Question 1

If an organization asks you to disclose your social security number,but fails to establish a set of procedures and policies for protecting your privacy,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The principle of Management in the Generally Accepted Privacy Principles emphasizes the need for an organization to establish, implement, and maintain a comprehensive privacy program that includes policies and procedures to protect personal information, which would include the handling of social security numbers.

Question 2

Abbie Johnson is a programmer at Healtheast network.Abbie has recently developed a new computer program for Healtheast.As part of the testing process,Abbie needs to use realistic patients data to ensure that the system is working properly.To protect privacy,management at Healtheast uses a program that replaces private patient information with fake values before sending the data to Abbie for testing.The program that replaces patient information with fake values is called

Accepted Answer

Data masking is the process of replacing sensitive information with data that looks like real data but is not. This is done to protect the privacy of the patients while still allowing the programmers to test the system with realistic data. Data encryption refers to the process of converting data into an unreadable format for secure transmission. Data wiping and data redacting are different techniques used to delete or obscure data, respectively, but they are not applicable in this scenario.

Question 3

It is impossible to encrypt information transmitted over the Internet.

Accepted Answer

This statement is false. Encryption is a commonly used method to ensure that information transmitted over the Internet is secure and cannot be intercepted or read by unauthorized individuals. Many encryption protocols, such as SSL and TLS, are used to secure online transactions, communication, and data storage. While no encryption method is completely foolproof or 100% secure, encrypting information significantly reduces the risk of it being intercepted or compromised.

Question 4

Cindy Vindoolo logged on to her e-mail account to find that she had received 50 e-mails from a company called LifeCo that promised her extreme weight loss if she bought their diet pills.Cindy angrily deleted all 50 e-mails,realizing she was a victim of

Accepted Answer

Spam refers to unsolicited or unwanted emails sent in bulk to a large number of recipients. In this scenario, the 50 e-mails received by Cindy were unsolicited and from a company she did not sign up to receive emails from. Hence, it qualifies as spam. Telemarketing refers to unsolicited phone calls, direct mail refers to physical mail sent directly to the recipient's address, and MLM (multi-level marketing) refers to a business model where participants earn commissions not only for their own sales but also for the sales of the people they recruit. None of these terms apply to Cindy's situation.

Question 5

CAN-SPAM provides both criminal and civil penalties for violations of the law.

Accepted Answer

CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act provides both criminal and civil penalties for violations of the law. Criminal penalties include fines and imprisonment while civil penalties include fines and court orders to cease violating the law.

Question 6

Data masking is also referred to as

Accepted Answer

Data masking is a technique used to protect sensitive information by replacing it with non-sensitive data or meaningless characters. Tokenization is a type of data masking that replaces sensitive information with a unique identifier or token. Encryption is a method of converting sensitive data into a code to protect it from unauthorized access. Captcha and cookies are not related to data masking.

Question 7

Under CAN-SPAM legislation,an organization that receives an opt-out request from an individual has ________ days to implement steps to ensure they do not send out any additional unsolicited e-mail to the individual again.

Accepted Answer

Under the CAN-SPAM Act, organizations are required to honor opt-out requests within 10 business days.

Question 8

Identify the item below that is not a step you could take to prevent yourself from becoming a victim of identity theft.

Accepted Answer

Refusing to disclose your social security number to anyone or any organization is not practical or feasible, as there are legitimate reasons and entities (such as employers, tax authorities, and financial institutions) that require your social security number for identification and reporting purposes. The other options are practical steps to protect your personal information.

Question 9

If an organization asks you to disclose your social security number,but decides to use it for a different purpose than the one stated in the organization's privacy policies,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

This is a violation of the Collection principle, which states that an organization must specify the purposes for which personal information is collected at or before the time of collection. Using the social security number for a different purpose than stated in the privacy policy is a breach of this principle.

