Objective 5.2 Implement Countermeasures Used to Ensure Data Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A global IoT company collects location data from its smart vehicle trackers. The company operates in the EU and California. The data is used for fleet management. The company must comply with both GDPR and CCPA. Which approach best balances compliance with both regulations?

   • AStore all data in the EU and do not inform users about data collection.
   • BAnonymize all data immediately and do not provide any user rights.
   • CImplement a global privacy policy that includes data minimization, transparency notices, and user rights mechanisms, and apply the stricter requirements to all users.
   • DCollect as much data as possible to support future analytics, and provide a privacy notice only to EU users.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which method is an example of secure data disposal?

   • AMoving data to an archive folder
   • BOverwriting the storage media with random data
   • CCompressing the data to save space
   • DDeleting files from a hard drive using the standard delete command
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multinational company deploys IoT sensors in its European offices to monitor air quality. The data includes location-based employee presence. The company must comply with GDPR. Which set of actions is most appropriate for the company to take?

   • AObtain verbal consent from employees and delete data after one year.
   • BAnonymize all data before storage and do not inform employees about the monitoring.
   • CConduct a data protection impact assessment (DPIA), provide a privacy notice to employees, and establish a process for breach notification.
   • DEncrypt all data and store it in a data center located in the EU.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the goal of a data disposal policy in an IoT system?

   • ATo restrict access to data to authorized users
   • BTo encrypt data before transmission
   • CTo permanently delete or anonymize data when retention periods expire
   • DTo back up data to a secondary location
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational IoT company suffers a data breach that affects users in the EU and the US. The breach involves personal data. The company must comply with GDPR and various US state laws. What is the most critical action the company must take?

   • ASend a courtesy notification to all users, regardless of jurisdiction.
   • BNotify only the affected users in the EU, as GDPR is stricter.
   • CNotify the relevant supervisory authorities and affected users within the required timeframes for each jurisdiction.
   • DWait for the investigation to complete before notifying anyone.
   Reveal Solution Discussion Select an answer first