support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. IAPP
  4. CIPT

IAPP CIPT Exam Prep
Certified Information Privacy Technologist (CIPT) (Page 8 )

Updated On: 12-Sep-2026
Page 8 of 66
PDF with 325 Questions

Which of the following is considered a records management best practice?

  1. Archiving expired data records and files.
  2. Storing decryption keys with their associated backup systems.
  3. Implementing consistent handling practices across all record types.
  4. Using classification to determine access rules and retention policy.

Answer(s): D

Explanation:

Why option D is the best choice
Classification drives retention & access control – In records-management standards (e.g., ISO 15489, NARA M-19), the primary step is to classify records so that appropriate retention periods, disposal schedules, and access rules can be applied uniformly. This enables consistent governance and compliance across the organization. Directly addresses both access and retention – Classification explicitly ties a record’s sensitivity level to its retention schedule and to who may retrieve or disclose it, fulfilling the core records-management objectives of security and legal hold. Facilitates auditable processes – A documented classification scheme creates a traceable audit trail, making it easier to verify that records are handled according to policy throughout their lifecycle.
Why the other options are less suitable
Archiving expired data records and files (A) – Archiving is a downstream activity; it does not establish the policies that determine what should be retained or for how long, so it does not encompass the broader best-practice of systematic handling. Storing decryption keys with their associated backup systems (B) – While key management is critical for data protection, it is a technical control rather than a records-management best practice focused on classification, retention, and lifecycle governance. Implementing consistent handling practices across all record types (C) – Consistency is valuable, but without an underlying classification framework that defines retention and access rules, the consistency lacks the requisite policy basis and may lead to inappropriate handling of sensitive records.


Reference:

ISO 15489-1:2016 – Information and documentation — Records management — Part 1: General – https://www.iso.org/standard/62071.html National Archives and Records Administration (NARA) – Records Management Guidance – https://www.archives.gov/records-management-best-practices
These sources define the classification-based approach as the foundational best practice in records management.



Which of the following provides a mechanism that allows an end-user to use a single sign-on (SSO) for multiple services?

  1. The Open ID Federation.
  2. PCI Data Security Standards Council
  3. International Organization for Standardization.
  4. Personal Information Protection and Electronic Documents Act.

Answer(s): A

Explanation:

Why option A is correct
The Open ID Federation defines protocols (e.g., OpenID Connect) that enable a single identity provider to authenticate a user once, allowing that user to access multiple services without re-entering credentials – the essence of SSO. It provides the necessary federation-level specifications, trust frameworks, and token exchange mechanisms that let disparate applications interoperate under a common authentication flow.
Why the other options are not suitable
B – PCI Data Security Standards Council : Focuses on securing cardholder data and does not define authentication or federation mechanisms for SSO across services.
C – International Organization for Standardization : ISO is a standards-setting body; while it publishes standards related to security and privacy, it does not itself supply an SSO protocol or federation model.
D – Personal Information Protection and Electronic Documents Act : This is Canadian privacy legislation; it governs data handling but contains no technical specification for SSO implementation.
Key takeaway – Only the Open ID Federation explicitly provides a technical framework for single sign-on across multiple services, making it the correct choice.


Reference:

OpenID Connect Core 1.0 Specification: https://openid.net/specifications/openid-connect-core-1_0.html OpenID Federation Overview (OpenID Foundation): https://openid.net/federation/
These documents detail the protocols and trust models that enable SSO in federated identity environments.



A user who owns a resource wants to give other individuals access to the resource.
What control would apply?

  1. Mandatory access control.
  2. Role-based access controls.
  3. Discretionary access control.
  4. Context of authority controls.

Answer(s): C

Explanation:

Why “Discretionary Access Control (DAC)” is the appropriate answer
The owner of a resource possesses the authority to decide who may use that resource. DAC mechanisms are designed specifically for this scenario: they let the resource owner grant or revoke permissions at will, without requiring central policy enforcement. Operations such as “share a file,” “invite a collaborator,” or “publish a document” are classic DAC functions because the owner explicitly delegates access rights.
Why the other choices are less suitable
Mandatory Access Control (MAC) – Access decisions are governed by system-wide policies and labels (e.g., “confidential,” “top-secret”) that users cannot override. The owner does not have discretionary authority; therefore MAC does not match the described use case.
Role-Based Access Control (RBAC) – Permissions are assigned based on pre-defined roles within an organization, not on the individual owner’s ad-hoc decision to share a particular resource.
While RBAC can enforce broader policies, it does not capture the owner-centric delegation characteristic of the question. Context-of-Authority Controls – This is not a recognized generic access-control model; it may refer to situational rules (e.g., time-of-day, location), which are unrelated to the basic owner-initiated sharing described.
Conclusion The control that directly supports a resource owner granting access to others on a case-by-case basis is Discretionary Access Control , making option C the correct answer.


