IAPP CIPM Exam Questions and Answers PDF

Question #1

SCENARIO Please use the following to answer the next QUESTION: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expa

A. The company needs to have policies and procedures in place to guide the purchasing decisions

B. The privacy notice for customers and the Business Continuity Plan (BCP) still need to be reviewed

C. Staff members across departments need time to review technical information concerning any new databases

D. Senior staff members need to first commit to adopting a minimum number of Privacy Enhancing Technologies (PETs)

View answer

Correct Answer: A

Question #2

SCENARIO Please use the following to answer the next QUESTION: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information u

A. Restrict the vendor to using company security controls

B. Offer company resources to assist with the processing

C. Include transfer prohibitions in the vendor contractcorrect

D. Lock the data down in its current location

View answer

Correct Answer: C

Question #3

SCENARIO Please use the following to answer the next QUESTION: For 15 years, Albert has worked at Treasure Box C a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motiva

A. Access

B. Correction

C. Escalation

D. Data Integritycorrect

View answer

Correct Answer: D

Question #4

What is a key feature of the privacy metric template adapted from the National Institute of Standards and Technology (NIST)?

A. It provides suggestions about how to collect and measure data

B. It can be tailored to an organization's particular needs

C. It is updated annually to reflect changes in government policy

D. It is focused on organizations that do business internationally

View answer

Correct Answer: A

Question #5

SCENARIO Please use the following to answer the next QUESTION: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It

A. User risk training

B. Biometric security

C. Encryption of the data

D. Frequent data backups

View answer

Correct Answer: A

Question #6

What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?

A. Using data that is too broad to capture specific meanings

B. Possessing too many types of data to perform a valid analysis

C. Using limited data in an attempt to support broad conclusions

D. Trying to use several measurements to gauge one aspect of a program

View answer

Correct Answer: A

Question #7

As a Data Protection Officer, one of your roles entails monitoring changes in laws and regulations and updating policies accordingly. How would you most effectively execute this responsibility?

A. Consult an external lawyer

B. Regularly engage regulators

C. Attend workshops and interact with other professionals

D. Subscribe to email list-serves that report on regulatory changes

View answer

Correct Answer: D

Question #8

In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?

A. Monetary exchange

B. Geographic features

C. Political history

D. Cultural norms

View answer

Correct Answer: D

Question #9

SCENARIO Please use the following to answer the next question: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry has always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. His initiative to achieve regulatory compliancecorrect

B. His intention to transition to electronic storage

C. His objective for zero loss of personal information

D. His intention to send notice letters to customers and employees

View answer

Correct Answer: A

Question #10

Under the General Data Protection Regulation (GDPR), which of the following situations would LEAST likely require a controller to notify a data subject?

A. An encrypted USB key with sensitive personal data is stolen

B. A direct marketing email is sent with recipients visible in the ‘cc’ fieldcorrect

C. Personal data of a group of individuals is erroneously sent to the wrong mailing list

D. A hacker publishes usernames, phone numbers and purchase history online after a cyber-attack

View answer

Correct Answer: B

Question #11

SCENARIO Please use the following to answer the next QUESTION: Martin Brise?o is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Brise?o decided to change the hotel’s on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Intere

A. Information would have been ranked according to importance and stored in separate locations

B. The most sensitive information would have been immediately erased and destroyed

C. The most important information would have been regularly assessed and tested for security

D. Information would have been categorized and assigned a deadline for destructioncorrect

View answer

Correct Answer: D

Question #12

In addition to regulatory requirements and business practices, what important factors must a global privacy strategy consider?

A. Monetary exchange

B. Geographic featurescorrect

C. Political history

D. Cultural norms

View answer

Correct Answer: B

Question #13

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. To send consistent communication

B. To shift to electronic communication

C. To delay communications until local authorities are informed

D. To consider under what circumstances communication is necessary

View answer

Correct Answer: D

Question #14

Which of the following is TRUE about the Data Protection Impact Assessment (DPIA) process as required under the General Data Protection Regulation (GDPR)?

