An organization is concerned that its aging IT infrastructure will lead to increased security and privacy risks. Which of the following would help mitigate these risks?
Answer(s): A
Why “Vulnerability Management” is the best choiceTargets the root cause of most security incidents: unpatched or mis-configured components that often result from aging hardware/software. Implements a continuous cycle (identify → prioritize → remediate → verify) that directly reduces exploitable weaknesses before they can be leveraged, thereby lowering both security breaches and privacy violations. Aligns with industry guidance (e.g., NIST SP 800-53 RA-3, ISO/IEC 27001 A.12.6) which mandate systematic vulnerability assessment and remediation for critical information assets.Why the other options are less suitableData Loss Prevention (DLP) – Focuses on preventing unauthorized data exfiltration; it does not address the underlying weakness of old platforms that can be compromised in the first place. Code Audits – Useful for reviewing application source code, but aging infrastructure risk typically stems from operating-system patches, firmware, and configuration drift, not just code quality. Network Centricity – Describes a design philosophy rather than a concrete risk-mitigation process; it offers no systematic way to discover or remediate vulnerabilities in legacy components.Conclusion Implementing a formal Vulnerability Management program directly mitigates the heightened security and privacy risks associated with outdated IT infrastructure by continuously discovering, assessing, and fixing exploitable weaknesses.
NIST Special Publication 800-53 Revision 5 – Security and Privacy Controls for Information Systems andOrganizations: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final ISO/IEC 27001:2022 – Information security management systems – Requirements: https://www.iso.org/standard/82875.html
An organization has recently experienced a data breach where large amounts of personal data were compromised. As part of a post-incident review, the privacy technologist wants to analyze available data to understand what vulnerabilities may have contributed to the incident occurring. He learns that a key vulnerability had been flagged by the system but that detective controls were not operating effectively. Which type of web application security risk does this finding most likely point to?
Answer(s): D
Correct option – Logging and Monitoring Failures – The breach stemmed from a known vulnerability that was flagged, but the organization’s detective controls (e.g., security event logging, alerts, and response monitoring) were not operating effectively. When a vulnerability is detected but not promptly identified or acted upon through robust logging and monitoring, adversaries can exploit it undetected for extended periods. This aligns directly with the OWASP Top 10 2021 risk Logging and Monitoring Failures (A05:2021), which emphasizes the need for comprehensive log collection, real-time analysis, and alerting to detect and respond to attacks in a timely manner.Why Insecure Design is less appropriate – Insecure Design focuses on flaws in the architectural or threat-modeling phase (e.g., missing security controls in design). While a design flaw may have created the condition for the vulnerability, the key issue highlighted here is that the flagged vulnerability was not being monitored or acted upon, indicating a control-operational problem rather than a design oversight.Why Misconfiguration is less appropriate – Misconfiguration involves improper settings of software, services, or infrastructure (e.g., default credentials, open ports). The scenario describes a vendor-identified vulnerability that remained unaddressed due to weak monitoring, not an erroneous configuration of an already-deployed component.Why Vulnerable and Outdated Components is less appropriate – That category covers use of components with known security flaws that are outdated or have unpatched vulnerabilities. Here the vulnerability itself was flagged (implying known risk) but not acted on because of inadequate monitoring; the focus is on detection/response gaps, not on the existence of the outdated component per se.Conclusion – The finding reflects a breakdown in the organization’s ability to detect and respond to security events, which is precisely what Logging and Monitoring Failures addresses.
OWASP Top 10 2021 – A05: Logging and Monitoring Failures: https://owasp.org/www-project-top-ten/ NIST Special Publication 800-66 Rev. 1 – Guide to Security Monitoring and Surveillance: https://csrc.nist.gov/publications/detail/sp/800-66/rev-1/finalThese links provide detailed guidance on the risks associated with insufficient logging and monitoring and the importance of effective detective controls.
There are two groups of users in a company, where one group is allowed to see credit card numbers, while the other group is not. Both are accessing the data through the same application. The most effective and efficient way to achieve this would be?