Reference:

NIST Special Publication 800-16 – Access Control Guidelines ( https://csrc.nist.gov/publications/detail/sp/800-16/rev-1/final ) ISO/IEC 27001:2022 – Information security management systems – Code of practice for information security controls ( https://www.iso.org/standard/75733.html )



What is the potential advantage of homomorphic encryption?

  1. Encrypted information can be analyzed without decrypting it first.
  2. Ciphertext size decreases as the security level increases.
  3. It allows greater security and faster processing times.
  4. It makes data impenetrable to attacks.

Answer(s): A

Explanation:

Answer is: A. Encrypted information can be analyzed without decrypting it first.
Why A is correct
Homomorphic encryption enables computation on ciphertext, producing an encrypted result that, when decrypted, matches the outcome of the same operations performed on the plaintext. This property allows data to be processed, searched, or aggregated while it remains encrypted, preserving confidentiality end-to-end.
Why the other options are inferior
B: Ciphertext size decreases as the security level increases – Incorrect; ciphertext size typically grows with higher security parameters to maintain strength, not shrink.
C: It allows greater security and faster processing times – Partially true about security, but homomorphic schemes are computationally intensive; they do not generally provide faster processing compared to clear-text operations.
D: It makes data impenetrable to attacks – Overstates capability; homomorphic encryption protects data in use, but it does not guarantee immunity to all cryptanalytic attacks, especially implementation flaws or side-channel exploits.


Reference:

International Association of Privacy Professionals (IAPP) – “Homomorphic Encryption Overview” – https://iapp.org/resources/data-privacy-frameworks/homomorphic-encryption/ IBM Security – “What Is Homomorphic Encryption?” – https://www.ibm.com/security/articles/homomorphic-encryption
Prepared for certification exam review, focusing on technical precision and exam-relevant rationale.



What has been found to undermine the public key infrastructure system?

  1. Man-in-the-middle attacks.
  2. Inability to track abandoned keys.
  3. Disreputable certificate authorities.
  4. Browsers missing a copy of the certificate authority's public key.

Answer(s): C

Explanation:

Justification
Option C – Disreputable certificate authorities is the root cause of the most critical PKI failure mode. A trusted hierarchy can be subverted when a CA issues fraudulent certificates or deliberately mis-issues them, thereby destroying the trust model that PKI relies on. Real-world incidents (e.g., DigiNotar 2011, Symantec 2017) demonstrate how compromised or negligent CAs can lead to widespread certificate-trust loss, man-in-the-middle (MITM) capability, and forced revocation of large numbers of certificates.
Option A – Man-in-the-middle attacks are often cited as a threat, but they are generally mitigated by PKI mechanisms such as certificate pinning, OCSP stapling, and strict validation of certificate chains. MITM attacks succeed primarily when the underlying trust anchor is already weakened, i.e., when a disreputable CA is involved; thus, this is a symptom rather than the primary systemic flaw.
Option B – Inability to track abandoned keys describes a known operational challenge, yet it pertains mainly to key lifecycle management and does not directly undermine the cryptographic trust foundation of PKI. Modern revocation infrastructures (CRLs, OCSP, CRL-DP, etc.) can handle abandoned keys, albeit with administrative overhead.
Option D – Browsers missing a copy of the CA’s public key would cause certificate validation failures for specific users, but it is a configuration error rather than an inherent design weakness of PKI. Moreover, browsers are equipped with pre-installed root store updates, making this scenario less pervasive than systemic CA misconduct.
Conclusion – The erosion of the trust chain is most fundamentally attributed to disreputable certificate authorities , as they compromise the very premise that certificates uniquely identify a trustworthy entity. This flaw can cascade into broader PKI dysfunction, whereas the other options represent either secondary issues or operational inconveniences.


Reference:

RFC 5280 – Internet X.509 Public Key Infrastructure Certificate and Certificate Request Syntax Specification. https://www.rfc-editor.org/rfc/rfc5280 “DigiNotar breach” – Wikipedia, https://en.wikipedia.org/wiki/DigiNotar#Security_breach (accessed 2025).



  PDF
Viewing page 8 of 66
Viewing questions 36 - 40 out of 325 questions


Post your Comments and Discuss IAPP CIPT exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!