Which is likely to reduce the types of access controls needed within an organization?
Answer(s): C
Correct Answer: C – Standardization of technologyStandardizing the technology stack (e.g., using a common OS, database platform, cloud provider, and security controls) dramatically reduces the variety of data-handling scenarios an organization must accommodate. When most applications share identical security models, authentication mechanisms, and configuration baselines, the same set of access-control policies can be applied consistently across the board. This convergence means fewer discretionary variations in how permissions are granted or enforced, allowing the organization to rely on a limited set of generic controls rather than a patchwork of bespoke schemes.Why the other options are less appropriateA: Decentralization of data – Dispersing data across multiple locations, business units, or systems actually increases the number of distinct access-control contexts that must be managed, because each site or department may require its own rules. B. Regular data inventories – Inventories are valuable for discovering what data exists and where it resides, but they do not themselves reduce the number of access-control mechanisms; they merely provide awareness. D. Increased number of remote employees – More remote workers typically broaden the attack surface and necessitate additional network-level and identity-based controls, not a reduction. Remote work introduces additional considerations such as VPNs, zero-trust segments, and endpoint protections.Conclusion When an organization consolidates technology usage and enforces uniform security configurations, the need for a multitude of specialized access-control types diminishes because a single, standardized set of controls can protect all assets uniformly. This is why standardization of technology is the most effective driver for reducing the diversity of access-control implementations.
1. NIST SP 800-53 Rev. 5 – Access Control Requirements – https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final 2. ISO/IEC 27001 – Annex A.9 Access Control – https://www.iso.org/standard/54534.htmlThese sources detail how consistent technical environments simplify access-control design and implementation.
What is an Access Control List?
Answer(s): B
Why option B is the correct definition of an Access Control List (ACL)An ACL is a per-subject authorization table that associates each entity (user, process, or role) with one or more permission types (read, write, execute, delete, etc.). It specifies what rights are granted to each individual (or logical entity) rather than describing steps, resources, or revocations. The ACL therefore indicates the type of permission granted to each individual, which matches statement B exactly.Why the other choices are less suitableA – Describes a procedural sequence (“list of steps necessary for an individual to access a resource”), which is a workflow or SOP, not an ACL. C – Refers to a list of resources an individual may access; this is more characteristic of a capability list or resource-based policy, not an ACL that maps permissions to subjects. D – Mentions revocation of privileges, which is an action taken on an ACL but not the definition of the list itself.Hence, option B accurately captures the technical nature of an ACL as used in access-control models.
NIST SP 800-53 Rev. 5 – Access Control Requirements: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27001:2022 – Information Security Management Systems – Access Control: https://www.iso.org/standard/54534.html
Which of the following is an example of drone `swarming`?
Answer(s): D
JustificationSwarming is defined as a coordinated behavior in which a group of autonomous aerial vehicles communicates directly with one another to achieve a collective mission without central control. This requires real-time data exchange, shared intent, and distributed decision-making among the drones.Option D describes drones actively exchanging information to conduct a search-and-rescue operation together, which exactly matches the definition of swarming. Option A shows a single drone observing a cyclist; there is no interaction among multiple drones. Option B involves a single drone collecting data over a site; it lacks multi-drone coordination. Option C depicts drone-based delivery to homes, which is a point-to-point logistics task, not a collaborative, communication-driven swarm activity.Therefore, D is the only option that exemplifies drone swarming.
FAA, UAS Swarming Operations – Guidance Material (2023). https://www.faa.gov/uas/swarming/guidance ISO/IEC 30107-3, Information technology – Biometric performance testing – Part 3: Presentation attack detection (2022). https://www.iso.org/standard/75234.html
An individual drives to the grocery store for dinner. When she arrives at the store, she receives several unsolicited notifications on her phone about discounts on items at the grocery store she is about to shop at. Which type of privacy problem does this represent?
Answer(s): A
Why “Intrusion” is the best answerDefinition – Intrusion refers to the unauthorized collection, use, or disclosure of personal information that compromises an individual’s control over their own data. Scenario fit – The individual receives unsolicited location-based advertisements while en route to a store. This implies that her whereabouts or movements were gathered without her explicit consent and subsequently used to generate a notification, directly infringing on her informational self-determination. Technical precision – The problem is not merely that data were collected; it is that they were harvested covertly and deployed to influence her experience at the moment of travel, constituting an intrusion into her personal space.Why the other options are less suitableSurveillance – Implies systematic, ongoing monitoring or tracking of activities. While tracking may underlie the intrusion, the core issue here is the unsolicited use of that information rather than the breadth of continuous surveillance. Decisional Interference – Involves manipulation of an individual’s choices through direct pressure or misleading information. The grocery-store pop-ups are merely informational; they do not coerce a decision but merely present it.Exposure – Denotes the accidental or unintended public disclosure of personal data. The notifications are intentionally sent to a specific recipient; they do not involve a public leak or exposure of the data beyond the intended audience.Conclusion The situation exemplifies Intrusion because personal data about the individual’s location were obtained and employed without consent, violating her privacy expectations.
https://iapp.org/resources/privacy-management/privacy-principles/ https://iapp.org/resources/learning-events/cielt/
What is the most effective first step to take to operationalize Privacy by Design principles in new product development and projects?
Why option B is the correct answerLeadership buy-in establishes the governance authority and resources needed to embed privacy controls from the outset. Without executive sponsorship, mandatory privacy reviews, review tools, or training cannot be enforced consistently across projects. It triggers the creation of a formal privacy-by-design (PbD) policy , allocates budget for risk-based assessments, and integrates privacy into the product development lifecycle (e.g., Agile sprints, design reviews). Certification bodies (e.g., IAPP, CIPP/E) repeatedly stress that top-down commitment is the prerequisite for any operational privacy program.Why the other options are less suitable as the first stepA – Mandatory privacy review & legal approval : This is a tactical control that requires the authority and budget only available after leadership endorsement. C – Online PbD assessment tool : A tooling solution is valuable for consistency, but its design and deployment depend on prior governance and funding decisions. D – Annual PbD training : Training is essential for awareness but cannot drive cultural or process change without leadership support; it also lacks the enforcement power required for early-stage design integration.Most effective first step: Obtain leadership commitment to mandate a privacy-focused review and approval workflow that is baked into every new product’s design and delivery phases.
International Association of Privacy Professionals (IAPP), Certified Information Privacy Technologist (CIPT) Body of Knowledge, Section 3.1 – Governance and Leadership. https://iapp.org/certify/cipt/body-of-knowledge/ NIST Privacy Framework, Identify – Governance (Version 1.1). https://www.nist.gov/publications/privacy-framework-version-11
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.