I85PREP
⌘ K
CIPT study materials
CIPT study resources

CIPT practice questions

One question at a time. Build your CIPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundational principles in technology

In the CIA triad, which property ensures that data is accessible only to those authorized to view it?

  1. Authenticity
  2. Integrity
  3. Availability
  4. Confidentiality Correct answer.

Explanation

Confidentiality means information is not disclosed to unauthorized parties, while integrity covers accuracy and completeness and availability covers timely access. Authenticity concerns origin, which is a separate property.

Question 2Foundational principles in technology

Which property best distinguishes a cryptographic hash function from encryption?

  1. It always expands the data
  2. It relies on a shared secret key
  3. It is intended to be one-way Correct answer.
  4. It needs a public-private key pair

Explanation

A hash function maps input to a fixed-length digest and is designed to be infeasible to invert, and it uses no key at all. Encryption is reversible by whoever holds the correct key.

Question 3Foundational principles in technology

Encryption primarily protects data by doing which of the following?

  1. Verifying who created the data
  2. Rendering the data unreadable without a key Correct answer.
  3. Deleting the data once it is no longer needed
  4. Recording every access to the data

Explanation

Encryption transforms plaintext into ciphertext using an algorithm and a key, so that only holders of the key can recover the original content.

Question 4Foundational principles in technology

Authentication and authorization differ in that authentication does which of the following?

  1. Logs the actions a user performs
  2. Establishes who a user claims to be Correct answer.
  3. Encrypts a user's stored files
  4. Defines what resources a user may use

Explanation

Authentication verifies identity claims, while authorization decides which actions or resources that identity may use.

Question 5Foundational principles in technology

The principle of data minimization directs an organization to collect which of the following?

  1. Data from every available source
  2. All data that could ever be relevant
  3. Only data needed for the purpose Correct answer.
  4. Data held for the maximum period

Explanation

Data minimization limits collection to what is adequate, relevant and necessary for the specified purpose, reducing downstream risk and compliance burden.

Question 6Foundational principles in technology

A website cookie is best described as which of the following?

  1. A backup copy of a production database
  2. A virus planted by an attacker
  3. A key used to encrypt network traffic
  4. A small file held by the browser Correct answer.

Explanation

A cookie is a small text file that a browser stores and returns to a site, often used to maintain state such as a session or a preference.

Question 7Foundational principles in technology

In which cloud service model does the provider manage the application while the customer mainly manages its own data and user accounts?

  1. Platform as a service
  2. Infrastructure as a service
  3. Software as a service Correct answer.
  4. Function as a service

Explanation

In SaaS the provider operates the application and the underlying platform, and the customer's main responsibilities are its own data, users and configuration.

Question 8Foundational principles in technology

Ransomware is characterized by doing which of the following?

  1. Flooding a network with traffic
  2. Silently logging keystrokes
  3. Displaying unwanted advertisements
  4. Encrypting files for a payment Correct answer.

Explanation

Ransomware encrypts or locks files and demands payment for restoring access, often accompanied by a threat to leak the data.

Question 9Foundational principles in technology

A team must encrypt large volumes of backup data that never leave its own data center. Which approach is most efficient?

  1. Symmetric encryption using a shared key Correct answer.
  2. Hashing each record before storage
  3. Encoding the data with Base64
  4. Asymmetric encryption with public keys

Explanation

Symmetric ciphers use a single shared key and are far faster than asymmetric algorithms, which makes them suitable for bulk data such as backups.

Question 10Foundational principles in technology

Adding a unique random salt to each password before hashing mainly achieves which of the following?

  1. It defeats precomputed rainbow tables Correct answer.
  2. It speeds up login verification
  3. It lets the system recover the password
  4. It removes the need for a password policy

Explanation

A per-record salt makes each stored hash unique, so an attacker cannot reuse a precomputed table of hashes for common passwords.

Question 11Foundational principles in technology

A digital signature created with a sender's private key gives the recipient which assurance?

  1. That the message was delivered on time
  2. That the message is free of malware
  3. That the signer sent it, unaltered Correct answer.
  4. That only the recipient can read the message

Explanation

A signature is produced with the sender's private key and verified with the public key, binding the message to the signer and revealing any alteration.

Question 12Foundational principles in technology

Which protection does HTTPS, implemented with TLS, add to a web session?

  1. It permanently deletes the data afterwards
  2. It encrypts the traffic in transit Correct answer.
  3. It proves the data is accurate and lawful
  4. It hides the data from the server itself

Explanation

TLS encrypts the channel between client and server and authenticates the server through its certificate, but the server can still read the data it receives.

