CIPM EXAM WITH 100% CORRECT
ANSWERS
When is a DPIA required (4) - Answer-1. If processing is likely to entail high risk to DS
2. Use of new technologies 3. Article 35 of GDPR 4. Article 29 Working Party
Article 28, GDPR requires 3 things regarding vendors - Answer-1. do due diligence
before working with a vendor 2. data processing agreements 3. controller has right to
audit processor
3 Components of Privacy Operational Lifecycle - Answer-1. Assess 2. Protect 3. Sustain
4. Respond
How do privacy and security intersect - Answer-Security is about if the info is secure or
not, privacy is about the specific info and the people represented by that info.
Info Security - Answer-provides admin, technical, and physical controls/safe gaurds to
reduce probably damage, loss, or unauthorized data use
Access controls - Answer-govern who has the right to access specific info
role-based controls - Answer-help with access controls, ensure only the people who
need access to certain info have it
Basic Security Principles for Role-based Controls (3) - Answer-1. Segregation of Duties
2. Least Privilege 3. Need-to-Know Access
Segregation of Duties - Answer-Ensures that one person cannot exploit or gain access
to info inappropriately.
Least Privilege - Answer-Providing only the minimum amount of privileges necessary to
perform a job or function.
Need to know basis - Answer-Access is restricted to only info that is critical to the
performance of an authorized, assigned mission
Goal of evaluating security controls - Answer-ensure they are implemented and
operating effectively to achieve org's privacy practices
, Idenfitied info - Answer-has unique identifiers across DBs, contact info is stored with
profile info
Pseudonymous Data - Answer-Linkable with reasonable effort - common IDs across Ds,
contact info stored separately from profile/transaction info
Anonymous data - Answer-Unlinkable, no collection of contact info, no collection of long
term personal characteristics
obfuscation techniques - Answer-the action of making something obscure, unclear, or
unintelligible - Ex: Masking, Randomization, Noise, Hashing
Data minimization techniques - Answer-1. Data Segregation 2. Compression 3.
Aggregation 4. Deletion 5. De-identification
Common security practices (5) - Answer-1. Data loss prevention 2. Destruction 3.
Encryption 4. Auditing and testing 5. Access controls for physical and virtual systems
Privacy engineering technologies (2) - Answer-1. Differential privacy (system for publicly
sharing information about a dataset by describing the patterns of groups within the
dataset while withholding information about individuals in the dataset.) 2. Homomorphic
encryption (can be used for privacy-preserving outsourced storage and computation)
Privacy engineering - Answer-Aims to provide methods, tools, and techniques that
ensure acceptable levels of privacy
privacy by design facilitates privacy - Answer-engineering - provides valuable design
guidelines
Difference between EU and US approach to PbD - Answer-US - If there is no harm
done from the invasion - no problem
EU - irrelevant if there is no harm, any sort of invasion is a problem
What can help a senior exec see value of planning for an incident or breach? - Answer-
Translating statistics to monetary values (i.e. cost per individual record lost or
compromised)
Orgs risks due to a data breach (5) - Answer-1. lost revenue 2. legal and regulatory
costs/fines 3. loss of business 3. impact on busn relationships 4. loss of
customer/consumer trust 5. damage to public perception
Individual risks due to a data breach (4) - Answer-1. emotional distress 2. identity theft
3. reputational harm 4. financial damage
What causes most data breaches - Answer-Malicious/criminal attacks - 48%
ANSWERS
When is a DPIA required (4) - Answer-1. If processing is likely to entail high risk to DS
2. Use of new technologies 3. Article 35 of GDPR 4. Article 29 Working Party
Article 28, GDPR requires 3 things regarding vendors - Answer-1. do due diligence
before working with a vendor 2. data processing agreements 3. controller has right to
audit processor
3 Components of Privacy Operational Lifecycle - Answer-1. Assess 2. Protect 3. Sustain
4. Respond
How do privacy and security intersect - Answer-Security is about if the info is secure or
not, privacy is about the specific info and the people represented by that info.
Info Security - Answer-provides admin, technical, and physical controls/safe gaurds to
reduce probably damage, loss, or unauthorized data use
Access controls - Answer-govern who has the right to access specific info
role-based controls - Answer-help with access controls, ensure only the people who
need access to certain info have it
Basic Security Principles for Role-based Controls (3) - Answer-1. Segregation of Duties
2. Least Privilege 3. Need-to-Know Access
Segregation of Duties - Answer-Ensures that one person cannot exploit or gain access
to info inappropriately.
Least Privilege - Answer-Providing only the minimum amount of privileges necessary to
perform a job or function.
Need to know basis - Answer-Access is restricted to only info that is critical to the
performance of an authorized, assigned mission
Goal of evaluating security controls - Answer-ensure they are implemented and
operating effectively to achieve org's privacy practices
, Idenfitied info - Answer-has unique identifiers across DBs, contact info is stored with
profile info
Pseudonymous Data - Answer-Linkable with reasonable effort - common IDs across Ds,
contact info stored separately from profile/transaction info
Anonymous data - Answer-Unlinkable, no collection of contact info, no collection of long
term personal characteristics
obfuscation techniques - Answer-the action of making something obscure, unclear, or
unintelligible - Ex: Masking, Randomization, Noise, Hashing
Data minimization techniques - Answer-1. Data Segregation 2. Compression 3.
Aggregation 4. Deletion 5. De-identification
Common security practices (5) - Answer-1. Data loss prevention 2. Destruction 3.
Encryption 4. Auditing and testing 5. Access controls for physical and virtual systems
Privacy engineering technologies (2) - Answer-1. Differential privacy (system for publicly
sharing information about a dataset by describing the patterns of groups within the
dataset while withholding information about individuals in the dataset.) 2. Homomorphic
encryption (can be used for privacy-preserving outsourced storage and computation)
Privacy engineering - Answer-Aims to provide methods, tools, and techniques that
ensure acceptable levels of privacy
privacy by design facilitates privacy - Answer-engineering - provides valuable design
guidelines
Difference between EU and US approach to PbD - Answer-US - If there is no harm
done from the invasion - no problem
EU - irrelevant if there is no harm, any sort of invasion is a problem
What can help a senior exec see value of planning for an incident or breach? - Answer-
Translating statistics to monetary values (i.e. cost per individual record lost or
compromised)
Orgs risks due to a data breach (5) - Answer-1. lost revenue 2. legal and regulatory
costs/fines 3. loss of business 3. impact on busn relationships 4. loss of
customer/consumer trust 5. damage to public perception
Individual risks due to a data breach (4) - Answer-1. emotional distress 2. identity theft
3. reputational harm 4. financial damage
What causes most data breaches - Answer-Malicious/criminal attacks - 48%
