CISSP Asset Security Practice Question
An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collecting location data only when the app is actively in use
Data minimization requires collecting only the data necessary for the specified purpose. Collecting location data only when the app is actively in use reduces unnecessary data collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypting location data both at rest and in transit
Why it's wrong here
While encryption is a fundamental security control that protects data confidentiality and integrity both in transit and at rest, it does not inherently reduce the *volume* or *scope* of data initially collected. Privacy by Design's data minimization principle focuses on limiting data collection to only what is strictly necessary from the outset, a concern encryption does not address.
- ✗
Anonymizing location data after collection
Why it's wrong here
Anonymizing location data is a valuable privacy-enhancing technique that reduces re-identification risk, but it is typically applied *after* the data has already been collected. The principle of data minimization, central to Privacy by Design, mandates that the organization should strive to collect the least amount of personal data possible *at the point of collection*, rather than relying solely on post-collection processing.
- ✗
Obtaining explicit consent from users before collection
Why it's wrong here
Obtaining explicit consent from users is a critical legal and ethical requirement for data collection, ensuring transparency and user autonomy. However, consent primarily grants permission for data processing and does not, by itself, enforce the principle of data minimization. A user might consent to extensive data collection, but Privacy by Design still requires the organization to limit that collection to what is strictly necessary for the stated purpose.
- ✓
Collecting location data only when the app is actively in use
Why this is correct
This approach directly embodies the 'data minimization' principle of Privacy by Design by ensuring that location data is only acquired when it is essential for the application's active functionality. By limiting collection to periods of active use, the organization significantly reduces the overall volume of sensitive personal data held, thereby mitigating potential privacy risks and demonstrating a proactive commitment to user privacy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.