Which of the following is NOT a step in the methodology of a privacy risk framework?
Answer(s): D
Why “Ranking” is NOT a step in a privacy-risk frameworkAssessment – The foundational activity where privacy-related assets, threats, and vulnerabilities are identified and evaluated. Monitoring – Ongoing tracking of changes in data processing, regulations, and technology to maintain situational awareness. Response – Defined actions taken when risks are discovered or when incidents occur, such as remediation, mitigation, or reporting. Ranking – While risk scores can be used internally, the formal methodology does not include “ranking” as a distinct step; it is merely an internal way to prioritize findings after assessment, not a procedural phase.Why the other options are valid stepsAssessment is universally listed as the first phase in frameworks such as ISO/IEC 27701 and NIST Privacy Framework. Monitoring follows assessment in continuous risk management cycles, ensuring that identified risks are tracked over time. Response corresponds to the remediation or treatment stage, closing the loop by acting on the findings from assessment and monitoring.Thus, the only option that does not belong to the prescribed methodology is D – Ranking .
ISO/IEC 27701 – Privacy Information Management System (PIMS) : https://www.iso.org/standard/82875.html NIST Privacy Framework – Core Functions : https://www.nist.gov/publications/privacy-framework-core-functions-and-functionsThese standards outline the typical steps—assessment, monitoring, and response—that constitute the privacy-risk methodological cycle.
Which of the following occurs when an individual takes a specific observable action to indicate and confirm that they give permission for their information to be processed?
Answer(s): A
Technical justificationExpress (explicit) consent – occurs when a data subject actively affirms their willingness (e.g., ticking a check-box, clicking “Accept”). The action is observable, unambiguous, and directly ties to the granting of permission. This matches the defined meaning of consent under the GDPR (Article 4(11)) and aligns with the exam’s description of “taking a specific observable action to indicate and confirm that they give permission for their information to be processed.”Implied consent – inferred from a lack of objection or from conduct that suggests agreement, but it is not based on a distinct, observable affirmative act. The question emphasizes a specific observable action to confirm permission, which characterizes explicit consent, not passive or inferred behavior.Informed notice – refers to the transparent disclosure of processing purposes, legal bases, etc., required under Articles 12-14. It is a prerequisite for obtaining consent but does not itself constitute the act of granting permission.Authorized notice – is not a recognized term in privacy legislation; it conflates notice with authorization and therefore does not describe the act of confirming consent through a documented action.Conclusion: The scenario describes a deliberate, affirmative act by the data subject, which is precisely what the GDPR defines as express (explicit) consent . The other options either describe passive inference, preliminary disclosure, or a non-existent concept, and thus are less appropriate.
1. European Parliament & Council, Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(11) – definition of consent – https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX:32016R0679 2. GDPR Recital 32 – “Consent should be given by a clear affirmative act…” – https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679#d1e1950-1-1These sources provide the official legal basis confirming that only a clear, affirmative action qualifies as express consent.
A BaaS provider backs up the corporate data and stores it in an outsider provider under contract with the organization. A researcher notifies the organization that he found unsecured data in the cloud. The organization looked into the issue and realized one of its backups was misconfigured on the outside provider's cloud and the data fully exposed to the open internet. They quickly secured the backup. Which is the best next step the organization should take?
Answer(s): A – Review the content of the data exposedThe immediate priority after a data exposure incident is to confirm what data was actually exposed and assess its sensitivity, content, and potential impact. This step enables the organization to:Determine the scope of the breach (e.g., whether protected personal data, intellectual property, or confidential business information was involved). Perform a rapid risk-based impact analysis (privacy, regulatory, reputational). Identify any required remediation actions such as notifications to data subjects, regulators, or internal stakeholders.Only after fully understanding the nature of the exposed data can the organization proceed with contractual, investigative, or provider-selection activities.Why the other options are secondary at this stageB: Review its contract with the outside provider – Contract review is important for future accountability and liability, but it does not address the current exposure. The contract can be examined later to determine remediation measures or enforcement actions.C: Investigate how the researcher discovered the unsecured data – While forensic insight can be valuable, the focus should first be on data impact assessment. The attack surface is already known; deeper technical attribution can be pursued after the breach scope is clarified.D: Investigate using alternate BaaS providers or on-premise backup systems – Switching providers or migrating to on-premise solutions is a strategic decision that should follow a thorough understanding of what was compromised and why, not an immediate reaction to an exposed backup.
NIST Special Publication 800-61r2, Guide to Handling Incidents, 2012 – Recommends containment, analysis, and impact assessment as immediate next steps in incident response. IAPP CIPT Official Training Materials (2023) – Emphasizes privacy-impact assessment of exposed data before proceeding to contractual or provider-evaluation actions.(Links accessed September 2025)1. https://csrc.nist.gov/publications/detail/sp/800-61r2/final 2. https://iapp.org/certificate/cielt/official-training-materials/
An organization is launching a new online subscription-based publication. As the service is not aimed at children, users are asked for their date of birth as part of the of the sign-up process. The privacy technologist suggests it may be more appropriate to ask if an individual is over 18 rather than requiring they provide a date of birth. What kind of threat is the privacy technologist concerned about?
Selected option: A – IdentificationJustificationIdentification threat – Requiring the exact date of birth logs a personally identifying piece of information that can be tied back to a specific individual. Even though the purpose is age verification, the DOB itself enables precise identification of the user within the organization’s database (e.g., linking to other records, enabling profiling). The privacy technologist’s recommendation to ask only “Are you over 18?” aims to avoid storing or processing that identifying attribute, thereby reducing the risk of identifying an individual.Why not the other options?Insecurity – While security breaches could expose the DOB, the core privacy concern is not the overall security posture but the unnecessary capture of an identifier that directly reveals who the user is. Interference – This term is not commonly used in privacy threat modeling; it generally refers to interference with data subjects’ rights or system operation, which is not the central issue here. Minimization – Data minimization is a principle (collect only what is necessary) rather than a threat category. The threat is the potential for identifying an individual through the collected data, which is why “Identification” is the precise threat the technologist is addressing.
IAPP – “Privacy Fundamentals” (covers the concept of identification as a privacy risk): https://iapp.org/resources/privacy-fundamentals/ European Data Protection Board – “Guidelines on the processing of personal data concerning health and care services” (discusses identification risks in age-verification contexts): https://edpb.europa.eu/law/guideline/2022/04/finningual_en.pdf
Combining multiple pieces of information about an individual to produce a whole that is greater than the sum of its parts is called?
Answer(s): C
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.