What logs should an application server retain in order to prevent phishing attacks while minimizing data retention?
Answer(s): A
JustificationData minimisation is a core privacy principle; retaining only the necessary data reduces risk and storage costs. To counter phishing, an application server must be able to audit the content of messages (e.g., which links were included) and verify the integrity of communication metadata (sender/receiver identifiers, timestamps, message IDs). Storing only de-identified metadata (message IDs, timestamps, basic routing info) provides sufficient context for forensic review and threat analysis without exposing personally identifiable information or confidential URL content. Limited-retention policies (e.g., 30-90 days) satisfy legal and operational needs while minimizing the attack surface from leaked log data. Including link click data (Option B) adds unnecessary detail that can expose user behaviour and increase liability, while Options C and D expose sender/receiver identities that are not required for phishing detection and contradict the goal of minimising data retention.Why Option A Is BestProvides the audit trail needed for phishing investigation (message metadata) while keeping the dataset small and de-identified. Aligns with best-practice retention schedules and privacy-by-design standards.Why Other Options Are Less SuitableB – Adds click-through data, increasing granularity and privacy exposure without improving phishing prevention. C – Retains sender/receiver identities, which expands the data set beyond what is required and creates unnecessary privacy risk. D – Combines the drawbacks of B and C, resulting in the most extensive retention profile, conflicting with the “minimise data” requirement.
IAPP, “Data Minimisation and Retention” – https://iapp.org/resources/article/data-minimisation-and-retention/ NIST, “Guide to Computer Security Log Management (SP 800-92 Rev. 1)” – https://csrc.nist.gov/publications/detail/sp/800-92/rev-1/finalAnswer(s): A – Limited-retention, de-identified logs including only metadata.
Which of the following would be the most appropriate solution for preventing privacy violations related to information exposure through an error message?
Answer(s): C
ReasoningOption C – create generic error pages that omit variable data is the most effective control. By ensuring that any error response contains only non-sensitive, static text, the system eliminates the risk of inadvertently exposing user-specific information (e.g., session identifiers, URLs with query parameters, or personal attributes) in error messages. This directly addresses the privacy-exposure threat while preserving usability.Option A – use shorter error messages merely reduces the length of the output but does not guarantee that the content is free of personal data. Sensitive information can still appear in a truncated message, so the privacy risk remains.Option B – handle exceptions internally and never show errors to the user is unrealistic for production web applications. Users often need feedback when something goes wrong (e.g., validation failures); completely suppressing all error output can degrade usability and may hide legitimate bugs that require monitoring.Option D – log session name and parameters for troubleshooting is a good operational practice, but it does not prevent the exposure of that data to end-users. Logging is a downstream activity; it does not address the root cause of privacy leakage in the error response itself.Conclusion The most appropriate solution is to generate default error messages that are deliberately free of variable or context-specific data, thereby preventing accidental disclosure of personal or session-related information.
OWASP Privacy Guideline – “Minimize Data Exposure in Error Messages”: https://owasp.org/www-project-cheat-sheets/cheatsheets/Privacy_Controls Cheat_Sheet NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations – “SI-2 (6) Error Handling”: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final(Both links are publicly accessible and up-to-date as of the latest revisions.)
In day to day interactions with technology, consumers are presented with privacy choices. Which of the following best represents the Privacy by Design (PbD) methodology of letting the user choose a non-zero-sum choice?
Answer(s): B
Why option B is the best answerPbD principle of meaningful choice – Privacy-by-Design requires that users be presented with clearly expressed, technically accurate options that they can understand and act on without undue cognitive load . Plain-language design choices that are framed around privacy outcomes directly enable a non-zero-sum interaction: the user can select a level of privacy that fits their needs while the service provider still offers functionality. Error mitigation and consequence reduction – By wording choices in everyday language and linking them to concrete privacy consequences (e.g., “share my location with third-party ads” vs. “keep my location private”), users are less likely to make accidental disclosures and any mistake they do make has a smaller negative impact. This aligns with the PbD goal of embedding privacy safeguards into the default experience. Non-zero-sum framing – The wording of the choice itself reflects that privacy is not a fixed resource to be “taken” from the service; rather, the user can select a configuration that balances their privacy expectations with the functionality they desire. Option B captures this balance explicitly.Why the other options are less suitableOption A – “Using images, words, and contexts to elicit positive feelings … eliminating negativity and biases.”This describes an affective, persuasive design technique rather than a privacy-specific choice architecture. It does not explicitly address the user’s ability to select a distinct privacy setting or explain the trade-offs involved. Option C – “Displaying the percentage of users that chose a particular option … enabling the user to choose the most preferred option.”While social-norm information can influence decisions, it introduces a bias toward the majority choice and does not guarantee that the presented option is comprehensible or aligned with the user’s privacy goals. PbD emphasizes individual agency, not conformity to aggregate behavior. Option D – “Using contexts, antecedent events, and other priming concepts to assist the user in making a better privacy choice.”Priming can steer behavior subtly, but it does not provide the explicit, plain-language disclosure of what each option entails. PbD requires transparency and clarity, not merely environmental cues that may nudge without clear understanding.
