Identify Privacy Requirements CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which technique would make a dataset fully anonymous, such that individual records cannot be re-identified?

   • AGeneralizing or suppressing data so that individuals cannot be distinguished
   • BEncrypting the data with a strong algorithm
   • CReplacing names with random IDs while keeping a lookup table
   • DRemoving direct identifiers but retaining unique combinations of indirect identifiers
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A multinational company stores European customer data in a data center located in the European Union to comply with local regulations. This practice is an example of which requirement?

   • AData retention
   • BData anonymization
   • CData residency
   • DData minimization
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A user requests that their personal data be deleted from a service. Which legal right does this request invoke?

   • ARight to restrict processing
   • BRight to access
   • CRight to be forgotten
   • DRight to data portability
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A health-tech startup is building a fitness tracking app. The product manager wants to collect users' GPS location, heart rate, sleep patterns, and social media contacts to 'personalize the experience.' The legal team has flagged that only data necessary for the core functionality should be collected. Which approach best aligns with privacy requirements?

   • ACollect only social media contacts, as they are the most valuable for personalization, and skip health data to reduce risk.
   • BCollect all data but anonymize it immediately so it cannot be linked to individuals, thus avoiding privacy obligations.
   • CCollect only GPS location and heart rate, as they are directly needed for tracking workouts, and defer other data until a feature requires it.
   • DCollect all data now, as it may be useful for future features and machine learning models.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During the requirements phase for a new fitness tracking app, the product owner proposes collecting users' GPS location, heart rate, and social security number. Which principle should guide the decision on what data to collect?

   • ACollect only the minimal data elements necessary to achieve the app's stated purpose
   • BCollect data based on what competitors are collecting to stay competitive
   • CCollect as much data as possible to provide personalized features to users
   • DCollect all data that might be useful in the future to avoid re-engineering the app
   Reveal Solution Discussion Select an answer first