Objective 5.2 Implement Countermeasures Used to Ensure Data Privacy. CERTIFIED-IOT-SECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of a courtesy notification?

   • AProviding a privacy notice at the time of data collection
   • BNotifying users of a data breach within 72 hours as required by GDPR
   • CReporting a breach to the data protection authority
   • DSending users an email about an upcoming change to the privacy policy
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of implementing data user authorization mechanisms in an IoT system?

   • ATo ensure that only permitted individuals or systems can access personal data
   • BTo notify users about data breaches
   • CTo reduce the amount of data collected from sensors
   • DTo encrypt all data stored in the cloud
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An IoT vendor updates its privacy policy to clarify how it uses data from smart speakers. The vendor is not legally required to notify users of this change, but wants to maintain transparency and trust. What should the vendor do?

   • AOnly inform users who actively contact customer support.
   • BSend a courtesy notification to all users explaining the updated privacy policy.
   • CDo nothing because the change is not legally required to be communicated.
   • DWait until the next mandatory breach notification to inform users.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A financial IoT system collects transaction data from ATMs. The system must comply with PCI DSS and local privacy laws. The company wants to retain transaction data for fraud analysis for 3 years, but privacy regulations require that personal data not be kept longer than necessary. What is the best approach?

   • ADelete the data immediately after each transaction to minimize privacy risk.
   • BRetain the data for 3 years with strong encryption and access controls, then securely delete it.
   • CAnonymize the data after 1 year and retain it indefinitely.
   • DRetain the data indefinitely to support future fraud investigations.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which security control is specifically used to protect sensitive data at rest by replacing original values with fictional but realistic placeholders?

   • AEncryption
   • BData retention policy
   • CData masking
   • DAccess control
   Reveal Solution Discussion Select an answer first