CIPT CERTIFIED INFORMATION PRIVACY TECHNOLOGIST
COMPREHENSIVE EXAM 2026/2027 QUESTIONS AND
SOLUTIONS RATED A+
✔✔Browser Fingerprinting - ✔✔As technology has advanced, it has become easier to
differentiate between users just based on the given instance of the browser they are
using. Each browser keeps some information about the elements it encounters on a
given webpage. For instance, a browser will keep information on a text font so that the
next time that font is encountered on a webpage, the information can be reproduced
more easily. Because each of these saved elements have been accessed at different
times and in different orders, each instance of a browser is to some extent unique.
Tracking users using this kind of technology continues to become more prevalent.
✔✔Caching - ✔✔The saving of local copies of downloaded content, reducing the need
to repeatedly download content. To protect privacy, pages that display personal
information should be set to prohibit caching.
✔✔California Online Privacy Protection Act - ✔✔Requires that all websites catering to
California citizens provide a privacy statement to visitors and a easy-to-find link to it on
their web pages. Websites that carry personal data on children less than 18 years of
age must permit those children to delete data collected about them. Websites also must
inform visitors of the type of Do Not Track mechanisms they support or if they do not
support any at all.
✔✔Children's Online Privacy Protection Act (COPPA) of 1998 - ✔✔A U.S. federal law
that applies to the operators of commercial websites and online services that are
directed to children under the age of 13. It also applies to general audience websites
and online services that have actual knowledge that they are collecting personal
information from children under the age of 13. COPPA requires these website
operators: to post a privacy policy on the homepage of the website; provide notice about
collection practices to parents; obtain verifiable parental consent before collecting
personal information from children; give parents a choice as to whether their child's
personal information will be disclosed to third parties; provide parents access and the
opportunity to delete the child's personal information and opt out of future collection or
use of the information, and maintain the confidentiality, security and integrity of personal
information collected from children.
✔✔Choice - ✔✔An individual's ability to determine whether or how their personal
information may be used or disclosed by the entity that collected the information. Also,
the ability of an individual to limit certain uses of their personal information. For
example; an individual may have choice about whether to permit a company to contact
them or share their data with third parties. Can be express or implied.
✔✔Ciphertext - ✔✔Encrypted (enciphered) data.
,✔✔Closed Circuit Television - ✔✔Systems of cameras, monitors and recording
equipment that are not used for broadcasting but are connected to a closed network by
cables. CCTV is used primarily for video surveillance of premises.
✔✔Cloud Computing - ✔✔The storage of information on the Internet. Although it is an
evolving concept, definitions typically include on-demand accessibility, scalability, and
secure access from almost any location. Cloud storage presents unique security risks.
✔✔Collection Limitation - ✔✔A fair information practices principle, it is the principle
stating there should be limits to the collection of personal data, that any such data
should be obtained by lawful and fair means and, where appropriate, with the
knowledge or consent of the data subject.
✔✔Communications Privacy - ✔✔One of the four classes of privacy, along with
information privacy, bodily privacy and territorial privacy. It encompasses protection of
the means of correspondence, including postal mail, telephone conversations,
electronic e-mail and other forms of communicative behavior and apparatus.
✔✔Completeness Arguments - ✔✔Used as a means of assuring compliance with
privacy rules and policies in the design of new software systems. Completeness
arguments take privacy rules and compare them to the system requirements that have
been used to design a new software system. By pairing privacy rules with specific
system requirements, necessary technical safeguards can be accounted for, preventing
the software from being designed in such a way that would violate privacy policies and
regulations.
✔✔Computer Forensics - ✔✔The discipline of assessing and examining an information
system for relevant clues even after it has been compromised by an exploit.
✔✔Concept of Operations - ✔✔Used in Plan-driven Development Models, a Concept of
Operations is a detailed outline of how a software product or system will work once it is
fully operational. This is used to shape how a product or system will be designed and
implemented.
✔✔Confidentiality - ✔✔The obligation of an individual, organization or business to
protect personal information and not misuse or wrongfully disclose that information.
✔✔Consent - ✔✔This privacy requirement is one of the fair information practices.
