RFC 6973 Quiz

Q1: Why does privacy analysis include legitimate recipients and intermediaries as potential observers?

Multiple Choice

A. They are automatically malicious attackers with privileged network access B. They can collect, process, transfer, or expose privacy-relevant data C. Encryption prevents them from observing any traffic or application data

**Explanation:** RFC 6973 distinguishes observers from traditional attackers and evaluates context. A legitimate role can still create privacy harm through collection, compromise, or secondary use. Endpoints and intermediaries may see data by design and traffic patterns can remain observable.

Q2: An agent uses one stable identifier across unrelated services. Which privacy threat increases?

Multiple Choice

A. Message truncation when an intermediary removes part of the request body B. Service availability when one of the unrelated endpoints becomes unreachable C. Correlation and identification across contexts

**Explanation:** Identifier reuse primarily affects linkability rather than message framing. Stable identifiers do not inherently improve or reduce service uptime. A persistent identifier lets observers connect activities that users may expect to remain separate.

Q3: What does data minimization ask a protocol designer to do?

Multiple Choice

A. Omit or reduce identifying data that is not necessary for the protocol goal B. Retain every available field in case an unknown future purpose later emerges C. Encrypt all collected data and treat purpose and retention limits as unnecessary

**Explanation:** Minimization reduces collection, exposure, retention, and later misuse opportunities. Speculative collection conflicts with minimizing unnecessary data. Encryption does not justify indefinite collection or retention.

Q4: A service logs full prompts and tokens for debugging with no deletion policy. Which risks should be reviewed?

Multiple Choice

A. Only increased network latency and local disk consumption B. Stored-data compromise, retention, disclosure, and secondary use C. No privacy risk because internal logs are not protocol messages

**Explanation:** The main privacy issue is retained sensitive data, not only performance. Logs can outlive the purpose, be breached, or be reused beyond user expectations. Internal recipients and storage systems are still observers and compromise targets.

Q5: Does encrypting an A2A connection eliminate surveillance risk?

Multiple Choice

A. Yes, because encryption hides content, endpoints, timing, and size from every observer B. Yes, if a stable agent identifier is protected inside every encrypted message C. No, traffic patterns and metadata may still enable observation and correlation

**Explanation:** Packet size, timing, endpoints, and protocol patterns can remain observable. A stable identifier can increase correlation rather than remove surveillance. Confidentiality protects content but does not automatically provide undetectability.

Q6: What is secondary use?

Multiple Choice

A. Using collected data for a purpose beyond the one for which it was provided B. Sending the same request again after a timeout while preserving its original purpose C. Moving the same service to a backup server without changing why the data is processed

**Explanation:** Unexpected reuse can harm autonomy even when the original collection was authorized. That is a retry or replay issue rather than the privacy concept of secondary use. Infrastructure redundancy is not secondary use unless data purpose changes.

Q7: What does user participation add to privacy design?

Multiple Choice

A. A guarantee that every user reads and understands each policy before data collection B. Mechanisms for control, consent, recipient choice, and preference expression C. A requirement to expose the same identity and attributes to every protocol intermediary

**Explanation:** Participation requires usable controls and is not achieved by documentation alone. These mechanisms let individuals influence how their data is exposed and used. Participation can instead support limiting information per recipient or intermediary.

Q8: A protocol has privacy-protective and data-rich modes. What should designers examine about the default?

Multiple Choice

A. Whether it maximizes persistent identifiers and retained fields for easier analytics B. Whether it disables recipient choice and preference controls to simplify the UI C. Whether it minimizes amount, identifiability, and persistence and supports participation

**Explanation:** Analytics convenience does not by itself justify less protective defaults. Removing control can worsen user participation and requires explicit trade-off analysis. RFC 6973 asks designers to explain defaults that are less protective.

Q9: An A2A workflow has client, broker, agent, tool, and audit service phases. How should privacy analysis be structured?

Multiple Choice

A. Analyze each phase and then the architecture-wide data flow B. Analyze only the final tool because it performs the action C. Treat every entity as having identical privacy responsibilities

**Explanation:** Separate phase analysis reveals changing observers while the whole-flow view reveals cross-phase correlation. Earlier enablers and intermediaries may observe or retain equally sensitive data. Visibility, purpose, trust, and control differ by role and phase.

Q10: Which privacy review is most consistent with RFC 6973?

Multiple Choice

An A2A gateway stores complete grants, session proofs, tenant IDs, task IDs, and prompts for one year to investigate incidents. The store is encrypted and operator access is authenticated. A later proposal would reuse the same records to rank employee productivity.

A. Approve both uses because encryption and authenticated operator access eliminate correlation, retention, and secondary-use concerns B. Minimize collection and retention for the incident purpose, then assess productivity ranking as a distinct secondary use with its own controls C. Prohibit all security logging because RFC 6973 supplies a universal rule that any retained identifier is a protocol violation

**Explanation:** RFC 6973 Section 5.2.3 defines secondary use as using collected information for a different purpose without the individual's consent. Encryption and authenticated access reduce some disclosure risks, but they do not make later productivity ranking part of the original incident-response purpose or remove correlation risk. Section 6.1 defines data minimization across collection, use, disclosure, and storage. The review should identify which fields incident response needs, reduce identifiability where possible, bound retention and access, and evaluate the later use separately, including appropriate participation and transparency controls. RFC 6973 is Informational guidance and does not set one retention duration or prohibit all logging. It provides a framework for exposing the purpose, observer, identifiability, secondary-use, and mitigation trade-offs that the design must resolve.

Privacy threat modeling and data minimization

References

Q1: Why does privacy analysis include legitimate recipients and intermediaries as potential observers?

Q2: An agent uses one stable identifier across unrelated services. Which privacy threat increases?

Q3: What does data minimization ask a protocol designer to do?

Q4: A service logs full prompts and tokens for debugging with no deletion policy. Which risks should be reviewed?

Q5: Does encrypting an A2A connection eliminate surveillance risk?

Q6: What is secondary use?

Q7: What does user participation add to privacy design?

Q8: A protocol has privacy-protective and data-rich modes. What should designers examine about the default?

Q9: An A2A workflow has client, broker, agent, tool, and audit service phases. How should privacy analysis be structured?

Q10: Which privacy review is most consistent with RFC 6973?