IAPP CIPM Exam Practice Questions?

Question #1

SCENARIO Please use the following to answer the next QUESTION: John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor C MessageSafe. Bein

A. Cloud Inc

B. MessageSafe is liable if Cloud Inc

C. Cloud Inc

D. A&M LLP's service contract must be amended to list Cloud Inc

View answer

Correct Answer: B

Question #2

Which is TRUE about the scope and authority of data protection oversight authorities?

A. The Office of the Privacy Commissioner (OPC) of Canada has the right to impose financial sanctions on violators

B. All authority in the European Union rests with the Data Protection Commission (DPC)

C. No one agency officially oversees the enforcement of privacy regulations in the United States

D. The Asia-Pacific Economic Cooperation (APEC) Privacy Frameworks require all member nations to designate a national data protection authority

View answer

Correct Answer: C

Question #3

SCENARIO Please use the following to answer the next QUESTION: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, P

A. Audit rights

B. Liability for a data breach

C. Pricing for data security protectionscorrect

D. The data a vendor will have access to

View answer

Correct Answer: C

Question #4

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. Practicing data minimalism

B. Ensuring data retrievability

C. Implementing clear policies

D. Ensuring adequacy of infrastructure

View answer

Correct Answer: A

Question #5

SCENARIO Please use the following to answer the next QUESTION: John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor C MessageSafe. Bein

A. Cloud Inc

B. MessageSafe is liable if Cloud Inc

C. Cloud Inc

D. A&M LLP's service contract must be amended to list Cloud Inc

View answer

Correct Answer: B

Question #6

SCENARIO Please use the following to answer the next QUESTION: Richard McAdams recently graduated law school and decided to return to the small town of Lexington, Virginia to help run his aging grandfather's law practice. The elder McAdams desired a limited, lighter role in the practice, with the hope that his grandson would eventually take over when he fully retires. In addition to hiring Richard, Mr. McAdams employs two paralegals, an administrative assistant, and a part-time IT specialist who handles all

A. The vendor will be required to report any privacy violations to the appropriate authorities

B. The vendor may not be aware of the privacy implications involved in the project

C. The vendor may not be forthcoming about the vulnerabilities of the database

D. The vendor will be in direct contact with all of the law firm's personal data

View answer

Correct Answer: D

Question #7

SCENARIO Please use the following to answer the next QUESTION: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current user

A. Include appropriate language about privacy protection in vendor contracts

B. Perform a privacy audit on any vendor under consideration

C. Require that a person trained in privacy protection be part of all vendor selection teams

D. Do business only with vendors who are members of privacy trade associations

View answer

Correct Answer: C

Question #8

SCENARIO Please use the following to answer the next QUESTION: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging

A. Failure to obtain opt-in consent to marketing

B. Failure to observe data localization requirements

C. Failure to implement the least privilege access standard

D. Failure to integrate privacy throughout the system development life cycle

View answer

Correct Answer: D

Question #9

SCENARIO Please use the following to answer the next question: For 15 years, Albert has worked at Treasure Box C a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motiva

A. Appointing an internal ombudsman to address employee complaints regarding hours and pay

B. Using a third-party auditor to address privacy protection issues not recognized by the prior internal audits

C. Working with the Human Resources department to make screening procedures for potential employees more rigorous

D. Evaluating the company’s ability to handle personal health information if the plan to acquire the medical supply company goes forwardcorrect

View answer

Correct Answer: D

Question #10

SCENARIO Please use the following to answer the next QUESTION: Paul Daniels, with years of experience as a CEO, is worried about his son Carlton's successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton's direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultan

A. A supplier audit

B. An internal audit

C. A third-party audit

D. A self-certification

View answer

Correct Answer: C

Question #11

SCENARIO Please use the following to answer the next QUESTION: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, P

A. Ace Space’s documented procedurescorrect

B. Ace Space’s employee training program

C. Ace Space’s vendor engagement protocols

D. Ace Space’s content sharing practices on social media

View answer

Correct Answer: A

Question #12

SCENARIO Please use the following to answer the next QUESTION: John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor C MessageSafe. Bein

A. MessageSafe must apply due diligence before trusting Cloud Inc

B. MessageSafe must flow-down its data protection contract terms with A&M LLP to Cloud Inc

C. MessageSafe must apply appropriate security controls on the cloud infrastructure

D. MessageSafe must notify A&M LLP of a data breach

View answer

Correct Answer: C

Question #13

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. The timeline for monitoring

B. The method of recordkeeping

C. The use of internal employees

D. The type of required qualifications

View answer

Correct Answer: A

Question #14

In which situation would a Privacy Impact Assessment (PIA) be the least likely to be required?

