Objective 5.2 Implement Countermeasures Used to Ensure Data Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes the primary goal of data minimization in an IoT system?

   • ATo limit the collection of personal data to only what is necessary for the system's purpose
   • BTo make data anonymous so that individuals cannot be identified
   • CTo ensure data is encrypted both in transit and at rest
   • DTo reduce the cost of data storage by using compression techniques
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A smart building IoT system collects occupancy data from motion sensors to optimize HVAC usage. The system also records employee badge IDs and timestamps to track individual movement patterns. The company operates in a GDPR-regulated region. Which countermeasure should the company implement to align with data minimization while still achieving the HVAC optimization goal?

   • ACollect only aggregated occupancy counts per zone, discarding individual badge IDs and timestamps.
   • BAnonymize badge IDs by hashing them with a secret key.
   • CObtain explicit consent from employees to collect their movement data.
   • DEncrypt the badge ID and timestamp data at rest and in transit.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A retail IoT system collects customer footfall data via Wi-Fi tracking. The company wants to analyze shopping patterns over time, but must comply with CCPA, which requires that personal data not be kept longer than reasonably necessary. What is the best approach?

   • AAnonymize the data immediately after collection and store it indefinitely.
   • BKeep the data indefinitely to allow for long-term trend analysis.
   • CStore the data on a secure server and restrict access to authorized analysts only.
   • DDefine a retention period of 90 days, after which the data is automatically deleted or anonymized.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which mechanism is commonly used to authenticate a data user before granting access to personal data?

   • AMulti-factor authentication (MFA)
   • BEncryption at rest
   • CData masking
   • DData retention policy
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An IoT company processes personal data of users in the European Union. Which regulation directly imposes obligations on the company regarding the handling of this personal data?

   • ACCPA
   • BGDPR
   • CPCI DSS
   • DHIPAA
   Reveal Solution Discussion Select an answer first