Between November 30th and December 2nd, 2013, cybercriminals successfully infected the credit card payment systems and bypassed security controls of a United States-based retailer with malware that exfiltrated 40 million credit card numbers. Six months prior, the retailer had malware detection software installed to prevent against such an attack.
Which of the following would best explain why the retailer's consumer data was still exfiltrated?

• A. The U.S Department of Justice informed the retailer of the security breach on Dec. 12th, but the retailer took three days to confirm the breach and eradicate the malware.
• B. The detection software alerted the retailer's security operations center per protocol, but the information security personnel failed to act upon the alerts.
• C. The IT systems and security measures utilized by the retailer's third-party vendors were in compliance with industry standards, but their credentials were stolen by black hat hackers who then entered the retailer's system.
• D. The retailer's network that transferred personal data and customer payments was separate from the rest of the corporate network, but the malware code was disguised with the name of software that is supposed to protect this information.

Aadhaar is a unique-identity number of 12 digits issued to all Indian residents based on their biometric and demographic data. The data is collected by the Unique Identification Authority of India. The Aadhaar database contains the Aadhaar number, name, date of birth, gender and address of over 1 billion individuals.
Which of the following datasets derived from that data would be considered the most de-identified?

• A. A count of the month of birth and hash of the person's first name.
• B. A count of the years of birth and hash of the person' s gender.
• C. A count of the day of birth and hash of the person's first initial of their first name.
• D. Account of the century of birth and hash of the last 3 digits of the person's Aadhaar number.

Which of the following are the mandatory pieces of information to be included in the documentation of records of processing activities for an organization that processes personal data on behalf of another organization?

• A. Contact details of the processor and Data Protection Offer (DPO).
• B. Copies of the consent forms from each data subject.
• C. Descriptions of the processing activities and relevant data subjects.
• D. Time limits for erasure of different categories of data.

Which of these is considered an ethical dark pattern on privacy?

• A. Using attractive designs to influence an individual.
• B. Giving users more privacy options in relation to their personal information
• C. Rewarding users for providing more personal information
• D. Providing dear and simple privacy notices to users