Question 10

All of the following are associated with asymmetric encryption except

Accepted Answer

Asymmetric encryption, unlike symmetric encryption, is not known for speed. It involves complex mathematical computations which make it slower compared to symmetric encryption. The use of private and public keys is a fundamental aspect of asymmetric encryption, and it inherently requires key exchange (public keys are exchanged).

Question 11

Discuss to the key CAN-SPAM's guidelines on commercial e-mail that has the primary purpose of advertising.

Accepted Answer

The answer of Discuss to the key CAN-SPAM's guidelines on...

Question 12

If an organization asks you to disclose your date of birth and your address,but fails to establish any procedures for responding to customer complaints,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The principle of Monitoring and enforcement requires organizations to establish procedures for ensuring compliance with privacy policies and addressing complaints or inquiries from individuals regarding their personal information. Therefore, if the organization fails to establish any procedures for responding to customer complaints, it violates this principle. The collection, access, and security principles are not directly related to the establishment of complaint procedures.

Question 13

If an organization asks you to disclose your social security number,but fails to tell you about its privacy policies and practices,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The Generally Accepted Privacy Principle (GAPP) that addresses disclosures of privacy policies and practices is the Notice principle. If the organization fails to inform the individual about its privacy policies and practices before requesting their social security number, it has violated this principle.

Question 14

If an organization asks you to disclose your date of birth and your address,but fails to take any steps to protect your private information,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The Generally Accepted Privacy Principles include seven principles, and one of them is security, which states that organizations should take reasonable steps to protect personal information from unauthorized access, disclosure, and misuse. If the organization fails to take any steps to protect your private information (i.e., your date of birth and address), they have likely violated the security principle. Therefore, the correct answer is C - Security.

Question 15

If an organization asks you to disclose your social security number,yet fails to properly dispose of your private information once it has fulfilled its purpose,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The Generally Accepted Privacy Principle of Use and Retention states that an organization should only use personal information for the stated purpose and dispose of it properly once it has fulfilled its purpose. If the organization fails to dispose of the information properly, it is violating this principle. Therefore, the answer is D.

Question 16

CAN-SPAM applies to both commercial and personal e-mail.

Accepted Answer

CAN-SPAM primarily applies to commercial email messages, specifically targeting those that have the primary purpose of advertising or promoting a commercial product or service. Personal emails are not covered by this act.

Question 17

Identify the item below which is not a piece of legislation passed to protect individuals against identity theft or to secure individuals' privacy.

Accepted Answer

The Dodd-Frank Act is not primarily focused on protecting individuals against identity theft or securing individuals' privacy. It is a comprehensive financial reform law that addresses a wide range of issues related to financial institutions and market regulations. The other three options, HIPAA, HITECH, and the Gramm-Leach-Bliley Act, are all directly related to protecting individuals' privacy and personal information.

Question 18

Which of the following is not true regarding virtual private networks (VPN)?

Accepted Answer

It is actually less expensive to reconfigure VPNs to include new sites than to add or remove physical connections in a privately owned network. This is because adding or removing physical connections requires expensive equipment and installation, whereas reconfiguring VPNs can be done more quickly and inexpensively with software updates. Therefore, the statement in option C is not true.

Question 19

If an organization asks you to disclose your social security number,yet fails to permit you to opt-out before you provide the information,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

Choice and consent is one of the Generally Accepted Privacy Principles that require organizations to provide individuals with the opportunity to choose whether their personal information can be collected or disclosed to another entity. Failing to allow opt-out before disclosing social security number violates this principle.

Question 20

If an organization asks you to disclose your date of birth and your address,but refuses to let you review or correct the information you provided,the organization has likely violated which of the Generally Accepted Privacy Principles?

Accepted Answer

The organization has violated the "Access" principle, which requires that individuals have the right to access and correct their personal information. By refusing to let the individual review or correct their information, the organization is not providing adequate access to the information.

Quiz 9: Confidentiality and Privacy Controls