A. The DPIA result must be reported to the corresponding supervisory authority

B. The DPIA report must be published to demonstrate the transparency of the data processing

C. The DPIA must include a description of the proposed processing operation and its purpose

D. The DPIA is required if the processing activity entails risk to the rights and freedoms of an EU individual

View answer

Correct Answer: D

Question #15

SCENARIO Please use the following to answer the next QUESTION: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current user

A. Implement a more comprehensive suite of information security controls than the one used by the vendor

B. Ask the vendor for verifiable information about their privacy protections so weaknesses can be identified

C. Develop security protocols for the vendor and mandate that they be deployed

D. Insist on an audit of the vendor's privacy procedures and safeguards

View answer

Correct Answer: B

Question #16

SCENARIO Please use the following to answer the next QUESTION: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expa

A. Outsourcing the hotline

B. A system for staff education

C. Strict communication channels

D. An ethics complaint department

View answer

Correct Answer: B

Question #17

If an organization maintains a separate ethics office, to whom would its officer typically report to in order to retain the greatest degree of independence?

A. The Board of Directors

B. The Chief Financial Officer

C. The Human Resources Director

D. The organization's General Counsel

View answer

Correct Answer: A

Question #18

SCENARIO Please use the following to answer the next question: For 15 years, Albert has worked at Treasure Box C a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motiva

A. Who has access to the data

B. What the nature of the data is

C. How data at the company is collected

D. How long data at the company is keptcorrect

View answer

Correct Answer: D

Question #19

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. His initiative to achieve regulatory compliance

B. His intention to transition to electronic storage

C. His objective for zero loss of personal information

D. His intention to send notice letters to customers and employees

View answer

Correct Answer: C

Question #20

Which is the best way to view an organization’s privacy framework?

A. As an industry benchmark that can apply to many organizations

B. As a fixed structure that directs changes in the organizationcorrect

C. As an aspirational goal that improves the organization

D. As a living structure that aligns to changes in the organization

View answer

Correct Answer: B

Question #21

SCENARIO Please use the following to answer the next QUESTION: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, P

A. Ace Space’s documented procedurescorrect

B. Ace Space’s employee training program

C. Ace Space’s vendor engagement protocols

D. Ace Space’s content sharing practices on social media

View answer

Correct Answer: A

Question #22

An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor. Which of the following actions should the privacy officer take first?

A. Perform a risk of harm analysis

B. Report the incident to law enforcement

C. Contact the recipient to delete the email

D. Send firm-wide email notification to employees

View answer

Correct Answer: A

Question #23

SCENARIO Please use the following to answer the next QUESTION: John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor C MessageSafe. Bein

A. Privacy compliance

B. Security commitment

C. Certifications to relevant frameworks

D. Data breach notification to A&M LL

View answer

Correct Answer: C

Question #24

What are you doing if you succumb to "overgeneralization" when analyzing data from metrics?

A. Using data that is too broad to capture specific meanings

B. Possessing too many types of data to perform a valid analysis

C. Using limited data in an attempt to support broad conclusions

D. Trying to use several measurements to gauge one aspect of a program

View answer

Correct Answer: C

Question #25

What is the best way to understand the location, use and importance of personal data within an organization?

A. By analyzing the data inventory

B. By testing the security of data systems

C. By evaluating methods for collecting data

D. By interviewing employees tasked with data entry

View answer

Correct Answer: A

Question #26

SCENARIO Please use the following to answer the next QUESTION: Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Han

A. Training needs must be weighed against financial costs

B. Training on local laws must be implemented for all personnel

C. Training must be repeated frequently to respond to new legislation

D. Training must include assessments to verify that the material is mastered

View answer

Correct Answer: B

Question #27

If an organization maintains a separate ethics office, to whom would its officer typically report to in order to retain the greatest degree of independence?

A. The Board of Directors

B. The Chief Financial Officer

C. The Human Resources Director

D. The organization's General Counsel

View answer

Correct Answer: A

Question #28

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Data Lifecycle Management Standards

B. United Nations Privacy Agency Standards

C. International Organization for Standardization 9000 Series

D. International Organization for Standardization 27000 Series

View answer

Correct Answer: D

Question #29

SCENARIO Please use the following to answer the next question: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry has always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. Customer communication

B. Employee access to electronic storage

C. Employee advisement regarding legal matters

D. Controlled access at the company headquarterscorrect

View answer

Correct Answer: D

Question #30

SCENARIO Please use the following to answer the next QUESTION: It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It

A. The use of personal equipment is a cost-effective measure that leads to no greater security risks than are always present in a modern organization

B. Any computer or other equipment is company property whenever it is used for company business

C. While the company may not own the equipment, it is required to protect the business-related data on any equipment used by its employees

D. The use of personal equipment must be reduced as it leads to inevitable security risks

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

IAPP CIPM Exam Questions and Answers PDF | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

IAPP CIPM Exam Questions and Answers PDF | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now