A. If a company created a credit-scoring platform five years ago

B. If a health-care professional or lawyer processed personal data from a patient's file

C. If a social media company created a new product compiling personal data to generate user profiles

D. If an after-school club processed children's data to determine which children might have food allergies

View answer

Correct Answer: B

Question #15

An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor. Which of the following actions should the privacy officer take first?

A. Perform a risk of harm analysis

B. Report the incident to law enforcement

C. Contact the recipient to delete the email

D. Send firm-wide email notification to employees

View answer

Correct Answer: A

Question #16

An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor. Which of the following actions should the privacy officer take first?

A. Perform a risk of harm analysis

B. Report the incident to law enforcement

C. Contact the recipient to delete the email

D. Send firm-wide email notification to employees

View answer

Correct Answer: A

Question #17

When devising effective employee policies to address a particular issue, which of the following should be included in the first draft?

A. Rationale for the policy

B. Points of contact for the employee

C. Roles and responsibilities of the different groups of individuals

D. Explanation of how the policy is applied within the organization

View answer

Correct Answer: B

Question #18

Which of the following indicates you have developed the right privacy framework for your organization?

A. It includes a privacy assessment of each major system

B. It improves the consistency of the privacy program

C. It works at a different type of organization

D. It identifies all key stakeholders by name

View answer

Correct Answer: B

Question #19

There are different forms of monitoring available for organizations to consider when aligning with their privacy program goals. Which of the following forms of monitoring is best described as ‘auditing’?

A. Evaluating operations, systems, and processes

B. Tracking, reporting and documenting complaints from all sources

C. Assisting in the completion of attesting reporting for SOC2, ISO, or BS7799

D. Ensuring third parties have appropriate security and privacy requirements in place

View answer

Correct Answer: A

Question #20

Which of the following privacy frameworks are legally binding?

A. Binding Corporate Rules (BCRs)

B. Generally Accepted Privacy Principles (GAPP)

C. Asia-Pacific Economic Cooperation (APEC) Privacy Framework

D. Organization for Economic Co-Operation and Development (OECD) Guidelines

View answer

Correct Answer: A

Question #21

What should a privacy professional keep in mind when selecting which metrics to collect?

A. Metrics should be reported to the public

B. The number of metrics should be limited at first

C. Metrics should reveal strategies for increasing company earnings

D. A variety of metrics should be collected before determining their specific functions

View answer

Correct Answer: A

Question #22

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. Practicing data minimalism

B. Ensuring data retrievability

C. Implementing clear policies

D. Ensuring adequacy of infrastructure

View answer

Correct Answer: A

Question #23

When implementing Privacy by Design (PbD), what would NOT be a key consideration?

A. Collection limitation

B. Data minimization

C. Limitations on liability

D. Purpose specification

View answer

Correct Answer: C

Question #24

SCENARIO Please use the following to answer the next QUESTION: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging

A. Obtain express written consent from users of the Handy Helper regarding marketing

B. Work with Sanjay to review any necessary privacy requirements to be built into the product

C. Certify that the Handy Helper meets the requirements of the EU-US Privacy Shield Framework

D. Build the artificial intelligence feature so that users would not have to input sensitive information into the Handy Helper

View answer

Correct Answer: C

Question #25

An organization’s business continuity plan or disaster recovery plan does NOT typically include what?

A. Recovery time objectives

B. Emergency Response Guidelines

C. Statement of organizational responsibilities

D. Retention schedule for storage and destruction of informationcorrect

View answer

Correct Answer: D

Question #26

What is the name for the privacy strategy model that describes delegated decision making?

A. De-centralized

B. De-functionalized

C. Hybrid

D. Matrix

View answer

Correct Answer: A

Question #27

Which is NOT an influence on the privacy environment external to an organization?

A. Management team priorities

B. Regulations

C. Consumer demand

D. Technological advances

View answer

Correct Answer: C

Question #28

Which is NOT an influence on the privacy environment external to an organization?

A. Management team priorities

B. Regulations

C. Consumer demand

D. Technological advances

View answer

Correct Answer: C

Question #29

What is the best way to understand the location, use and importance of personal data within an organization?

A. By analyzing the data inventory

B. By testing the security of data systems

C. By evaluating methods for collecting data

D. By interviewing employees tasked with data entry

View answer

Correct Answer: C

Question #30

SCENARIO Please use the following to answer the next QUESTION: Martin Brise?o is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Brise?o decided to change the hotel’s on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Intere

A. Information would have been ranked according to importance and stored in separate locations

B. The most sensitive information would have been immediately erased and destroyed

C. The most important information would have been regularly assessed and tested for security

D. Information would have been categorized and assigned a deadline for destructioncorrect

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

IAPP CIPM Exam Practice Questions? | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

IAPP CIPM Exam Practice Questions? | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now