Question 13Foundational principles in technology

Replacing names with stable artificial identifiers, while keeping a separate mapping table, is best described as which of the following?

  1. Irreversible anonymization
  2. Data aggregation
  3. Data minimization
  4. Pseudonymization Correct answer.

Explanation

Pseudonymization swaps direct identifiers for artificial ones while a key or mapping permits re-identification, so the result typically remains personal data.

Question 14Foundational principles in technology

A dataset is released so that each record is indistinguishable from at least four others on the quasi-identifier attributes. Which technique is this?

  1. Differential privacy
  2. Homomorphic encryption
  3. k-anonymity Correct answer.
  4. Tokenization

Explanation

k-anonymity requires that each record be indistinguishable from at least k-1 other records on the quasi-identifiers, so here k equals 5.

Question 15Foundational principles in technology

An organization assigns permissions to job roles rather than to individuals. Which access control model is this?

  1. Role-based access control Correct answer.
  2. Mandatory access control
  3. Discretionary access control
  4. Rule-based access control

Explanation

Role-based access control grants permissions to roles, and users acquire permissions by being assigned to a role.

Question 16Foundational principles in technology

Applying least privilege means granting a user which of the following?

  1. Access to every company system
  2. Full administrator rights
  3. Permanent access once approved
  4. Only access needed for the task Correct answer.

Explanation

Least privilege grants the minimum access needed to complete a task, and only for as long as that task requires.

Question 17Foundational principles in technology

Stacking independent controls so that one failure does not expose data is known as which of the following?

  1. Defense in depth Correct answer.
  2. Separation of duties
  3. Zero-day patching
  4. Single sign-on

Explanation

Defense in depth layers independent controls so that the failure of any single control does not lead directly to a breach.

Question 18Foundational principles in technology

A retention schedule helps an organization primarily by doing which of the following?

  1. Limiting how long data is kept Correct answer.
  2. Backing up data to a second site
  3. Logging access to each record
  4. Encrypting records while stored

Explanation

A retention schedule sets how long each category of records is kept and when it must be destroyed, supporting the storage limitation principle.

Question 19Foundational principles in technology

An employee receives an email that mimics the IT helpdesk and asks them to click a link and re-enter their password. This is an example of which of the following?

  1. A phishing attack Correct answer.
  2. An eavesdropping attack
  3. A SQL injection attack
  4. A denial-of-service attack

Explanation

Phishing impersonates a trusted party to trick a recipient into revealing credentials or clicking a malicious link.

Question 20Foundational principles in technology

A tool that inspects outbound email and blocks messages containing national identification numbers is which of the following?

  1. A data loss prevention tool Correct answer.
  2. A web application firewall
  3. A backup appliance
  4. An intrusion detection system

Explanation

Data loss prevention tools inspect content in motion or at rest and block or quarantine items matching defined sensitive-data patterns.

Question 21Foundational principles in technology

A statistical release adds calibrated random noise so that the presence or absence of any single individual barely changes the output. Which technique is this?

  1. Deterministic encryption
  2. Differential privacy Correct answer.
  3. Pseudonymization
  4. k-anonymity

Explanation

Differential privacy injects calibrated noise so that outputs are statistically similar whether or not any one individual is included in the dataset.

Question 22Foundational principles in technology

A payment processor replaces card numbers with surrogate values kept in a separate vault. Which statement about this approach is accurate?

  1. It shrinks the scope of card-data rules Correct answer.
  2. The surrogate values cannot be reversed by anyone
  3. It makes the data impossible to join with records
  4. It guarantees the vault can never be breached

Explanation

Tokenization replaces sensitive values with surrogates held in a separate vault, and because the surrogates are not the card numbers, fewer systems fall within card-data requirements.

Question 23Foundational principles in technology

Why can deterministic encryption be risky for certain fields?

  1. It cannot be decrypted by the owner
  2. It requires far more storage space
  3. It loses the ability to sort any records
  4. Equal plaintexts give equal ciphertexts Correct answer.

Explanation

With deterministic encryption the same plaintext always yields the same ciphertext, so an observer can spot equal values and infer patterns or frequencies.

Question 24Foundational principles in technology

A protocol lets a user prove they know a password without revealing the password or anything derived from it. This is best described as which of the following?

  1. Public key infrastructure
  2. A zero-knowledge proof Correct answer.
  3. Role-based access control
  4. Symmetric key exchange

Explanation

A zero-knowledge proof lets a prover convince a verifier that a statement is true without disclosing the underlying secret.

