Free IAPP CIPM Questions and AnswersIAPP CIPM

Question #1

SCENARIO Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, P

A. Roll out an encryption policycorrect

B. Undertake a tabletop exercise

C. Ensure inventory of IT assets is maintained

D. Host a town hall discussion for all IT employees

View answer

Correct Answer: A

Question #2

In privacy protection, what is a "covered entity"?

A. Personal data collected by a privacy organization

B. An organization subject to the privacy provisions of HIPAcorrect

C. A privacy office or team fully responsible for protecting personal information

D. Hidden gaps in privacy protection that may go unnoticed without expert analysis

View answer

Correct Answer: B

Question #3

SCENARIO Please use the following to answer the next QUESTION: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It

A. The use of personal equipment is a cost-effective measure that leads to no greater security risks than are always present in a modern organization

B. Any computer or other equipment is company property whenever it is used for company business

C. While the company may not own the equipment, it is required to protect the business-related data on any equipment used by its employees

D. The use of personal equipment must be reduced as it leads to inevitable security risks

View answer

Correct Answer: C

Question #4

What United States federal law requires financial institutions to declare their personal data collection practices?

A. The Kennedy-Hatch Disclosure Act of 1997

B. The Gramm-Leach-Bliley Act of 1999

C. SUPCLA, or the federal Superprivacy Act of 2001

D. The Financial Portability and Accountability Act of 2006

View answer

Correct Answer: B

Question #5

What is the main function of the Asia-Pacific Economic Cooperation Privacy Framework?

A. Enabling regional data transfers

B. Protecting data from parties outside the region

C. Establishing legal requirements for privacy protection in the region

D. Marketing privacy protection technologies developed in the region

View answer

Correct Answer: A

Question #6

How are individual program needs and specific organizational goals identified in privacy framework development?

A. By employing metrics to align privacy protection with objectivescorrect

B. Through conversations with the privacy team

C. By employing an industry-standard needs analysis

D. Through creation of the business case

View answer

Correct Answer: A

Question #7

What should a privacy professional keep in mind when selecting which metrics to collect?

A. Metrics should be reported to the public

B. The number of metrics should be limited at first

C. Metrics should reveal strategies for increasing company earnings

D. A variety of metrics should be collected before determining their specific functions

View answer

Correct Answer: B

Question #8

What is the function of the privacy operational life cycle?

A. It establishes initial plans for privacy protection and implementationcorrect

B. It allows the organization to respond to ever-changing privacy demands

C. It ensures that outdated privacy policies are retired on a set schedule

D. It allows privacy policies to mature to a fixed form

View answer

Correct Answer: A

Question #9

All of the following changes will likely trigger a data inventory update EXCEPT?

A. Outsourcing the Customer Relationship Management (CRM) function

B. Acquisition of a new subsidiary

C. Onboarding of a new vendor

D. Passage of a new privacy regulation

View answer

Correct Answer: D

Question #10

SCENARIO Please use the following to answer the next QUESTION: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expa

A. Prove the authenticity of the company's records

B. Arrange for official credentials for staff members

C. Adequately document reasons for inconsistencies

D. Create categories to reflect degrees of data importance

View answer

Correct Answer: C

Question #11

SCENARIO Please use the following to answer the next QUESTION: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current user

A. Requiring the vendor to complete a questionnaire assessing International Organization for Standardization (ISO) 27001 compliance

B. Conducting a physical audit of the vendor's facilities

C. Conducting a penetration test of the vendor's data security structure

D. Examining investigation records of any breaches the vendor has experienced

View answer

Correct Answer: D

Question #12

In which situation would a Privacy Impact Assessment (PIA) be the least likely to be required?

A. If a company created a credit-scoring platform five years ago

B. If a health-care professional or lawyer processed personal data from a patient's file

C. If a social media company created a new product compiling personal data to generate user profiles

D. If an after-school club processed children's data to determine which children might have food allergies

View answer

Correct Answer: D

Question #13

Which of the following best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

A. Employees must sign an ad hoc contractual agreement each time personal data is exported

B. All employees are subject to the rules in their entirety, regardless of where the work is taking place

C. All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established

D. Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement

View answer

Correct Answer: C

Question #14

Read the following steps: ? Perform frequent data back-ups. ? Perform test restorations to verify integrity of backed-up data. ? Maintain backed-up data offline or on separate servers. These steps can help an organization recover from what?

A. Phishing attacks

B. Authorization errors

C. Ransomware attackscorrect

D. Stolen encryption keys

View answer

Correct Answer: C

Question #15

How are individual program needs and specific organizational goals identified in privacy framework development?

A. By employing metrics to align privacy protection with objectives

B. Through conversations with the privacy team

C. By employing an industry-standard needs analysis

D. Through creation of the business case

View answer

Correct Answer: D

Question #16

Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?

