What is the term for information provided to a social network by a member?
Answer(s): B
Answer ExplanationB – Declared data is the correct term.Declared data refers to personal information that a user actively supplies to a service, such as profile details, employment history, interests, or any other data the user intentionally adds to a social-network profile. This data is “declared” (i.e., explicitly provided) by the member and directly influences how the member is represented and discovered within the platform.Why the other options are less appropriateA: Profile data – While the information appears in a profile, the term “profile data” is not the standard classification used in privacy frameworks; it is a descriptive phrase rather than a formal privacy-taxonomy category. C. Personal choice data – No established privacy model uses this label; it is vague and conflates the concept of choice with the data itself. D. Identifier information – This generally denotes categorical data that can uniquely identify an individual (e.g., name, email, phone number). It does not capture the broader scope of user-provided details like interests, preferences, or affiliations that are voluntarily shared beyond mere identification.
1. IAPP CIPP/E Body of Knowledge – “Personal Data Types” (2024). https://iapp.org/cipp/e-body-of-knowledge/ 2. ISO/IEC 27701:2019 – “Privacy Information Management System – Guidance” (section on “declared data”). https://www.iso.org/standard/74464.html
What tactic does pharming use to achieve its goal?
Answer(s): A
Technical justificationPharming’s objective is to divert victims to fraudulent web sites in order to harvest credentials or personal data. The most direct method for achieving this diversion is to alter the victim’s local name-resolution mechanism, such as editing the Hosts file , so that legitimate domain names resolve to the attacker-controlled IP address. This manipulation occurs on the client side and does not require any external infrastructure. Option A precisely describes this technique—modifying the Hosts file—making it the textbook example of how pharmers accomplish their goal. Option B (encrypting files) characterizes ransomware activity, not pharming. Option C (creating false display advertisements) aligns with click-jacking or ad-injection attacks, which are unrelated to the core pharming mechanism. Option D (generating a malicious instant message) describes tactics used by malware distribution or botnets, again unrelated to pharming.Therefore, the correct answer is A .
CISA – Phishing and Pharming: https://www.cisa.gov/phishing-pharming OWASP – Pharming: https://owasp.org/www-community/Pharming
All of the following can be indications of a ransomware attack EXCEPT?
Technical justification for the correct answer (B) and why the other choices are valid indicatorsA – Inability to access certain files – Ransomware typically encrypts victim data, rendering the affected files unreadable without the attacker's decryption key. This loss of accessibility is a direct symptom of a ransomware infection.C – Unusual CPU activity – The encryption process consumes substantial computing resources. A sudden, unexplained spike in CPU usage on an endpoint can therefore signal that ransomware is actively encrypting files in the background.D – Suspicious network communications to C2 servers – Modern ransomware often communicates with command-and-control (C2) infrastructure to retrieve encryption keys, download additional payloads, or exfiltrate victim data. Detecting anomalous outbound connections to known malicious domains is a strong forensic indicator of ransomware activity.B – Increased amount of spam email in an individual's inbox – While spam can be a nuisance, it is not a technical indicator of ransomware compromise. Spam volume is usually driven by phishing campaigns or compromised mailing lists, unrelated to the encryption-based behavior characteristic of ransomware. Consequently, this option does not constitute a valid indication of a ransomware attack.Why option B is the “EXCEPT” answer The question asks for the statement that is not an indication of ransomware. Only option B describes a phenomenon (spam email influx) that bears no direct technical relationship to ransomware’s encryption or network-based tactics, whereas the other options reflect concrete, observable effects of ransomware execution.
CISA – Ransomware Guidance for Individuals and Families ( https://www.cisa.gov/ransomware ) MITRE ATT&CK – Ransomware technique overview ( https://attack.mitre.org/techniques/T1486/ )
You are a wine collector who uses the web to do research about your hobby. You navigate to a news site and an ad for wine pops up. What kind of advertising is this?
JustificationBehavioral advertising (B) targets users based on their observed actions or interests inferred from browsing history, clicks, or past interactions – e.g., displaying a wine-related ad because the user previously searched for, read about, or purchased wine. The scenario describes a user researching wine online; an ad that appears in that context reflects the site’s analysis of the user’s behavior (interest in wine) rather than purely the page’s content. Contextual advertising (C) would serve an ad directly tied to the content of the page (e.g., a wine-related ad on a wine-review article), not based on the user’s personal browsing pattern. Demographic advertising (D) relies on static user attributes such as age, gender, or location, which are not indicated in the description. Remnant (A) refers to unsold ad inventory sold at a discount after a campaign ends, which is unrelated to the targeting mechanism described.Hence, the correct classification is Behavioral advertising (B) because the ad is selected based on the user’s demonstrated interest in wine through their online activity.
Interactive Advertising Bureau (IAB) – Glossary of Advertising Terms: https://www.iab.com/glossary/ European Digital Advertising Alliance – Behavioural Advertising Guidance: https://www.youronlinechoices.com/europe#!/Note: This explanation is tailored for a CIPS certification review, focusing on terminology precision and conceptual differentiation.
What is the main reason the Do Not Track (DNT) header is not acknowledged by more companies?
Answer(s): C
Why option C is the best answerThe Do Not Track (DNT) header was introduced as a voluntary signal that users can send to indicate they do not wish to be tracked. However, the specification never defined a single, enforceable meaning for the header (e.g., whether it applies to first-party vs. third-party tracking, which data categories are covered, how it should be honored). Because companies could interpret “tracking” differently, they chose not to act on DNT, fearing inconsistent or contradictory obligations.Why the other options are less suitableA: “Most web browsers incorporate the DNT feature.”While many browsers do expose a DNT toggle, adoption is optional and usage rates are low; the existence of the feature does not explain why companies ignore it.B: “The financial penalties for violating DNT guidelines are too high.”Penalties are not a deterrent because there are no legally binding penalties tied to DNT; companies simply do not treat it as a regulatory requirement.D: “It has been difficult to solve the technological challenges surrounding DNT.”Technological implementation (e.g., sending a header) is trivial; the real barrier is the ambiguity of the standard, not technical complexity.Key takeaway The lack of consensus on what a DNT header means is the primary obstacle to broader corporate acknowledgment and compliance.
