CCNA Privacy Engineering Questions

Verifying every access request enforces continuous authentication and least-privilege authorisation, so no user or device is implicitly trusted based on network location. This directly satisfies Zero Trust's core tenet, limiting lateral movement and unnecessary data exposure, which strengthens privacy by ensuring only legitimate, validated entities reach personal data.

Federated Learning trains a shared model across distributed devices or silos, exchanging model updates rather than raw records. The PII never leaves its source location, directly satisfying the constraint of analysing distributed datasets without centralising raw personal data.

Privacy techniques such as noise injection, generalization, and aggregation degrade data quality. Demonstrating the measured utility impact lets the organization confirm the PET still supports the intended analysis. Approving a PET without quantifying this trade-off risks delivering a privacy-safe dataset that is analytically useless, which fails the project's business objective and undermines adoption of the PET framework.

BYOK lets the organisation generate, rotate, disable and destroy its own key material, so the cloud provider never holds sole custody. This lifecycle control is the privacy benefit: revoking the key renders the encrypted data inaccessible.

Recording the timestamp, notice version, and specific purposes creates an auditable trail that proves what the user agreed to and when. This is essential for demonstrating compliance and for enforcing consent accurately across microservices. Without this granularity, the organization cannot reliably honor withdrawal or prove lawful basis, making this a necessary action for enforceable consent.

OIDC scopes define which claims the client requests, so limiting requested scopes restricts the personal data released to the relying party. This directly enforces data minimisation, satisfying the privacy constraint of narrowing claim exposure at the identity provider.

Masking replaces sensitive log field values with obfuscated substitutes, so cleartext personal data is no longer exposed in stored logs. This is the most direct first technical step to minimise exposure while preserving log utility.

Encryption at rest renders stored log data unreadable without the decryption key, so any PII written to disk or archived storage remains protected even if the underlying medium is exposed. This directly satisfies the stem's requirement to safeguard PII within logs.

A privacy impact assessment must determine whether processing threatens individuals' rights and freedoms, including discrimination, loss of control or re-identification. Evaluating those risks against the new tool's data flows is a core PIA action, distinct from purely technical or contractual checks.

ABAC evaluates attributes such as department, location and data sensitivity at request time, granting access only when policy conditions match. This enforces least privilege dynamically rather than through static role assignments, limiting each identity to the minimum data its context requires.

Biometric server room entry is a physical control because it restricts bodily access to a facility through fingerprint or similar verification. Privacy controls of this type govern physical access to systems and media, unlike logical controls such as encryption or access rules.

Data minimisation directly satisfies the privacy engineering objective of limiting collection and retention to what is necessary for the stated health purpose. By reducing the volume of sensitive data processed, it shrinks breach impact and supports storage limitation, making it a core design objective for health systems.

Pseudonymization replaces direct identifiers with artificial identifiers, and the mapping table allows re-identification. This aligns with the scenario where names and emails are replaced by random IDs and the mapping is kept separately. It reduces privacy risk while preserving data utility for model development, and is explicitly recognized as a privacy-enhancing technique under regulations such as the GDPR.

On-device inference runs models locally, so raw sensitive inputs never leave the device, eliminating transfer to central servers. This directly satisfies the stem's privacy advantage by removing the transmission pathway that creates interception, residency and third-party exposure risks.

This approach leverages the vendor's retention feature for initial soft-deletion and adds a controlled purge after the recovery period, ensuring permanent deletion at the required time. It maintains auditability and avoids direct database manipulation, aligning with privacy by design principles for data minimization and storage limitation.

Embedding automated privacy test cases into the continuous integration and continuous delivery pipeline validates data minimization, consent flags, retention timers, and access controls on every build. This shifts privacy verification left, catching regressions before production. It provides repeatable evidence that privacy requirements are enforced in code, which is a core privacy engineering objective for a customer onboarding portal handling sensitive financial and identity data.

Homomorphic encryption performs computations directly on ciphertext, but each operation inflates noise, requiring bootstrapping and far greater processing power than plaintext equivalents. This computational overhead constrains scalable, real-time privacy-preserving analytics, which is the primary limitation a privacy engineer must weigh when assessing feasibility.

Enforcing a minimum result-set threshold stops a partner from pulling a group of one or two records, which is the classic inference path to re-identification. This directly addresses combination attacks because each response is guaranteed to represent a sufficiently large cohort. It is the database-layer control that satisfies the requirement of preventing individual re-identification through repeated querying.

The `server_side_encryption_configuration` block accepts the `sse_algorithm` argument, which must be set to `aws:kms` to enforce SSE-KMS encryption at rest on an S3 bucket. This satisfies the stem's requirement for Terraform-managed encryption using a KMS key rather than the default AES256.

Data discovery scanning tools continuously inventory where personal data resides across repositories, satisfying the operational control requirement by enforcing ongoing visibility rather than a one-off design decision. This recurring scanning activity detects shadow data stores, directly supporting privacy operations.

Purpose tags attached to records allow policy engines to grant access only when the requesting process has a matching purpose. This operationalizes purpose limitation in a centralized analytics environment where data from multiple sources is combined. It prevents analysts or downstream services from using records for purposes other than the one under which they were collected, and it creates an auditable link between data and its permitted use.

A centralized Identity Deletion event bus propagates erasure requests to every microservice, ensuring each independently-held copy of a data subject's records is deleted. This satisfies the distributed constraint, where no single service can reach all personal data stores directly.

FHE performs computation directly on ciphertext, so every operation carries enormous computational overhead compared with plaintext processing. That latency, not storage or key size, is the constraint stakeholders must accept before integrating the library into latency-sensitive financial workloads.

Differential privacy adds calibrated noise to aggregate query results, ensuring that the inclusion or exclusion of any single patient's data does not significantly affect the output. This prevents inference about individuals from aggregate statistics. It is the appropriate technical control when aggregate queries are necessary but individual privacy must be preserved.

Query throttling and auditing limit how many aggregate results an attacker can harvest, directly blocking the repeated-query pattern inference attacks rely on. Auditing also flags suspicious query volumes for investigation, satisfying the platform's need to detect and constrain statistical disclosure.

Non-invertible transformations like fuzzy extractors or biohashing create a protected template that allows matching without storing the original biometric. They are designed to be irreversible, so the original fingerprint cannot be reconstructed. This satisfies the privacy requirement while maintaining biometric functionality.

Preventing inference attacks matters because anonymisation fails if attackers can deduce identities from correlated attributes, even without direct identifiers. This satisfies the irreversibility constraint: k-anonymity, l-diversity or differential privacy must defeat linkage and reconstruction, since residual quasi-identifiers let adversaries re-identify individuals through statistical inference or auxiliary data.

Tokenization replaces PII with non-sensitive surrogate tokens mapped to original values in a secured vault. Foreign keys reference tokens consistently, so joins and referential integrity survive in non-production databases while the actual PII remains inaccessible to developers and testers.