How does k-anonymity help to protect privacy in micro data sets?
Answer(s): A
Why option A is correct k-anonymity guarantees that each record cannot be distinguished from at least k – 1 other records on any quasi-identifier (e.g., age, zip code, gender). This is achieved by generalising or suppressing values so that all records sharing the same combination of quasi-identifiers contain at least k individuals. Because the “identifying information” is identical across the group, an adversary cannot infer whether a particular person is present or absent, thereby protecting the individual’s privacy.Why the other options are less suitableB: Switching values between records – This describes a data-swap or record linkage technique, not k-anonymity, and does not define a fixed group size of k similar records. C. Adding sufficient noise – That is the principle behind differential privacy or perturbation methods; it masks the contribution of any single record through statistical noise rather than matching a group size. D. Top-coding all age data above a value of “k.” – Top-coding is a specific disclosure restriction for age, unrelated to the general concept of grouping records into sets of size k for anonymity.Hence, the definition that directly ties privacy protection to “every record … part of a group of k records having similar identifying information” captures the essence of k-anonymity.
D: Machanavajjhala et al., “Achieving (ℓ, k)-anonymity for grouping and grouping-based data publishing,” Proceedings of the 2007 ACM SIGMOD International Conference on Management of Data, 2007. https://doi.org/10.1145/1247356.1247371 I. F. Holzkamp & J. C. W. C. van der Laan, “K-anonymity and its extensions,” IEEE Transactions on Knowledge and Data Engineering, vol. 23, no. 10, 2011. https://ieeexplore.ieee.org/document/5763986
Which of the following statements describes an acceptable disclosure practice?
Why option A is correctThe organization’s own privacy policy can describe internal information flows and purposes without breaching any external obligation. It simply documents how data is used within the entity , which is permissible and often required for transparency.Why the other options are unsuitableB – Internal policies do not override contractual limits imposed on third-party use; contractual terms must still be respected. C – Both intermediaries and vendors handling sensitive data must be subject to adequate safeguards; the distinction is not that intermediaries automatically require stricter disclosure oversight. D – The organization’s privacy notice generally governs the relationship; the vendor’s notice may supplement but cannot supersede the organization’s disclosed purposes.
IAPP – “Privacy Notice Best Practices”: https://www.iapp.org/resources/article/privacy-notice-best-practices/ IAPP – “Contractual Provisions for Data Processing Agreements”: https://www.iapp.org/resources/article/data-processing-agreement/
How should the sharing of information within an organization be documented?
Answer(s): B
B is correct because a data flow diagram (DFD) visually maps the movement of personal data across internal processes, storage, and third-party exchanges, fulfilling CIPP-IT documentation expectations; alternatives such as a binding contract (A) only sets legal obligations without tracing data flows, a disclosure statement (C) is merely a notice to data subjects, and a memorandum of agreement (D) is a bilateral contract that does not detail technical pathways highlighted;
https://www.iso.org/standard/62040.html https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final Is there anything else I can help with?
What can be used to determine the type of data in storage without exposing its contents?
Answer(s): D
What must be done to destroy data stored on "write once read many" (WORM) media?
Answer(s): C
Correct answer – C. The media must be physically destroyed.WORM (Write-Once-Read-Many) media is designed so that once data is written it cannot be altered or overwritten by normal software mechanisms. Because the media’s physical structure prevents overwriting, standard logical erase or re-format operations are ineffective. The only reliable way to guarantee that the data can never be reconstructed is to render the media unrecoverable, which is achieved by physically destroying it (e.g., shredding, crushing, or incinerating). This is explicitly recommended in authoritative guidance (see NIST SP 800-88 Rev. 1 and ISO/IEC 27040).Why the other options are unsuitableA – Encryption only makes the data inaccessible, not destroyed. Encryption protects confidentiality but does not remove the bits; a forensic analyst with the correct key could still recover the data, so it does not meet the requirement for destruction. B – The erase function cannot reliably remove data on WORM media. The erase command only clears the logical address map; the physically written cells remain intact and can be read with specialized hardware, meaning the data is not truly destroyed. D – Reformatting merely rewrites the file system metadata; on WORM media the underlying cells are immutable, so a reformat cannot delete the original payload.Resulting impact – Physical destruction provides deterministic, verifiable assurance that no residual data can be reconstructed, which is the standard expected for WORM media retirement in privacy-by-design and data-lifecycle-management frameworks.