IAB DNT Specification (Version 1.0) – Defines the header and notes the ambiguity of its semantics. https://www.iab.com/wp-content/uploads/2012/03/DNT-1.0.pdf European Privacy Seal – “Do Not Track: Current State of Play” – Discusses the market response to DNT and the consensus problem. https://www.europeprivacyseal.eu/resources/do-not-track-report.pdf
Why is first-party web tracking very difficult to prevent?
Why option A is the best answerFirst-party tracking data is collected by the site the user is visiting, allowing that site to embed identifiers, cookies, and scripts that drive content personalization, analytics, and ad-delivery. To stop this collection, browsers or extensions would need to block or strip those identifiers automatically— an approach that would break core functionality of many legitimate sites (e.g., login persistence, e-commerce carts, dynamic content rendering). Because of the tight coupling between tracking mechanisms and essential site features, developers cannot reliably separate ad-tracking from functional code without harming user experience, making comprehensive prevention technically infeasible.Why the other options are unsuitableB: Consumer preference for targeted ads describes a market driver but does not explain the technical difficulty of preventing tracking. C. Regulatory interest in web tracking is growing (e.g., GDPR, CCPA); the statement that regulators are unconcerned is inaccurate and does not address the technical root cause.D: Modern browsers have built-in privacy features (e.g., Intelligent Tracking Prevention, Enhanced Tracking Protection) that can block many trackers, showing that lack of browser support is not the primary obstacle; the real barrier remains functional disruption.
IAPP – Certified Information Privacy Technologist (CIPT) Exam Content Outline, https://iapp.org/certify/cipt/ Mozilla – Tracking Protection in Firefox, https://support.mozilla.org/en-US/kb/tracking-protection-firefox-blocks-web-trackingThese resources confirm that first-party tracking is tightly integrated with website functionality, making it especially resistant to blanket blocking without causing breakage.
During a transport layer security (TLS) session, what happens immediately after the web browser creates a random PreMasterSecret?
Explanation of the correct choiceThe TLS handshake (TLS 1.2 or TLS 1.3) is message-driven. After the server has presented its certificate and the client has selected the cipher suite, the client generates a PreMasterSecret (a random value). This value is then encrypted with the server’s public key (the key that was extracted from the server’s certificate). The encrypted PreMasterSecret is sent to the server in the Client Key-Exchange message. Therefore, the step that occurs immediately after the browser creates the random PreMasterSecret is option C: “The web browser encrypts the PremasterSecret with the server's public key.”Why it is correct:In the classic RSA key-exchange method (the most common approach for browsers), the client must protect the PreMasterSecret while it is transmitted. Encryption with the server’s public key ensures only the server can decrypt it. This action follows directly after the PreMasterSecret generation and precedes any decryption or key derivation on the server side.Why the other options are unsuitableOption A – “The server decrypts the PremasterSecret.”Decryption occurs after the encrypted PreMasterSecret arrives at the server, not immediately after the client creates it. The wording implies the decryption is performed at the client side, which is inaccurate.Option B – “The web browser opens a TLS connection to the PremasterSecret.”TLS connections are opened to the server’s network endpoint, not to an abstract value called “PremasterSecret.” The PreMasterSecret is a cryptographic secret, not a network address.Option D – “The server and client use the same algorithm to convert the PremasterSecret into an encryption key.”While both parties eventually derive session keys from the decrypted PreMasterSecret, this conversion (via the PRF to generate the master secret) happens later , after the server has successfully decrypted the PreMasterSecret. It is not the immediate next step.Hence, option C accurately describes the immediate action taken by the browser after generating the random PreMasterSecret.
RFC 5280 – X.509 Public Key Certificate and Certification Path Validation (Section 4.5 describes RSA key-exchange). https://tools.ietf.org/html/rfc5280 RFC 8446 – The Transport Layer Security (TLS) Protocol Version 1.3 (Section 4.2 details the key-exchange messages and the use of the server’s public key). https://tools.ietf.org/html/rfc8446
What is the main benefit of using a private cloud?
Why option C is the best answerA private cloud is a dedicated environment that is owned or operated by a single organization. Its primary advantage in a privacy-focused context is that the organization can enforce strict access controls , ensuring that data and services are accessible only to authorized employees, contractors, and trusted components. This isolation enables compliance with legal and regulatory requirements (e.g., least-privilege, segregation of duties) and reduces the risk of unauthorized exposure that is often associated with multi-tenant or public clouds.Option A describes a backup capability, which is a generic storage feature and not unique to private clouds. Option B characterizes public-cloud outsourcing, the opposite of a private-cloud model. Option D suggests cost reduction, but private clouds typically involve higher capital and operational expenses compared with shared or public clouds; cost savings are not their defining benefit.Thus, restricting data access to internal personnel and contractors is the core benefit that aligns with privacy-centric objectives.
NIST definition of private cloud: https://csrc.nist.gov/publications/detail/sp/800-145/final IAPP Certified Information Privacy Technologist (CIPT) materials on cloud privacy principles: https://iapp.org/certify/cipt/
Share your comments for IAPP CIPT exam with other users:
data quality oecd
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your CIPT, please sign in or create a free account.