General Data Privacy and Security 2 — Questions and Answers
Question 1: What does the term 'data minimization' mean in the context of privacy?
- Compressing data to save storage space
- Collecting only the data necessary for a specific purpose (Correct answer)
- Deleting all data after 30 days
- Encrypting data before transmission
Correct answer: Collecting only the data necessary for a specific purpose
Data minimization is a privacy principle requiring organizations to collect only the minimum personal data needed to fulfill a stated purpose.
Question 2: Which attack type involves an attacker intercepting communication between two parties without their knowledge?
- SQL injection
- Man-in-the-middle (MITM) attack (Correct answer)
- Denial-of-service attack
- Cross-site scripting
Correct answer: Man-in-the-middle (MITM) attack
A man-in-the-middle attack occurs when an attacker secretly relays and possibly alters communications between two parties who believe they are communicating directly.
Question 3: What is a 'privacy impact assessment' (PIA)?
- A penalty issued for GDPR violations
- A process for identifying and mitigating privacy risks before launching a project (Correct answer)
- A user survey about data preferences
- A type of firewall configuration review
Correct answer: A process for identifying and mitigating privacy risks before launching a project
A Privacy Impact Assessment (PIA) is a process organizations use to identify, evaluate, and mitigate privacy risks associated with new projects or data processing activities.
Question 4: Which of the following best describes 'two-factor authentication' (2FA)?
- Using two different passwords for one account
- Requiring two separate forms of identity verification to access an account (Correct answer)
- Logging in from two devices simultaneously
- Encrypting data with two different keys
Correct answer: Requiring two separate forms of identity verification to access an account
Two-factor authentication requires users to provide two distinct types of credentials—such as a password and a one-time code—to verify their identity.
Question 5: Under the Children's Online Privacy Protection Act (COPPA), what age threshold requires parental consent for data collection?
- Under 16
- Under 13 (Correct answer)
- Under 18
- Under 12
Correct answer: Under 13
COPPA requires websites and online services to obtain verifiable parental consent before collecting personal information from children under 13.
Question 6: What is 'shoulder surfing' in the context of data security?
- Hacking through a shared Wi-Fi network
- Physically observing someone's screen or keyboard to steal information (Correct answer)
- Using someone's digital footprint to track their activity
- Installing spyware on a device covertly
Correct answer: Physically observing someone's screen or keyboard to steal information
Shoulder surfing is a low-tech attack where someone directly observes a person entering sensitive information such as PINs or passwords.
Question 7: What does 'data portability' allow individuals to do?
- Move their physical devices across borders without data loss
- Receive and transfer their personal data to another service provider (Correct answer)
- Access other users' anonymized data
- Store their data on multiple cloud servers simultaneously
Correct answer: Receive and transfer their personal data to another service provider
Data portability gives individuals the right to receive their personal data in a usable format and transfer it to another controller or service.
General Data Privacy and Security 2
What does the term 'data minimization' mean in the context of privacy?