support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. IAPP
  4. CIPT

IAPP CIPT Exam Prep
Certified Information Privacy Technologist (CIPT) (Page 9 )

Updated On: 3-Oct-2026
Page 9 of 66
PDF with 325 Questions

SCENARIO
Wesley Energy has finally made its move, acquiring the venerable oil and gas exploration firm Lancelot from its long-time owner David Wilson. As a member of the transition team, you have come to realize that Wilson's quirky nature affected even Lancelot's data practices, which are maddeningly inconsistent. "The old man hired and fired IT people like he was changing his necktie," one of Wilson's seasoned lieutenants tells you, as you identify the traces of initiatives left half complete.

For instance, while some proprietary data and personal information on clients and employees is encrypted, other sensitive information, including health information from surveillance testing of employees for toxic exposures, remains unencrypted, particularly when included within longer records with less-sensitive data. You also find that data is scattered across applications, servers and facilities in a manner that at first glance seems almost random.
Among your preliminary findings of the condition of data at Lancelot are the following:
Cloud technology is supplied by vendors around the world, including firms that you have not heard of. You are told by a former Lancelot employee that these vendors operate with divergent security requirements and protocols.
The company's proprietary recovery process for shale oil is stored on servers among a variety of less- sensitive information that can be accessed not only by scientists, but by personnel of all types at most company locations.
DES is the strongest encryption algorithm currently used for any file.
Several company facilities lack physical security controls, beyond visitor check-in, which familiar vendors often bypass.
Fixing all of this will take work, but first you need to grasp the scope of the mess and formulate a plan of action to address it.

Which is true regarding the type of encryption Lancelot uses?

  1. It employs the data scrambling technique known as obfuscation.
  2. Its decryption key is derived from its encryption key.
  3. It uses a single key for encryption and decryption.
  4. It is a data masking methodology.

Answer(s): C

Explanation:

Why option C is correct
Lancelot’s encryption is described as “the strongest encryption algorithm currently used” and that algorithm is DES . DES (Data Encryption Standard) is a symmetric-key block cipher ; the same secret key is used for both encrypting plaintext into ciphertext and for decrypting ciphertext back into plaintext. In symmetric encryption the encryption key is the decryption key (or mathematically related but operationally treated as a single key material). This matches statement C: “It uses a single key for encryption and decryption.”
Why the other choices are not appropriate
A – “It employs the data scrambling technique known as obfuscation.” Obfuscation is a reversible transformation that merely hides data structure; it is not a cryptographic encryption algorithm. DES is a formally defined cipher, not an ad-hoc obfuscation method.
B – “Its decryption key is derived from its encryption key.” While key-derivation functions exist in some modern schemes, DES does not derive a separate decryption key from an encryption key. The algorithm’s design uses the identical key material for both operations. Claiming derivation adds unnecessary complexity that is not present in the described implementation.
D – “It is a data masking methodology.” Data masking replaces sensitive values with non-sensitive placeholders (e.g., tokenization). It does not provide cryptographic confidentiality. DES encrypts data to render it unreadable without the key, which is fundamentally different from masking.
Therefore, option C accurately reflects the nature of the encryption used by Lancelot.


Reference:

NIST FIPS 197 – Data Encryption Standard (DES): https://csrc.nist.gov/publications/fips/fips197/fips_197.pdf NIST SP 800-57 Part 1 – Recommendation for Key Management: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
These documents confirm that DES is a symmetric-key algorithm employing a single key for both encryption and decryption, supporting the selection of option C.



SCENARIO
Wesley Energy has finally made its move, acquiring the venerable oil and gas exploration firm Lancelot from its long-time owner David Wilson. As a member of the transition team, you have come to realize that Wilson's quirky nature affected even Lancelot's data practices, which are maddeningly inconsistent. "The old man hired and fired IT people like he was changing his necktie," one of Wilson's seasoned lieutenants tells you, as you identify the traces of initiatives left half complete.

For instance, while some proprietary data and personal information on clients and employees is encrypted, other sensitive information, including health information from surveillance testing of employees for toxic exposures, remains unencrypted, particularly when included within longer records with less-sensitive data. You also find that data is scattered across applications, servers and facilities in a manner that at first glance seems almost random.
Among your preliminary findings of the condition of data at Lancelot are the following:
Cloud technology is supplied by vendors around the world, including firms that you have not heard of. You are told by a former Lancelot employee that these vendors operate with divergent security requirements and protocols.
The company's proprietary recovery process for shale oil is stored on servers among a variety of less- sensitive information that can be accessed not only by scientists, but by personnel of all types at most company locations.
DES is the strongest encryption algorithm currently used for any file.
Several company facilities lack physical security controls, beyond visitor check-in, which familiar vendors often bypass.
Fixing all of this will take work, but first you need to grasp the scope of the mess and formulate a plan of action to address it.

Which procedure should be employed to identify the types and locations of data held by Wesley Energy?

