It is MOST important to consider privacy by design principles during which phase of the software development life cycle (SDLC)?
Correct Answer: B
Requirements definition is a phase of the software development life cycle (SDLC) that involves gathering, analyzing and documenting the functional and non-functional requirements of the software system or application, such as features, performance, security and usability. It is most important to consider privacy by design principles during this phase, as it would help to ensure that privacy is embedded and integrated into the software system or application from the outset, rather than as an afterthought or an add-on. Considering privacy by design principles during requirements definition would also help to avoid costly rework or delays later in the SDLC, as well as to enhance customer trust and satisfaction, and comply with privacy laws and regulations. The other options are not as important as requirements definition in considering privacy by design principles. Application design is a phase of the SDLC that involves creating and specifying the architecture, components, interfaces and data models of the software system or application, based on the requirements defined in the previous phase. Implementation is a phase of the SDLC that involves coding, testing and debugging the software system or application, based on the design specifications created in the previous phase. Testing is a phase of the SDLC that involves verifying and validating that the software system or application meets the requirements and expectations of the users and stakeholders, as well as identifying and fixing any defects or errors1, p. 88-89 Reference: 1: CDPSE Review Manual (Digital Version)
Question 27
Which of the following system architectures BEST supports anonymity for data transmission?
Correct Answer: D
Explanation A peer-to-peer (P2P) system architecture is a network model where each node (peer) can act as both a client and a server, and communicate directly with other peers without relying on a centralized authority or intermediary. A P2P system architecture best supports anonymity for data transmission, by providing the following advantages: * It can hide the identity and location of the peers, by using encryption, pseudonyms, proxies, or onion routing techniques, such as Tor1 or I2P2. These techniques can prevent eavesdropping, tracking, or censorship by third parties, such as Internet service providers, governments, or hackers. * It can distribute the data across multiple peers, by using hashing, replication, or fragmentation techniques, such as BitTorrent3 or IPFS4. These techniques can reduce the risk of data loss, corruption, * or tampering by malicious peers, and increase the availability and resilience of the data. * It can enable the peers to control their own data, by using consensus, validation, or incentive mechanisms, such as blockchain5 or smart contracts. These mechanisms can ensure the integrity and authenticity of the data transactions, and enforce the privacy policies and preferences of the data owners.
Question 28
Which cloud deployment model is BEST for an organization whose main objectives are to logically isolate personal data from other tenants and adopt custom privacy controls for the data?
Correct Answer: B
Explanation A private cloud is a cloud deployment model that provides exclusive access and control to a single organization or a specific group of users within the organization. A private cloud is best for an organization whose main objectives are to logically isolate personal data from other tenants and adopt custom privacy controls for the data, as it offers the highest level of security, privacy, and customization among the cloud deployment models. A private cloud allows the organization to implement its own privacy policies, standards, and procedures for the personal data, as well as to configure the cloud infrastructure, services, and applications according to its specific needs and preferences. A private cloud also reduces the risk of data breaches, unauthorized access, or co-mingling of data from other tenants, as the personal data is stored and processed in a dedicated and isolated environment. References: CDPSE Review Manual, 2021, p. 125
Question 29
Which of the following should be of GREATEST concern when an organization wants to store personal data in the cloud?
Correct Answer: A
Explanation The organization's potential legal liabilities related to the data should be of greatest concern when an organization wants to store personal data in the cloud, as it may expose the organization to various compliance risks, such as data breach notification laws, data protection regulations, data sovereignty laws, and contractual obligations. The organization should ensure that the cloud storage provider complies with the applicable legal and regulatory requirements, and that the organization retains control and ownership of the data. The organization should also conduct due diligence and risk assessment of the cloud storage provider before entering into a contract. References: 2 Domain 2, Task 9; 4
Question 30
Using hash values With stored personal data BEST enables an organization to
Correct Answer: B
Explanation Using hash values with stored personal data best enables an organization to detect changes to the data, because hash values are unique and fixed outputs that are generated from the data using a mathematical algorithm. If the data is altered in any way, even by a single bit, the hash value will change dramatically. Therefore, by comparing the current hash value of the data with the original or expected hash value, the organization can verify the integrity and authenticity of the data. If the hash values match, it means that the data has not been tampered with. If the hash values differ, it means that the data has been corrupted or modified. References: * Ensuring Data Integrity with Hash Codes, Microsoft Learn * What is 'hashing,' and does it help avoid the obligations imposed by the new privacy regulations?, Data Privacy Dish
