025.3 Privacy Protection (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user wants to minimize the amount of personal data shared with online services. Which behavior is most consistent with the privacy best practice of data minimization?

   • AUse the same strong password for all accounts to reduce password fatigue.
   • BAccept all cookie consent banners to speed up browsing.
   • CProvide accurate personal details to all services to avoid account issues.
   • DUse a separate email address for each online service.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which principle states that personal data should only be used for the specific reason it was originally collected?

   • AData minimization
   • BData accuracy
   • CConsent
   • DPurpose limitation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company's customer database was breached, and attackers exfiltrated records containing names, email addresses, and hashed passwords. The company's security team is assessing the risk. Which factor most significantly increases the privacy risk to the affected individuals?

   • AThe database was hosted on a cloud provider with encryption at rest.
   • BThe hashed passwords were salted with a unique value per user.
   • CThe company has a public privacy policy explaining data usage.
   • DThe email addresses can be used for targeted phishing attacks.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A global company processes personal data of users in both the EU and California. The company's privacy team must comply with both GDPR and CCPA. Which requirement is unique to the GDPR and not directly required by the CCPA?

   • ADeleting user data upon request.
   • BConducting a Data Protection Impact Assessment (DPIA) for high-risk processing.
   • CProviding users with the right to access their personal data.
   • DAllowing users to opt out of the sale of their personal information.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital wants to publish a dataset of patient visit records for medical research. The dataset includes names, ZIP codes, birth dates, and diagnoses. The researchers need to analyze correlations between demographics and diseases but do not need to contact patients. Which approach best protects patient privacy while still allowing the research?

   • APublish the dataset as-is but require researchers to sign a non-disclosure agreement.
   • BRemove only the names and keep all other fields unchanged.
   • CEncrypt the dataset and share the decryption key with the researchers.
   • DRemove names and replace birth dates with age ranges.
   Reveal Solution Discussion Select an answer first