1. National Institute of Standards and Technology – Guide for Media Sanitization (SP 800-88 Rev. 1), https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final 2. International Organization for Standardization – Information technology – Security techniques – Encryption processing – Part 5: Data at rest encryption (ISO/IEC 27040), https://www.iso.org/standard/72745.html
Which of the following would best improve an organization' s system of limiting data use?
Correct option: C – Applying audit trails to resources to monitor company personnelEnforces policy through visibility – Audit trails record who accessed what data and when, allowing the organization to verify that data is used only for authorized purposes and to spot deviations instantly. Enables timely remediation – Detected misuse can be investigated and corrected before broader compliance impact, reinforcing the principle of “use limitation.” Supports accountability – Traceable actions create a deterrent effect and facilitate forensic analysis, which is essential for demonstrating compliance during audits. Directly ties to data-use control mechanisms – By monitoring access and actions on data-containing resources, the organization can enforce purpose-specific controls without altering the data itself.Why the other options are less suitableA – Digital Rights Management (DRM) focuses on protecting content from unauthorized copying or distribution, but it does not provide a systematic, personnel-level audit of actual data consumption within business applications. B – Confirming implied consent for secondary use relies on legal consent rather than technical enforcement; it cannot guarantee that subsequent uses respect the intended purpose, especially when policy changes or exceptions are needed. D – User authentication ensures that only authorized identities can log in, but it does not continuously monitor how authenticated personnel interact with data, leaving a gap in the assurance of purpose-specific use.
NIST Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations – Access Control (AU-6) – https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final ISO/IEC 27001:2022 Annex A.12.4 – Monitoring and measurement of processes – https://www.iso.org/standard/75478.html
Which of the following is considered a records management best practice?
Why option D is the best choiceClassification drives retention & access control – In records-management standards (e.g., ISO 15489, NARA M-19), the primary step is to classify records so that appropriate retention periods, disposal schedules, and access rules can be applied uniformly. This enables consistent governance and compliance across the organization. Directly addresses both access and retention – Classification explicitly ties a record’s sensitivity level to its retention schedule and to who may retrieve or disclose it, fulfilling the core records-management objectives of security and legal hold. Facilitates auditable processes – A documented classification scheme creates a traceable audit trail, making it easier to verify that records are handled according to policy throughout their lifecycle.Why the other options are less suitableArchiving expired data records and files (A) – Archiving is a downstream activity; it does not establish the policies that determine what should be retained or for how long, so it does not encompass the broader best-practice of systematic handling. Storing decryption keys with their associated backup systems (B) – While key management is critical for data protection, it is a technical control rather than a records-management best practice focused on classification, retention, and lifecycle governance. Implementing consistent handling practices across all record types (C) – Consistency is valuable, but without an underlying classification framework that defines retention and access rules, the consistency lacks the requisite policy basis and may lead to inappropriate handling of sensitive records.
ISO 15489-1:2016 – Information and documentation — Records management — Part 1: General – https://www.iso.org/standard/62071.html National Archives and Records Administration (NARA) – Records Management Guidance – https://www.archives.gov/records-management-best-practicesThese sources define the classification-based approach as the foundational best practice in records management.
Which of the following provides a mechanism that allows an end-user to use a single sign-on (SSO) for multiple services?
Why option A is correctThe Open ID Federation defines protocols (e.g., OpenID Connect) that enable a single identity provider to authenticate a user once, allowing that user to access multiple services without re-entering credentials – the essence of SSO. It provides the necessary federation-level specifications, trust frameworks, and token exchange mechanisms that let disparate applications interoperate under a common authentication flow.Why the other options are not suitableB – PCI Data Security Standards Council : Focuses on securing cardholder data and does not define authentication or federation mechanisms for SSO across services. C – International Organization for Standardization : ISO is a standards-setting body; while it publishes standards related to security and privacy, it does not itself supply an SSO protocol or federation model. D – Personal Information Protection and Electronic Documents Act : This is Canadian privacy legislation; it governs data handling but contains no technical specification for SSO implementation.Key takeaway – Only the Open ID Federation explicitly provides a technical framework for single sign-on across multiple services, making it the correct choice.
OpenID Connect Core 1.0 Specification: https://openid.net/specifications/openid-connect-core-1_0.html OpenID Federation Overview (OpenID Foundation): https://openid.net/federation/These documents detail the protocols and trust models that enable SSO in federated identity environments.
Share your comments for IAPP CIPT exam with other users:
data quality oecd