Question 25Foundational principles in technology

Traffic routed through several relays, with each relay removing only one layer of encryption, provides which property?

  1. End-to-end confidentiality from the final relay
  2. Protection against malicious exit nodes
  3. Guaranteed integrity of the payload
  4. Sender anonymity toward the destination Correct answer.

Explanation

Layered relays hide the origin of a request from the destination, but the final relay can see the payload unless the application layer encrypts it.

Question 26Foundational principles in technology

When a user signs in, a system first verifies the user's identity with a password and then checks which files that user may open. The second check is best described as:

  1. Account provisioning
  2. Authentication
  3. Authorization Correct answer.
  4. Federated identity

Explanation

Authentication establishes who the user is, while authorization determines what an authenticated identity is permitted to do. The file-access decision is a policy evaluation against the user's entitlements, which is the authorization step.

Question 27Foundational principles in technology

Full-disk encryption on a laptop protects the data primarily while that data is in which state?

  1. Being processed by the CPU
  2. Stored on the disk Correct answer.
  3. Displayed on a screen
  4. Moving across a network

Explanation

Full-disk encryption protects stored data on the medium, so if the device is lost or stolen the contents are unreadable without the key. Once the machine boots and unlocks the volume, the data is decrypted for use and the disk encryption no longer shields it.

Question 28Foundational principles in technology

A privacy-by-design practice that limits the collection of personal data to what is necessary for a stated purpose is known as:

  1. Data retention scheduling
  2. Data integrity controls
  3. Data portability rights
  4. Data minimization Correct answer.

Explanation

Data minimization constrains collection and use to the personal data actually needed for the specified purpose. Retention scheduling, portability, and integrity controls govern other lifecycle concerns rather than the scope of collection.

Question 29Foundational principles in technology

A hardware token that generates a one-time passcode is which type of authentication factor?

  1. A password the user has memorized
  2. A hardware token the user carries Correct answer.
  3. A PIN chosen by the user
  4. A fingerprint read by a biometric scanner

Explanation

Authentication factors fall into categories such as knowledge, possession, and inherence. A physical token is something the user possesses, which is why it is combined with a password to form multi-factor authentication.

Question 30Foundational principles in technology

Which property of a cryptographic hash function means that changing a single character of the input produces an unrelated, very different digest?

  1. Pre-image resistance
  2. Avalanche effect Correct answer.
  3. Key escrow
  4. Collision resistance

Explanation

The avalanche effect describes how a tiny change in input alters roughly half of the output bits, so similar inputs yield unrelated digests. Collision and pre-image resistance address different guarantees about finding matching inputs or reversing the digest.

Question 31Foundational principles in technology

A sender wants to encrypt a message so that only the intended recipient can read it, using asymmetric cryptography. Which key should the sender use?

  1. The recipient's private key
  2. The sender's public key
  3. The sender's private key
  4. The recipient's public key Correct answer.

Explanation

In public-key cryptography the recipient's public key encrypts data that only the matching private key can decrypt. The sender never needs, and should never hold, the recipient's private key.

Question 32Foundational principles in technology

A remote employee needs an encrypted tunnel that carries traffic securely across the public internet to the corporate network. This is typically provided by:

  1. A content delivery network
  2. A virtual LAN
  3. A web application firewall
  4. A virtual private network Correct answer.

Explanation

A VPN encapsulates and encrypts traffic between a remote device and a network gateway so that data crossing untrusted networks cannot be read or altered in transit. The other technologies address local segmentation, HTTP filtering, or content caching rather than remote secure access.

Question 33Foundational principles in technology

An access control system grants or denies access based on the user's department, the project code of the file, the device being used, and the time of day. Which model is this?

  1. Role-based access control
  2. Discretionary access control
  3. Mandatory access control
  4. Attribute-based access control Correct answer.

Explanation

Attribute-based access control evaluates attributes of the subject, the resource, and the environment to reach a decision, so contextual inputs such as device and time of day fit this model. Role-based, mandatory, and discretionary models base decisions on job roles, policy labels, or owner discretion rather than on combined contextual attributes.

Question 34Foundational principles in technology

Before releasing a dataset, an analyst replaces exact ages with ten-year age bands. This de-identification technique is:

  1. Generalization Correct answer.
  2. Suppression
  3. Tokenization
  4. Pseudonymization

Explanation

Generalization reduces the precision of a value by mapping it into a broader category, such as an age band instead of an exact age. Suppression removes values outright, while pseudonymization and tokenization replace identifiers with substitutes.