Individuals must be able to prevent the collection of their personal data, unless the
disclosure is required by law. If an individual has choice (see Choice) about the use or
disclosure of his or her information, consent is the individuals' way of giving permission
for the use or disclosure. Consent may be affirmative; i.e., opt-in; or implied; i.e., the
individual didn't opt out. (1) Explicit Consent: A requirement that an individual "signifies"
his or her agreement with a data controller by some active communication between the
parties. According to the EU Data Protection Directive, explicit consent is required for
, processing of sensitive information. Further, data controllers cannot infer consent from
non-response to a communication. (2) Implicit Consent: Implied consent arises where
consent may reasonably be inferred from the action or inaction of the individual.
✔✔Content Delivery Network - ✔✔The servers that contain most or all of the visible
elements of a web page and that are contacted to provide those elements. In the realm
of advertising, a general ad server is contacted after a webpage is requested, that ad
server looks up any known information on the user requesting to access the webpage.
✔✔Contextual Advertising - ✔✔The most used form of targeted advertising on the
internet. The content of the ad relies on the content of the webpage or the query
entered by a user.
✔✔Contextual Integrity - ✔✔A concept developed by Helen Nissenbaum, contextual
integrity is a way to think about and quantify potential privacy risks in software systems
and products. Contextual Integrity focuses on what consumer expectations are in a
given situation and how the product or system differs from that expectation. The more a
product or system deviates from those expectations, the more likely a consumer will
perceive a privacy harm.
✔✔Cookie - ✔✔A small text file stored on a client machine that may later be retrieved
by a web server from the machine. Cookies allow web servers to keep track of the end
user's browser activities, and connect individual web requests into a session. Cookies
can also be used to prevent users from having to be authorized for every password
protected page they access during a session by recording that they have successfully
supplied their user name and password already. Cookies may be referred to as "first-
party" (if they are placed by the website that is visited) or "third-party" (if they are placed
by a party other than the visited website). Additionally, they may be referred to as
"session cookies" if they are deleted when a session ends, or "persistent cookies" if they
remain longer.
✔✔Cross-site Scripting - ✔✔Code injected by malicious web users into web pages
viewed by other users.
✔✔Cryptography - ✔✔The science or practice of hiding information, usually through its
transformation. Common cryptographic functions include: encryption, decryption, digital
signature and non-repudiation.
✔✔Cryptosystem - ✔✔The materials necessary to encrypt and decrypt a given
message, usually consisting of the encryption algorithm and the security key.
✔✔Customer Access - ✔✔A customer's ability to access the personal information
collected on them as well as review, correct or delete any incorrect information.
COMPREHENSIVE EXAM 2026/2027 QUESTIONS AND
SOLUTIONS RATED A+
✔✔Browser Fingerprinting - ✔✔As technology has advanced, it has become easier to
differentiate between users just based on the given instance of the browser they are
using. Each browser keeps some information about the elements it encounters on a
given webpage. For instance, a browser will keep information on a text font so that the
next time that font is encountered on a webpage, the information can be reproduced
more easily. Because each of these saved elements have been accessed at different
times and in different orders, each instance of a browser is to some extent unique.
Tracking users using this kind of technology continues to become more prevalent.
✔✔Caching - ✔✔The saving of local copies of downloaded content, reducing the need
to repeatedly download content. To protect privacy, pages that display personal
information should be set to prohibit caching.
✔✔California Online Privacy Protection Act - ✔✔Requires that all websites catering to
California citizens provide a privacy statement to visitors and a easy-to-find link to it on
their web pages. Websites that carry personal data on children less than 18 years of
age must permit those children to delete data collected about them. Websites also must
inform visitors of the type of Do Not Track mechanisms they support or if they do not
support any at all.
✔✔Children's Online Privacy Protection Act (COPPA) of 1998 - ✔✔A U.S. federal law
that applies to the operators of commercial websites and online services that are
directed to children under the age of 13. It also applies to general audience websites
and online services that have actual knowledge that they are collecting personal
information from children under the age of 13. COPPA requires these website
operators: to post a privacy policy on the homepage of the website; provide notice about
collection practices to parents; obtain verifiable parental consent before collecting
personal information from children; give parents a choice as to whether their child's
personal information will be disclosed to third parties; provide parents access and the
opportunity to delete the child's personal information and opt out of future collection or
use of the information, and maintain the confidentiality, security and integrity of personal
information collected from children.
✔✔Choice - ✔✔An individual's ability to determine whether or how their personal
information may be used or disclosed by the entity that collected the information. Also,
the ability of an individual to limit certain uses of their personal information. For
example; an individual may have choice about whether to permit a company to contact
them or share their data with third parties. Can be express or implied.
✔✔Ciphertext - ✔✔Encrypted (enciphered) data.