A. The DPIA result must be reported to the corresponding supervisory authority

B. The DPIA report must be published to demonstrate the transparency of the data processing

C. The DPIA must include a description of the proposed processing operation and its purpose

D. The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual

View answer

Correct Answer: C

Question #17

SCENARIO Please use the following to answer the next QUESTION: Ben works in the IT department of IgNight, Inc., a company that designs lighting solutions for its clients. Although IgNight's customer base consists primarily of offices in the US, some individuals have been so impressed by the unique aesthetic and energy-saving design of the light fixtures that they have requested IgNight's installations in their homes across the globe. One Sunday morning, while using his work laptop to purchase tickets for an

A. Availability Breach

B. Authenticity Breach

C. Confidentiality Breach

D. Integrity Breach

View answer

Correct Answer: C

Question #18

Why were the nongovernmental privacy organizations, Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC), established?

A. To promote consumer confidence in the Internet industry

B. To improve the user experience during online shopping

C. To protect civil liberties and raise consumer awareness

D. To promote security on the Internet through strong encryption

View answer

Correct Answer: C

Question #19

SCENARIO Please use the following to answer the next question: For 15 years, Albert has worked at Treasure Box C a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motiva

A. Awareness campaigns with confusing information

B. Obsolete data processing systems

C. Outdated security frameworkscorrect

D. Potential in-house threats

View answer

Correct Answer: C

Question #20

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. Customer communication

B. Employee access to electronic storage

C. Employee advisement regarding legal matters

D. Controlled access at the company headquarters

View answer

Correct Answer: D

Question #21

SCENARIO Please use the following to answer the next QUESTION: Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Han

A. Add security cameras at facilities that are now without them

B. Set policies about the purpose and use of the security cameras

C. Reduce the number of security cameras located inside the building

D. Restrict access to surveillance video taken by the security cameras and destroy the recordings after a designated period of time

View answer

Correct Answer: B

Question #22

In privacy protection, what is a “covered entity”?

A. Personal data collected by a privacy organizationcorrect

B. An organization subject to the privacy provisions of HIPAAcorrect

C. A privacy office or team fully responsible for protecting personal information

D. Hidden gaps in privacy protection that may go unnoticed without expert analysis

View answer

Correct Answer: AB

Question #23

Why were the nongovernmental privacy organizations, Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC), established?

A. To promote consumer confidence in the Internet industrycorrect

B. To improve the user experience during online shopping

C. To protect civil liberties and raise consumer awarenesscorrect

D. To promote security on the Internet through strong encryption

View answer

Correct Answer: AC

Question #24

SCENARIO Please use the following to answer the next QUESTION: Martin Brise?o is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Brise?o decided to change the hotel’s on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Intere

A. Information would have been ranked according to importance and stored in separate locations

B. The most sensitive information would have been immediately erased and destroyed

C. The most important information would have been regularly assessed and tested for security

D. Information would have been categorized and assigned a deadline for destructioncorrect

View answer

Correct Answer: D

Question #25

An organization is establishing a mission statement for its privacy program. Which of the following statements would be the best to use?

A. This privacy program encourages cross-organizational collaboration which will stop all data breaches

B. Our organization was founded in 2054 to reduce the chance of a future disaster like the one that occurred ten years ago

C. The goal of the privacy program is to protect the privacy of all individuals who support our organization

D. In the next 20 years, our privacy program should be able to eliminate 80% of our currentbreaches

View answer

Correct Answer: C

Question #26

SCENARIO Please use the following to answer the next QUESTION: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current user

A. Include appropriate language about privacy protection in vendor contracts

B. Perform a privacy audit on any vendor under consideration

C. Require that a person trained in privacy protection be part of all vendor selection teams

D. Do business only with vendors who are members of privacy trade associations

View answer

Correct Answer: A

Question #27

SCENARIO Please use the following to answer the next QUESTION: Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious. Last week, a data processing firm used by the company reported that its system may have been hacked, and customer data such as names, addresses, and birthdays may have been compromised. Although the attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to Question the company's privacy program at today's m

A. The amount of responsibility that a data controller retains

B. The appropriate role of an organization's security department

C. The degree to which training can lessen the number of security incidents

D. The role of Human Resources employees in an organization's privacy program

View answer

Correct Answer: A

Question #28

Which of the following is an example of Privacy by Design (PbD)?

A. A company hires a professional to structure a privacy program that anticipates the increasing demands of new laws

B. The human resources group develops a training program from employees to become certified in privacy policy

C. A labor union insists that the details of employers’ data protection methods be documented in a new contract

D. The information technology group uses privacy considerations to inform the development of new networking software

View answer

Correct Answer: AC

Question #29

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Cost basis

B. Gap analysis

C. Return to investment

D. Breach impact modeling

View answer

Correct Answer: C

Question #30

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Assess

B. Protect

C. Respond

D. Sustain

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free IAPP CIPM Questions and AnswersIAPP CIPM | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free IAPP CIPM Questions and AnswersIAPP CIPM | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now