Question 35Foundational principles in technology

In the data lifecycle, the stage at which personal data is no longer needed and is securely destroyed is called:

  1. Use
  2. Disclosure
  3. Collection
  4. Disposal Correct answer.

Explanation

The disposal stage covers secure destruction or irreversible de-identification of data once its purpose and retention period have ended. Collection, use, and disclosure are earlier stages in which data is gathered, processed, or shared.

Question 36Foundational principles in technology

A company places its public web servers on a separate network segment with tightly limited access to internal systems, so that a compromised web server does not expose the internal LAN. This practice is:

  1. Network segmentation Correct answer.
  2. Load balancing
  3. Network address translation
  4. Port mirroring

Explanation

Segmentation divides a network into zones with controlled paths between them, which limits how far an attacker can move after compromising an exposed host. Translation, load balancing, and mirroring change addressing, distribute traffic, or copy traffic for monitoring, but they do not isolate zones.

Question 37Foundational principles in technology

Malicious software that presents itself as a useful application and depends on the user installing and running it is best classified as:

  1. A worm
  2. A rootkit
  3. A trojan Correct answer.
  4. A logic bomb

Explanation

A trojan disguises itself as legitimate software and relies on user execution to run, which matches the described behavior. Worms spread without user action, rootkits conceal activity, and logic bombs trigger on a condition.

Question 38Foundational principles in technology

Two hospitals want to compute a combined statistic across their patient datasets, with neither hospital revealing its individual records to the other and with no trusted third party involved. The cryptographic technique designed for this is:

  1. Database activity monitoring
  2. Symmetric key wrapping
  3. Multiparty computation Correct answer.
  4. Federated identity assertion

Explanation

Multiparty computation is a protocol family in which parties jointly evaluate a function over their private inputs and learn only the result. Identity federation, key wrapping, and activity monitoring address access, key transport, and logging rather than private joint computation.

Question 39Foundational principles in technology

A cloud analytics service computes statistics directly on encrypted values and returns an encrypted result that only the data owner can decrypt. The capability that makes this possible is:

  1. Transport layer security
  2. Deterministic encryption
  3. Homomorphic encryption Correct answer.
  4. Format-preserving encryption

Explanation

Homomorphic encryption allows arithmetic to be performed on ciphertext so that decrypting the result yields the same answer as computing on the plaintext. The service therefore processes data without ever seeing it in the clear.

Question 40Foundational principles in technology

An attacker takes a de-identified health dataset and matches its records against a public voter registry using birth date, ZIP code, and gender to identify individuals. This attack is known as:

  1. A rainbow table attack
  2. A brute-force attack
  3. A man-in-the-middle attack
  4. A linkage attack Correct answer.

Explanation

A linkage attack re-identifies records by joining a de-identified dataset with another dataset that contains identifiers, using shared quasi-identifiers as the join key. Its lesson is that removing direct identifiers is insufficient when combinations of other fields remain distinctive.

Question 41The tech pro's role in data protection

According to the Privacy by Design framework, which principle calls for privacy protections to be built into a system before any data is collected rather than added after a problem is discovered?

  1. Privacy as the default setting
  2. Respect for user privacy; keep it user-centric
  3. End-to-end security across the full data lifecycle
  4. Proactive not reactive; preventative not remedial Correct answer.

Explanation

The first Privacy by Design principle asks organisations to anticipate and prevent privacy risks before data is collected, rather than remediating after an incident has occurred. The other principles address default configurations, lifecycle protection and user control, but they do not carry the before-the-fact timing requirement.

Question 42The tech pro's role in data protection

A social media platform makes every new profile publicly visible to everyone unless the user actively changes the settings. Which Privacy by Design principle is most directly violated?

  1. Visibility and transparency
  2. Privacy as the default setting Correct answer.
  3. Full functionality - positive-sum, not zero-sum
  4. Proactive not reactive; preventative not remedial

Explanation

Privacy as the default setting requires that, if a user does nothing at all, the most privacy-protective configuration applies. Making profiles public unless changed shifts the burden onto the individual and exposes them by default.

Question 43The tech pro's role in data protection

Which Privacy by Design principle rejects the assumption that privacy must be traded away in order to achieve functionality or security?

  1. End-to-end security across the full data lifecycle
  2. Privacy as the default setting for every new user account
  3. Full functionality - positive-sum, not zero-sum Correct answer.
  4. Privacy embedded into design from the outset of the project

Explanation

Full functionality, also described as positive-sum, rejects the zero-sum view that privacy must be sacrificed for other objectives. It requires designs that accommodate privacy and functionality together, for example by building controls into a feature rather than removing the feature.

