← Back

Chapter 6: Enterprise Security, Data Privacy, and Risk Management

Every problem in the chapter beside the book’s answer, a chapter at a time as you scroll.

Chapter 6: Enterprise Security, Data Privacy, and Risk Management

10 problems · 0 figures

6-1 §6.1 source ↗

What is a description of Privacy by Design?
  1. a.
    a principle advocating for privacy to be intentionally embedded into the design and architecture of IT systems and business practices
  2. b.
    a principle focusing on the technical aspects of implementing data protection controls, such as encryption and anonymization
  3. c.
    a principle focusing only on data storage and management by third-party providers
  4. d.
    a principle that is reactive to data protection and is only considered after a data breach has occurred

Answer

A. a principle advocating for privacy to be intentionally embedded into the design and architecture of IT systems and business practices

6-3 §6.1 source ↗

The International Organization for Standardization’s (ISO) 27701 standard is an extension of ISO 27001. What does ISO 27701 provide guidance on?
  1. a.
    how to manage privacy information
  2. b.
    how to manage third-party relationships in data storage
  3. c.
    how to create new data privacy laws
  4. d.
    how to design privacy into IT systems and business practices

Answer

A. how to manage privacy information

6-5 §6.1 source ↗

What is the term for the practice of incorporating privacy controls into the design and development of IT, systems, networks, and business practices?
  1. a.
    Privacy by Design
  2. b.
    privacy engineering
  3. c.
    security engineering
  4. d.
    privacy network

Answer

B. privacy engineering

6-7 §6.2 source ↗

Which attack can turn unsecured IoT devices into bots to carry out massive, distributed denial-of-service (DDoS) attacks?
  1. a.
    Mirai botnet attack
  2. b.
    SQL injection
  3. c.
    CSRF attack
  4. d.
    dictionary attack

Answer

A. Mirai botnet attack

6-9 §6.2 source ↗

When developing web and IoT technologies, enterprises and IT professionals have the social responsibility to ________.
  1. a.
    maximize profit
  2. b.
    ensure user engagement
  3. c.
    safeguard user information and privacy
  4. d.
    minimize development costs

Answer

C. safeguard user information and privacy

6-11 §6.2 source ↗

Which organization has been heavily involved in developing standards specifically for IoT?
  1. a.
    W3C
  2. b.
    IEEE
  3. c.
    ITU
  4. d.
    NIST

Answer

B. IEEE

6-13 §6.3 source ↗

Which type of organization would most likely require that its data centers be ISO/IEC 27001 certified?
  1. a.
    local shops
  2. b.
    Fortune 500 companies
  3. c.
    small online businesses
  4. d.
    individual clients

Answer

B. Fortune 500 companies

6-15 §6.4 source ↗

In terms of compliance with global frameworks such as GDPR, what principle emphasizes collecting only the data strictly necessary for intended purposes?
  1. a.
    data maximization
  2. b.
    transparency
  3. c.
    data minimization
  4. d.
    data expansion

Answer

C. data minimization

6-17 §6.4 source ↗

In complying with global frameworks such as GDPR, what does the term transparency primarily refer to?
  1. a.
    the organization’s revenue
  2. b.
    clarity in how user data are used and managed
  3. c.
    the physical layout of an office
  4. d.
    government operations

Answer

B. clarity in how user data are used and managed

6-19 §6.4 source ↗

The scope of a gap analysis for data security and privacy usually includes evaluating ________.
  1. a.
    employee behavior and data sharing controls
  2. b.
    third-party data access and customer behavior
  3. c.
    evaluating areas such as user consent management, data sharing controls, and third-party data access
  4. d.
    consent management only

Answer

C. evaluating areas such as user consent management, data sharing controls, and third-party data access

Loading chapter 7…

Problems and answers are adapted from Foundations of Information Systems by Mahesh S. Raisinghani, OpenStax, and are used under the CC BY-NC-SA 4.0 licence. Access for free at https://openstax.org/books/foundations-information-systems/pages/1-introduction. Illustrations: Copyright Rice University, OpenStax, under CC BY-NC-SA 4.0 license. This adaptation is released under the same licence, is non-commercial, and is neither affiliated with nor endorsed by OpenStax or Rice University.