  1. Privacy audit.
  2. Log collection
  3. Data inventory.
  4. Data classification.

Answer(s): C

Explanation:

Why “Data inventory” is the correct procedure
A data inventory systematically catalogs what data exists, where it resides, in which formats, and who owns it . This gives the transition team the full picture of the fragmented data landscape at Lancelot (e.g., encrypted vs. unencrypted files, cloud providers, server locations, and physical sites). The inventory is the foundation for any subsequent privacy-focused activity; it answers the question “what data do we actually have?” before we can audit, classify, or secure it.
Why the other options are insufficient
Privacy audit – evaluates compliance and risk but does not, by itself, locate or enumerate data assets; it relies on an inventory to be effective. Log collection – captures system-generated events (access, errors) but does not reveal the content or location of stored data stores. Data classification – involves labeling data based on sensitivity, yet it presupposes that the data has already been discovered and mapped; without an inventory, classification cannot be performed accurately.
Practical steps for the inventory
1. Identify all data stores (servers, cloud buckets, backup media, removable media). 2. Document data owners, custodians, and business purpose. 3. Record metadata such as file types, storage locations, encryption status, and retention schedules. 4. Use automated tools or manual discovery to map relationships between data elements across sites.
With a complete inventory in hand, Wesley Energy can then proceed to classification, risk assessment, and remediation planning.


Reference:

IAPP CIPP/E Body of Knowledge – Data Mapping and Inventory ( https://iapp.org/certify/cipte/ ) NIST SP 800-53 Rev. 5 – SC-12: Information System Inventory and Assessment ( https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final )



A credit card with the last few numbers visible is an example of what?

  1. Masking data
  2. Synthetic data
  3. Sighting controls.
  4. Partial encryption

Answer(s): A

Explanation:

Justification
The scenario describes a credit card where only the last few digits are displayed, while the rest of the data remains hidden or obscured. This technique is used to protect the full PAN (Primary Account Number) while still allowing identification of the card; it is a classic example of masking data . Masking data is a privacy-preserving method that partially reveals an identifier by replacing part of it with a placeholder (e.g., asterisks), thereby reducing exposure risk. Synthetic data refers to artificially generated datasets that preserve statistical properties but contain no real personal information; the credit-card example does not meet this definition. Sighting controls are mechanisms that restrict observational access to sensitive information (e.g., limiting who can view a record), which is broader than the technical act of leaving only part of a number visible. Partial encryption involves encrypting only a portion of the data; the visible digits are not encrypted at all, they are simply shown, so this term does not apply.
Conclusion: Among the given options, Masking data precisely describes the practice of displaying only a subset of a credit-card number to minimize privacy risk.


Reference:

IAPP CIPP/E Study Guide – Data Masking Techniques: https://iapp.org/resources/cipp-study-guide/data-masking/ European Data Protection Board (EDPB) Guidance on Pseudonymisation and Anonymisation, mentioning masking as a privacy-enhancing measure: https://edpb.europa.eu/law/guidance/pseudonymisation_en



What is an example of a just-in-time notice?

  1. A warning that a website may be unsafe.
  2. A full organizational privacy notice publicly available on a website
  3. A credit card company calling a user to verify a purchase before it is authorized
  4. Privacy information given to a user when he attempts to comment on an online article.

Answer(s): D

Explanation:

I would like to ask you some questions, so please output in json format following the given template.
"matched_user_question": "", "confidence_score": <score between 0.0 and 1.0>



A vendor has been collecting data under an old contract, not aligned with the practices of the organization.
Which is the preferred response?

  1. Destroy the data
  2. Update the contract to bring the vendor into alignment.
  3. Continue the terms of the existing contract until it expires.
  4. Terminate the contract and begin a vendor selection process.

Answer(s): B

Explanation:

Why Option B is the preferred response
Regulatory alignment – Updating the contract ensures the vendor’s data collection practices satisfy current privacy laws and internal policy requirements, eliminating the risk of non-compliance. Risk mitigation – Rather than abruptly ending the relationship (which can cause service disruption) or destroying valuable data (which may have legitimate business or legal retention value), contractual amendment allows continued oversight and monitoring. Operational continuity – Maintaining the vendor while correcting the contract preserves critical services and avoids the cost and effort of a full vendor-selection process. Governance best practice – Modern privacy frameworks (e.g., GDPR Art. 28, NIST 800-53 PL-2) emphasize the need for enforceable contractual clauses that reflect contemporary data-handling standards; updating the agreement satisfies this control.
Why the other options are less suitable
Destroy the data (A) – Eliminates potentially useful information and may breach contractual or statutory retention obligations; it does not address the underlying privacy practice gap. Continue the terms of the existing contract (C) – Leaves the vendor’s non-compliant practices in place, exposing the organization to ongoing privacy risk and possible regulatory enforcement. Terminate the contract and begin a new vendor selection (D) – Can be disproportionate (service disruption, cost) and does not guarantee that a new vendor will meet the required standards without first establishing updated contractual controls.
Thus, the most balanced and technically sound approach is to amend the contract to bring the vendor into alignment with current privacy practices.


Reference:

IAPP – Managing Third-Party Risk (2023): https://iapp.org/resources/detail/managing-third-party-risk/ IAPP – Data Processing Agreement (DPA) Template (2024): https://iapp.org/resources/detail/data-processing-agreement-template/



  PDF
Viewing page 9 of 66
Viewing questions 41 - 45 out of 325 questions


Post your Comments and Discuss IAPP CIPT exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!