Identify Privacy Requirements CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A government agency is developing a public health surveillance system. The system will collect health data from citizens to track disease outbreaks. The agency must balance the need for detailed data with privacy concerns. The legal team requires that data be retained only as long as necessary for public health purposes. Which approach best meets these requirements?

   • ACollect de-identified health data with a unique code that can be re-identified only by authorized public health officials, and retain it for a defined period based on the outbreak response plan.
   • BCollect detailed health data, including names and addresses, and retain it for 10 years for future analysis.
   • CCollect health data with full identifiers, but delete it immediately after the outbreak ends.
   • DCollect only aggregated health data without any personal identifiers, and retain it for the duration of the outbreak.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational e-commerce platform is expanding to a new country with strict data protection laws. The platform currently stores all customer data in a single data center in the US. The new country requires that personal data of its citizens be stored locally. The platform also wants to provide a consistent user experience, including personalized recommendations. Which approach best satisfies both legal and business requirements?

   • AKeep all data in the US, but allow new country citizens to access the platform with a VPN.
   • BAnonymize all data before storing it in the new country, so that local laws do not apply.
   • CStore all data in the new country's data center to comply with local laws, and accept slower performance for US users.
   • DStore new country citizens' data in a local data center, and implement data transfer mechanisms to allow limited access for global analytics.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A research organization is developing a platform to share patient health records with external researchers. The legal team requires that the data be 'fully anonymous' so that re-identification is not reasonably possible. Which technique should the software requirements specify?

   • AReplace patient names with unique pseudonyms and keep the mapping table in a secure database.
   • BRemove direct identifiers like names and social security numbers, but retain zip codes and birth dates.
   • CApply k-anonymity to ensure each record is indistinguishable from at least k-1 other records, and suppress outliers.
   • DEncrypt all data fields with a strong algorithm and store the decryption key on the same server.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When transferring personal data from one country to another, what must be considered to ensure lawful processing?

   • AThe data's file format
   • BThe data's storage capacity
   • CThe jurisdiction's data protection laws and transfer mechanisms
   • DThe data's encryption key length
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a software requirements document, which requirement reflects honoring a user's preference regarding marketing communications?

   • AThe system must encrypt all user data at rest
   • BThe system must use multi-factor authentication
   • CThe system must provide an opt-out mechanism for promotional emails
   • DThe system must log all access attempts
   Reveal Solution Discussion Select an answer first