Question 44The tech pro's role in data protection

A development team encrypts personal data in the live production database but stores nightly backups and long-term archives of the same data unencrypted. Which principle is most directly undermined?

  1. Respect for user privacy by keeping everything user-centric
  2. Visibility and transparency to users about all data practices
  3. Privacy as the default setting for all new accounts and profiles
  4. End-to-end security across the full lifecycle of the data Correct answer.

Explanation

End-to-end security calls for protection across the whole lifecycle of data, including backups, archives, exports and disposal, not only the live system. Leaving copies of the same data unprotected creates a gap that undermines the principle.

Question 45The tech pro's role in data protection

Under Article 25 of the GDPR, data protection by design and by default requires a controller to:

  1. Obtain a certification from an accredited certification body before any processing of personal data begins
  2. Integrate safeguards into the processing and, by default, process only data necessary for each purpose Correct answer.
  3. Notify the supervisory authority and obtain its approval before launching any new processing system
  4. Appoint a data protection officer in every case where personal data is processed, regardless of the scale or nature of that processing

Explanation

Article 25 requires controllers to implement appropriate technical and organisational measures and to ensure that, by default, only personal data necessary for each specific purpose is processed. It is an obligation about design and defaults, not a pre-approval or registration step.

Question 46The tech pro's role in data protection

Engineers tell a privacy technologist that they cannot implement a legal requirement because it is 'too vague to act on'. What is the most effective first step for the technologist?

  1. Accept the engineering team's position and formally record the requirement as unimplementable within the current architecture
  2. Instruct the engineering team to pause all development until legal rewrites the requirement
  3. Escalate to the supervisory authority and ask it to interpret the legal obligation for the team
  4. Translate the obligation into concrete, testable technical requirements the team can implement and verify Correct answer.

Explanation

A core function of the privacy technologist is to bridge legal and technical language, turning an abstract obligation into concrete requirements that engineers can design, build and test against. Escalating or halting work does not unblock delivery.

Question 47The tech pro's role in data protection

Privacy engineering is best described as:

  1. The practice of drafting privacy policies and public-facing notices on behalf of the organisation
  2. The process of auditing third-party vendors for their security certifications and control environment
  3. The legal analysis of whether a particular processing activity complies with the applicable statutes and regulations
  4. Applying engineering methods and controls so that privacy requirements are met throughout a system's lifecycle Correct answer.

Explanation

Privacy engineering applies engineering methods, tools and controls so that privacy requirements are satisfied from requirements through operation and disposal of a system. It complements legal analysis and policy work rather than replacing them.

Question 48The tech pro's role in data protection

An organisation wants to reduce the cost and effort of fixing privacy defects in its products. Which approach is most effective?

  1. Introduce privacy requirements and reviews early in the lifecycle, before design is finalised Correct answer.
  2. Rely on users and customers to report privacy problems once the product is live in production
  3. Add a privacy review step only after a breach or a complaint has been received about the product
  4. Run a comprehensive privacy audit of the finished product immediately before the go-live date

Explanation

Defects discovered late are far more expensive to fix, so privacy requirements, threat modelling and reviews should begin at the requirements and design stages. This is the 'shift left' approach to privacy.

Question 49The tech pro's role in data protection

Compared with a security risk assessment, a privacy risk assessment is typically more concerned with:

  1. Adverse effects on individuals from the processing of their personal data, such as unexpected exposure Correct answer.
  2. The financial exposure of the organisation from downtime, fines and reputational damage
  3. The confidentiality, integrity and availability of the organisation's information assets and systems
  4. The physical security of data centre facilities and the personnel who staff and maintain them

Explanation

Privacy risk focuses on harms to individuals arising from how personal data is processed, such as loss of autonomy, discrimination, stigma or unwanted exposure. Security risk focuses primarily on harm to the organisation's information assets.

Question 50The tech pro's role in data protection

A product team plans to deploy facial recognition to verify customer identity at store entrances. What should the privacy technologist recommend first?

  1. Publish a clear notice about the new capability on the company website shortly after launch
  2. Proceed, because biometric authentication is inherently more secure than passwords or PINs
  3. Obtain written approval from the chief executive and then launch a small pilot in a few stores
  4. Conduct a privacy impact assessment before development, given the likely high risk to individuals Correct answer.

Explanation

Biometric identification is typically a high-risk activity, so a privacy impact assessment should be carried out before processing begins, while design changes are still cheap. The assessment identifies and mitigates risks to individuals and documents the decision.