Free Certified U.S. Data Privacy Officer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified U.S. Data Privacy Officer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A privacy officer is assessing which retailer is a financial institution under the FTC Safeguards Rule. Each retailer has no financial activity other than the one described. Which retailer qualifies?

   1. A.A retailer that issues its own credit card directly to consumers.Correct answer: A
   2. B.A retailer that accepts credit cards issued by other companies.
   3. C.A retailer that occasionally offers deferred payment plans.
   4. D.A retailer that allows customers to run a purchase tab.

   Explanation: The rule gives as an example "A retailer that extends credit by issuing its own credit card directly to consumers" and explains that this demonstrates significant engagement in extending credit. Section 314.2(h)(4) contrasts acceptance of others' cards, occasional deferred payment plans, and running a tab as activities that alone do not make the retailer a financial institution.

   Reference: Standards for Safeguarding Customer Information: Definitions — 16 CFR § 314.2(h)(2)(i), (h)(4)(i)–(iii)

2. 2A company's privacy leader establishes organization-wide privacy values and determines risk tolerance to guide program priorities. Which NIST Privacy Framework function most directly describes that work?

   1. A.Identify-P.
   2. B.Govern-P.Correct answer: B
   3. C.Control-P.
   4. D.Communicate-P.

   Explanation: NIST says Govern-P focuses on "establishing organizational privacy values and policies" and understanding risk tolerance. Identify-P addresses understanding data processing and risks, Control-P addresses managing data, and Communicate-P addresses understanding and dialogue about processing.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — p. 7, Govern-P function

3. 3An operator considers the enumerated COPPA methods for obtaining verifiable parental consent. Which method is expressly limited to an operator that does not disclose children's personal information?

   1. A.A signed consent form returned by postal mail.
   2. B.A video conference with trained personnel.
   3. C.Email with additional confirmation steps.Correct answer: C
   4. D.A government identification check against databases.

   Explanation: Section 312.5(b)(2)(viii) states that an operator that does not disclose children's personal information "may use an email coupled with additional steps" to verify parental consent. The listed signed-form, video, and government-ID methods do not carry that same nondisclosure condition in their respective provisions.

   Reference: Children's Online Privacy Protection Rule: Parental Consent — 16 CFR § 312.5(b)(2)(i), (iv), (v), (viii)

4. 4While reviewing authentication for a customer-information system, an FTC Safeguards Rule-covered finance company considers factor types. Which pair uses two different authentication factor types under the rule?

   1. A.A password and a personal identification number.
   2. B.A fingerprint and a facial biometric scan.
   3. C.A hardware token and a separate security key.
   4. D.A password and a hardware security token.Correct answer: D

   Explanation: The rule describes "Knowledge factors, such as a password" and "Possession factors, such as a token" as different types. Two knowledge factors, two biometric inherence factors, or two possession factors do not provide two different factor types.

   Reference: Standards for Safeguarding Customer Information: Definitions — 16 CFR § 314.2(k)(1)–(3)

5. 5A U.S. company engaged in a restricted transaction under 28 CFR § 202.401 selects an auditor for its required annual audit. In addition to competence and the stated exclusions for covered persons and countries of concern, what does § 202.1002(b) require of the auditor?

   1. A.Independence from the audited activityCorrect answer: A
   2. B.Employment by the transaction vendor
   3. C.A professional information-systems audit certification
   4. D.A professional public-accountancy license

   Explanation: The rule states that the auditor "Must be independent". It separately requires competence and prohibits a covered person or country of concern from conducting the audit. The provision does not require employment by the vendor, a particular professional certification, or an accountancy license.

   Reference: Audits for Restricted Transactions — 28 CFR § 202.1002(b)(2)

6. 6A HIPAA business associate discovers a breach of unsecured protected health information. Under the federal breach notification rule, which party must the business associate notify of the breach?

   1. A.The affected covered entityCorrect answer: A
   2. B.The Federal Trade Commission
   3. C.Each affected health plan member
   4. D.The Centers for Medicare and Medicaid Services

   Explanation: The rule states: "A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach." The covered entity has its own separate notification duties.

   Reference: HIPAA Breach Notification: Notification by a Business Associate — 45 CFR § 164.410(a)(1)

7. 7A financial institution covered by the FTC Safeguards Rule asks its privacy officer to identify its consumers. Which individual qualifies based solely on the relationship described?

   1. A.A person who names the institution as trustee of a trust.
   2. B.A person who applies for a household loan from the institution.Correct answer: B
   3. C.A beneficiary of a trust for which the institution is trustee.
   4. D.A beneficiary of an employee plan for which the institution is fiduciary.

   Explanation: The rule states that "An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended." Designating a trustee, being a trust beneficiary, or being a benefit-plan beneficiary alone does not establish consumer status under the accompanying examples.

   Reference: Standards for Safeguarding Customer Information: Definitions — 16 CFR § 314.2(b)(2)(i), (vi)–(viii)

8. 8A privacy team compares its NIST Current Profile with its Target Profile to find gaps in attaining desired outcomes. Which outcome has that type of gap?

   1. A.An outcome currently achieved and included in the target.
   2. B.An outcome currently achieved but omitted from the target.
   3. C.An outcome not currently achieved and omitted from the target.
   4. D.An outcome not currently achieved but included in the target.Correct answer: D

   Explanation: NIST explains that "The differences between the two Profiles enable an organization to identify gaps" and develop an improvement plan. An outcome sought in the target but not yet achieved is a gap in attaining the target.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — p. 8, Profiles

9. 9A covered clinic has psychotherapy notes but no patient's authorization. Assuming no other specific exception applies, which use is permitted under 45 CFR § 164.508(a)(2)?

   1. A.The notes' originator uses them for treatment.Correct answer: A
   2. B.Another clinician uses the notes for treatment.
   3. C.The clinic uses the notes for payment processing.
   4. D.The clinic discloses the notes for a health plan's operations.

   Explanation: The psychotherapy-notes exception permits "Use by the originator of the psychotherapy notes for treatment" without the otherwise required authorization. The ordinary treatment, payment, and operations categories do not generally remove the special authorization rule for the other described uses.

   Reference: HIPAA Privacy Rule: Uses and Disclosures for Which an Authorization Is Required — 45 CFR § 164.508(a)(2)(i)(A)

10. 10A privacy officer asks administrators to grant employees only the system accesses needed to perform their assigned work. Which security principle does this apply?

    1. A.Separation of duties.
    2. B.Least functionality.
    3. C.Least privilege.Correct answer: C
    4. D.Defense in depth.

    Explanation: NIST describes least privilege as "allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks". The other principles address different aspects of control design.

    Reference: Security and Privacy Controls for Information Systems and Organizations — NIST SP 800-53 Rev. 5, AC-6