Identify Privacy Requirements CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A mobile banking app is being designed. The product owner wants to collect the user's device location to offer branch finder features. The security team is concerned about privacy. Which data collection requirement is most appropriate?

   • ACollect location only when the user actively uses the branch finder feature, and allow the user to grant or revoke permission.
   • BCollect location data but immediately share it with third-party advertisers to monetize the app.
   • CCollect precise GPS location continuously in the background to personalize offers.
   • DCollect location once during registration and store it for the lifetime of the account.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A social media platform is updating its privacy requirements. The product team wants to retain user posts indefinitely to train recommendation algorithms. However, the legal team notes that users must be able to request deletion of their data. Which requirement should be included?

   • ARetain all data indefinitely, but anonymize it after the user requests deletion.
   • BRequire users to contact customer support and provide a reason for deletion.
   • CProvide a mechanism for users to delete their account and all associated data, with a defined retention period for backups.
   • DAllow users to request deletion, but only for posts older than 5 years.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A data analytics company is building a platform that processes user browsing data to generate insights. The company wants to minimize privacy risks while retaining the ability to analyze individual user behavior over time. Which approach best balances these goals?

   • AUse fully anonymous data by removing all identifiers, but this prevents tracking individual behavior over time.
   • BUse aggregated data only, such as daily averages, to protect privacy.
   • CUse raw data with no anonymization, but rely on legal agreements to protect privacy.
   • DUse pseudonymous data with a persistent identifier, and implement strict access controls to protect the mapping.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An online retailer wants to share customer purchase history with a marketing analytics firm. The privacy policy states that customers can opt out of data sharing. Which requirement should be implemented?

   • AShare data only for customers who have explicitly opted in to data sharing.
   • BDo not share any data with third parties, regardless of user preferences.
   • CShare data with the marketing firm, but remove customer names and email addresses.
   • DShare data with the marketing firm by default, and allow customers to opt out via a link in the privacy policy.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A health app stores user records with a unique identifier that can be linked back to the individual's name through a separate key. This practice is an example of which type of data handling?

   • AFully anonymous data
   • BAggregated data
   • CEncrypted data
   • DPseudo-anonymous data
   Reveal Solution Discussion Select an answer first