,✔✔Closed Circuit Television - ✔✔Systems of cameras, monitors and recording
equipment that are not used for broadcasting but are connected to a closed network by
cables. CCTV is used primarily for video surveillance of premises.
✔✔Cloud Computing - ✔✔The storage of information on the Internet. Although it is an
evolving concept, definitions typically include on-demand accessibility, scalability, and
secure access from almost any location. Cloud storage presents unique security risks.
✔✔Collection Limitation - ✔✔A fair information practices principle, it is the principle
stating there should be limits to the collection of personal data, that any such data
should be obtained by lawful and fair means and, where appropriate, with the
knowledge or consent of the data subject.
✔✔Communications Privacy - ✔✔One of the four classes of privacy, along with
information privacy, bodily privacy and territorial privacy. It encompasses protection of
the means of correspondence, including postal mail, telephone conversations,
electronic e-mail and other forms of communicative behavior and apparatus.
✔✔Completeness Arguments - ✔✔Used as a means of assuring compliance with
privacy rules and policies in the design of new software systems. Completeness
arguments take privacy rules and compare them to the system requirements that have
been used to design a new software system. By pairing privacy rules with specific
system requirements, necessary technical safeguards can be accounted for, preventing
the software from being designed in such a way that would violate privacy policies and
regulations.
✔✔Computer Forensics - ✔✔The discipline of assessing and examining an information
system for relevant clues even after it has been compromised by an exploit.
✔✔Concept of Operations - ✔✔Used in Plan-driven Development Models, a Concept of
Operations is a detailed outline of how a software product or system will work once it is
fully operational. This is used to shape how a product or system will be designed and
implemented.
✔✔Confidentiality - ✔✔The obligation of an individual, organization or business to
protect personal information and not misuse or wrongfully disclose that information.
✔✔Consent - ✔✔This privacy requirement is one of the fair information practices.
Individuals must be able to prevent the collection of their personal data, unless the
disclosure is required by law. If an individual has choice (see Choice) about the use or
disclosure of his or her information, consent is the individuals' way of giving permission
for the use or disclosure. Consent may be affirmative; i.e., opt-in; or implied; i.e., the
individual didn't opt out. (1) Explicit Consent: A requirement that an individual "signifies"
his or her agreement with a data controller by some active communication between the
parties. According to the EU Data Protection Directive, explicit consent is required for
, processing of sensitive information. Further, data controllers cannot infer consent from
non-response to a communication. (2) Implicit Consent: Implied consent arises where
consent may reasonably be inferred from the action or inaction of the individual.
✔✔Content Delivery Network - ✔✔The servers that contain most or all of the visible
elements of a web page and that are contacted to provide those elements. In the realm
of advertising, a general ad server is contacted after a webpage is requested, that ad
server looks up any known information on the user requesting to access the webpage.
✔✔Contextual Advertising - ✔✔The most used form of targeted advertising on the
internet. The content of the ad relies on the content of the webpage or the query
entered by a user.
✔✔Contextual Integrity - ✔✔A concept developed by Helen Nissenbaum, contextual
integrity is a way to think about and quantify potential privacy risks in software systems
and products. Contextual Integrity focuses on what consumer expectations are in a
given situation and how the product or system differs from that expectation. The more a
product or system deviates from those expectations, the more likely a consumer will
perceive a privacy harm.
✔✔Cookie - ✔✔A small text file stored on a client machine that may later be retrieved
by a web server from the machine. Cookies allow web servers to keep track of the end
user's browser activities, and connect individual web requests into a session. Cookies
can also be used to prevent users from having to be authorized for every password
protected page they access during a session by recording that they have successfully
supplied their user name and password already. Cookies may be referred to as "first-
party" (if they are placed by the website that is visited) or "third-party" (if they are placed
by a party other than the visited website). Additionally, they may be referred to as
"session cookies" if they are deleted when a session ends, or "persistent cookies" if they
remain longer.
✔✔Cross-site Scripting - ✔✔Code injected by malicious web users into web pages
viewed by other users.
✔✔Cryptography - ✔✔The science or practice of hiding information, usually through its
transformation. Common cryptographic functions include: encryption, decryption, digital
signature and non-repudiation.
✔✔Cryptosystem - ✔✔The materials necessary to encrypt and decrypt a given
message, usually consisting of the encryption algorithm and the security key.
✔✔Customer Access - ✔✔A customer's ability to access the personal information
collected on them as well as review, correct or delete any incorrect information.