Answer(s): B
Technical justificationOption B implements a policy-driven, selective decryption approach: data is stored encrypted (meeting confidentiality requirements) and decrypted only when the accessing principal is authorized by the access-control engine. This minimizes exposure of clear-text credit-card data, reduces storage overhead (a single encrypted data set), and keeps the application architecture simple—both user groups use the same interface but receive different outputs based on their rights.Option A requires duplicate data stores with different obfuscation levels. Maintaining two copies introduces synchronization risk, increases storage costs, and adds complexity to the query layer that must decide which copy to present. It also does not enforce real-time access checks, potentially leading to accidental disclosure if the wrong copy is selected.Option C applies obfuscation on-the-fly when unauthorized users request the data. This still requires the obfuscation logic to be executed for every request and gives no assurance that clear-text data will never be written to logs or caches, increasing the attack surface and operational overhead.Option D eliminates the data entirely for unauthorized users, but it still stores the decrypted credit-card numbers for authorized users. Moreover, dropping the data can break downstream processes that rely on the same dataset, and it does not provide a systematic enforcement mechanism; it is more of a hack than a controlled access solution.Conclusion Given the need for an efficient (single source of truth) and effective (strong enforcement) method to separating access rights, encrypt-at-rest with selective decryption (Option B) is the optimal design. It satisfies confidentiality, minimizes duplication, and integrates cleanly with existing role-based access controls.
ISO/IEC 27001:2013 – Annex A.10.1 Cryptographic controls https://www.iso.org/standard/54534.html NIST Special Publication 800-53 Revision 4 – AC-3 Access Enforcement https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/finalThese sources provide the foundational guidance on encryption, access control, and best practices for handling sensitive data.
Which of the following is NOT a valid basis for data retention?
JustificationCorrect answer – A. Size of the data – Data-retention policies should be driven by factors such as the type of personal data , the legal/regulatory requirements that govern it, the location where it is stored (which may trigger jurisdiction-specific rules), and the last time it was accessed (to determine relevance). The sheer volume of a dataset does not provide a legitimate or compliant basis for keeping or deleting records; retention decisions must be risk-based, not size-based.Why the other options are valid basesB: Type of the data – Different data categories (e.g., biometric, health, financial) carry distinct legal obligations (GDPR Art. 9, HIPAA, etc.), so the nature of the data directly influences retention periods. C. Location of the data – Geographic storage places the data under specific jurisdictional regimes (EU-GDPR, CCPA, etc.), each prescribing its own retention rules. D. Last time the data was accessed – Active-use monitoring can justify continued retention (e.g., for audit or business-need purposes) while stale data may be archived or destroyed.Therefore, size is the only option that does not constitute a recognized, lawful basis for determining retention duration.
International Association of Privacy Professionals (IAPP), CIPT Body of Knowledge – Data Retention – https://iapp.org/certificate-program/cips/ European Data Protection Board (EDPB), Guidelines on Data Retention – https://edpb.europa.eu/our-work/guidance-documents/data-protection-guidelines (PDF)
An organization needs to be able to manipulate highly sensitive personal information without revealing the contents of the data to the users. The organization should investigate the use of?
JustificationHomomorphic encryption (B) is the only technique that allows a party to perform arithmetic or logical operations directly on ciphertext . This means the data can be manipulated (e.g., aggregated, filtered, transformed) while it remains encrypted, ensuring the underlying plaintext is never exposed to the processing user. It therefore meets the requirement for handling “highly sensitive personal information without revealing the contents.”AES (A) is a symmetric block cipher that provides confidentiality but requires decryption before any meaningful computation can occur . Because the plaintext must be exposed to the processing environment, it does not satisfy the “manipulate without revealing contents” criterion.Quantum encryption (C) refers primarily to quantum key distribution (QKD) , which secures the exchange of keys rather than enabling computation on encrypted data. It does not address the core need of performing operations on data while it is still encrypted.Pseudonymization (D) removes or replaces direct identifiers, but the underlying content remains readable and manipulable in plaintext . It therefore offers no technical guarantee that the data’s contents stay hidden during processing.Conclusion: Only homomorphic encryption provides the technical capability to keep data encrypted while permitting the required transformations, making it the correct choice.
Homomorphic Encryption Standard (NIST) – https://csrc.nist.gov/projects/quantum-safe-cryptography/homomorphic-encryption Microsoft SEAL documentation – https://github.com/microsoft/SEAL/blob/master/README.md
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.