IAPP, Privacy by Design: An Internationally Recognized Framework, 2023 – https://iapp.org/resources/privacy-by-design/ NIST, Privacy Framework: A NIST Guide for Privacy-Centric Design, 2020 – https://doi.org/10.6028/NIST.SP.800-53r5 (see Section 4 on “User-Centric Privacy Choices”)
What risk is mitigated when routing video traffic through a company's application servers, rather than sending the video traffic directly from one user to another?
Technical justification (exam-style)Routing video streams through a centrally-hosted media relay (or application server) instead of a direct peer-to-peer (P2P) link changes the trust boundary of the communication path.Identity protection (Option B) – In a P2P scenario each client resolves the other peer’s IP address and may expose additional identifiers (e.g., XMPP/Jitsi-style JIDs, SIP To-URIs, or WebRTC ICE candidates). By forcing all media to flow through a controlled server, the client never reveals its network address or session identifiers to the counterpart. This directly mitigates the risk of the other user learning who you are (e.g., username, account ID) and helps preserve anonymity. Phishing protection (Option A) – Phishing is a social-engineering attack that exploits deceptive content or URLs; it is not reduced simply by mediated media transport. The server does not filter malicious UI or email messages, so this risk is unchanged. Location information (Option C) – While a TURN/relay can hide NAT-derived location details, the primary purpose of routing through the server is to enforce policy and authentication, not to obscure geography. Moreover, many applications still disclose regional information via other data (e.g., user-selected locale, profile metadata), so location concealment is not the core mitigated risk. Authentication assurance (Option D) – Forcing media via the server does not automatically enforce stronger credential checks; authentication remains a separate concern. Unless the server explicitly validates credentials before accepting a session, the claim of “stronger authentication” is unsupported.Therefore, B. “The user's identity is protected from the other user.” is the best answer because it directly addresses the security benefit of removing direct exposure of client identifiers over the media path, whereas the other options describe risks that are either unrelated or only partially addressed by server-mediated routing.
WebRTC Working Group – NOTE “WebRTC Security Considerations” (RFC 7467) – https://tools.ietf.org/html/rfc7467 Mozilla Developer Network – “WebRTC Security” – https://developer.mozilla.org/en-US/docs/WebRTC/Security
Organizations understand there are aggregation risks associated with the way the process their customer's data. They typically include the details of this aggregation risk in a privacy notice and ask that all customers acknowledge they understand these risks and consent to the processing. What type of risk response does this notice and consent represent?
Answer(s): D
Correct option: D – Risk acceptanceExplanation of risk acceptance – The organization does not eliminate, mitigate, or transfer the aggregation risk; instead, it acknowledges that the risk remains but proceeds with processing that continues to generate it. By publishing a privacy notice that explicitly delineates the aggregation risk and obtaining explicit consent from data subjects, the organization expresses deliberate acceptance of the residual risk while seeking informed consent. Why the other options are less appropriateB: Risk mitigation – Mitigation would involve redesigning data-collection practices, applying technical safeguards (e.g., differential privacy, anonymization), or limiting aggregation to reduce the likelihood or impact of the risk. Simply stating the risk and seeking consent does not reduce the risk itself. A. Risk transfer – Transfer would involve shifting the risk to a third party (e.g., via contractual indemnities or insurance). The notice/consent process does not move the risk elsewhere; it merely records that the data subject has been informed and consents. C. Risk avoidance – Avoidance would require abandoning or halting the data-processing activity that creates the aggregation risk. By continuing processing after disclosure and consent, the organization is not avoiding the risk.Conclusion – The described practice aligns with risk acceptance because the organization consciously acknowledges the aggregation risk, discloses it, and obtains consent to proceed, thereby accepting the residual risk while ensuring informed decision-making by the data subjects.
IAPP “Privacy Risks and Risk Management” guidance – https://iapp.org/resources/privacy-risk-management/ NIST Special Publication 800-53 Rev. 5, “Security and Privacy Controls for Information Systems and Organizations” – https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (see sections on risk assessment and risk acceptance)
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.