Objective 5.2 Implement Countermeasures Used to Ensure Data Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Under GDPR, what must an IoT company provide to end users regarding their personal data?

   • AA promise that their data will be stored indefinitely
   • BA clear and transparent notice about data collection and processing
   • CA guarantee that their data will never be shared with third parties
   • DAn option to opt out of all data collection
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hospital's IoT patient monitoring system experiences a data breach that exposes patient names and medical record numbers. The hospital is subject to HIPAA. What is the most critical action the hospital must take?

   • ANotify affected patients and the Department of Health and Human Services (HHS) within the required timeframe.
   • BNotify the local police department and post a notice on the hospital's website.
   • CSend a courtesy notification to all patients informing them of the breach.
   • DWait to notify anyone until the investigation is complete.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a courtesy notification in the context of IoT data privacy?

   • AA notification that is legally required by regulations such as GDPR
   • BA proactive, non-mandatory notification to inform users about data-related events
   • CA notification that is only sent to regulatory authorities
   • DA notification that replaces the need for a privacy policy
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An IoT platform for smart home devices stores video feeds from indoor cameras. The platform allows homeowners to access their own feeds and allows technicians to access feeds for troubleshooting. Which mechanism should the platform implement to ensure that each user can only access the feeds they are authorized to see?

   • AEncrypt the video feeds with a single key shared among all users.
   • BUse a single shared password for all users to simplify access.
   • CRely on the security of the home Wi-Fi network to restrict access.
   • DImplement attribute-based access control (ABAC) that grants access based on user role and device ownership.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A smart city deploys IoT sensors that collect traffic and pedestrian data. The city must notify citizens about the data collection and their rights. Additionally, the city plans to change the data usage policy and wants to inform citizens proactively. Which approach best meets both the legal and voluntary notification requirements?

   • ASend a courtesy notification about the policy change only, without a privacy notice.
   • BPost a notice on the city's social media page about the data collection.
   • CWait for a data breach to notify citizens about the data collection.
   • DPublish a comprehensive privacy notice on the city's website and send a courtesy notification to citizens about the upcoming policy change.
   Reveal Solution Discussion Select an answer first