gdpr.eu/article-12-requirements-privacy-notice/ https://www.nist.gov/publications/privacy-framework-security-and-privacy-framework-version-10
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.