Objective 3.1 Identify and Mitigate Privacy Risks CERTIFIED-ETHICAL-EMERGING-TECHNOLOGIST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A health-tech startup is building a mobile app that collects users' heart-rate data via wearable devices. The product team wants to share de-identified datasets with university researchers for a public health study. The legal team has flagged that the dataset includes zip codes, birth dates, and timestamps of each reading. What is the most appropriate first step to reduce the privacy risk before sharing the data?

   • AStore the dataset in a private cloud environment accessible only to the research team.
   • BEncrypt the dataset with AES-256 before transferring it to the researchers.
   • CRemove zip codes, birth dates, and precise timestamps from the dataset before sharing.
   • DObtain written consent from every user whose data is in the dataset.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An online education platform collects student names, email addresses, and course progress data. The platform wants to use this data for research on learning patterns but wants to minimize the privacy risk. Which approach would best allow the platform to use the data for research while reducing the risk of identifying individual students?

   • AAnonymize the dataset by removing direct identifiers and generalizing quasi-identifiers before research use.
   • BEncrypt the dataset and store it in a secure database.
   • CObtain consent from students to use their data for research.
   • DRestrict access to the dataset to only the research team.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software company is developing a new customer relationship management (CRM) system that will store customer names, phone numbers, and purchase history. The development team wants to identify potential privacy threats in the system's design before it goes live. Which approach would best help the team systematically identify these threats?

   • AImplement role-based access controls to limit who can view customer data.
   • BPerform threat modeling to identify potential attack vectors and privacy weaknesses in the system design.
   • CWrite a comprehensive privacy policy for the CRM system.
   • DDeploy a data loss prevention system to monitor data access.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company is launching a new loyalty program that will collect customer purchase history, email addresses, and location data at the point of sale. The privacy team is asked to identify potential privacy risks before the program launches. Which approach would most effectively identify the specific risks associated with how data flows through the new system?

   • AReview the company's existing privacy policy for compliance with relevant regulations.
   • BAsk the marketing team to list all the features they want in the loyalty program.
   • CConduct a data flow analysis that maps how each data element moves from collection to storage to sharing.
   • DDeploy a data loss prevention system to monitor outgoing emails.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital is required to prevent patient health records from being sent outside the organization via email. The IT team needs a tool that monitors outbound communications and blocks emails containing protected health information. Which tool should the IT team deploy?

   • AA privacy impact assessment tool to evaluate the email system's risks.
   • BA data loss prevention system configured with rules to detect and block PHI in outbound emails.
   • CAn encryption tool that encrypts all emails sent from the hospital.
   • DA consent management platform to track patient consent for data sharing.
   Reveal Solution Discussion Select an answer first