Being able to tell that two records relate to the same person is a ___ threat.
Linkability lets an adversary correlate data items to the same individual even without knowing who they are, eroding privacy.
3 / 10
Being able to single out and name the individual behind data is an ___ threat.
Identifiability means the data can be tied to a specific real person, which is the core harm many privacy controls aim to prevent.
4 / 10
Combining 'anonymised' datasets to unmask individuals is called ___.
Re-identification attacks correlate quasi-identifiers across datasets to recover identities, so true anonymisation is harder than it looks.
5 / 10
Mitigating privacy threats by collecting only what you need applies the principle of data ___.
Data minimisation reduces the attack surface: data you never collect can't be linked, identified, or leaked.
6 / 10
During a code review of the new user onboarding flow for 'Streamline' social media platform, Alice comments to Ben: 'I'm seeing a potential issue here – we're logging every interaction with our user.profile object, including things like abandoned searches and time spent on specific pages. This could be used to infer sensitive information about users' interests, even if we don't explicitly ask for it.' Which of the following best describes Alice's concern?
Alice is highlighting the risk of re-identification. While Data Minimization and Privacy by Design are important principles, her specific concern relates to how seemingly innocuous logged events can be combined to reveal a user's profile. Differential Privacy, while relevant to privacy techniques, isn't directly what she's identifying in this scenario – it addresses the broader problem of data leakage during analysis.
7 / 10
You're reviewing a pull request for a new feature that allows users to upload profile pictures. The PR description states: 'We've implemented image resizing and compression to reduce storage costs.' Which of the following represents a potential privacy threat associated with this description?
The PR description focuses solely on technical optimizations. While not explicitly stated, resized images often retain metadata like the original camera model or location data. This metadata can be used for re-identification. Access controls and logging are separate concerns that don't directly stem from image resizing itself.
8 / 10
During a standup meeting, David mentions, 'We're using the 'Phoenix' data lake to store all user activity logs. We've applied pseudonymization to the IDs, but we're still collecting every single click and page view.' What is the primary concern David raises regarding this approach?
David highlights a critical flaw: pseudonymization alone isn't sufficient for privacy. Simply replacing identifiers with pseudonyms doesn't inherently protect user identity if the underlying data still contains enough information to link back to individuals. GDPR and other regulations require more robust anonymization techniques.
9 / 10
Sarah is investigating a potential privacy violation related to a marketing campaign. The company combined data from various sources – including website analytics, CRM records, and social media activity – to create detailed user profiles. What term best describes this process?
The scenario describes de-identification. While data aggregation is a related process, it doesn't imply the removal of identifying information. Stitching refers to the technical act of joining datasets – de-identification is the broader concept of transforming data to reduce privacy risks.
10 / 10
During a discussion about designing a new recommendation engine, Maria suggests: 'We should only collect user preferences for the items they actively interact with – things like purchases and ratings. We shouldn't track browsing history or demographic information unless it's explicitly provided.' What principle is Maria advocating?
Maria's suggestion directly embodies the principle of Data Minimization. Collecting only relevant data reduces the potential harm if that data is compromised or misused. While Privacy Impact Assessments are a valuable process, this question focuses on the immediate data collection strategy.
What will I practice in "Privacy Threat Modeling Vocabulary"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.