IAPP CIPM Exam Sample Questions

Question #1

SCENARIO Please use the following to answer the next QUESTION: Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office's video surveillance cameras leaked to news operations showed a drug exchange between Special Han

A. Training needs must be weighed against financial costs

B. Training on local laws must be implemented for all personnel

C. Training must be repeated frequently to respond to new legislation

D. Training must include assessments to verify that the material is mastered

View answer

Correct Answer: B

Question #2

What is the name for the privacy strategy model that describes delegated decision making?

A. De-centralized

B. De-functionalized

C. Hybrid

D. Matrix

View answer

Correct Answer: D

Question #3

SCENARIO Please use the following to answer the next QUESTION: Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current user

A. Include appropriate language about privacy protection in vendor contracts

B. Perform a privacy audit on any vendor under consideration

C. Require that a person trained in privacy protection be part of all vendor selection teams

D. Do business only with vendors who are members of privacy trade associations

View answer

Correct Answer: C

Question #4

SCENARIO Please use the following to answer the next QUESTION: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging

A. Sanjay should advise the distributor that Omnipresent Omnimedia has certified to the Privacy Shield Framework and there should be no issues

B. Sanjay should work with Manasa to review and remediate the Handy Helper as a gating item before it is released

C. Sanjay should document the data life cycle of the data collected by the Handy Helper

D. Sanjay should write a privacy policy to include with the Handy Helper user guide

View answer

Correct Answer: C

Question #5

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Cost basis

B. Gap analysis

C. Return to investment

D. Breach impact modeling

View answer

Correct Answer: C

Question #6

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Privacy by Design

B. Privacy Step Assessment

C. Information Security Planning

D. Innovation Privacy Standards

View answer

Correct Answer: A

Question #7

As a Data Protection Officer, one of your roles entails monitoring changes in laws and regulations and updating policies accordingly. How would you most effectively execute this responsibility?

A. Consult an external lawyer

B. Regularly engage regulators

C. Attend workshops and interact with other professionals

D. Subscribe to email list-serves that report on regulatory changes

View answer

Correct Answer: D

Question #8

What should a privacy professional keep in mind when selecting which metrics to collect?

A. Metrics should be reported to the public

B. The number of metrics should be limited at first

C. Metrics should reveal strategies for increasing company earnings

D. A variety of metrics should be collected before determining their specific functions

View answer

Correct Answer: A

Question #9

SCENARIO Please use the following to answer the next QUESTION: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expa

A. Outsourcing the hotline

B. A system for staff education

C. Strict communication channels

D. An ethics complaint department

View answer

Correct Answer: B

Question #10

SCENARIO Please use the following to answer the next QUESTION: As they company’s new chief executive officer, Thomas Goddard wants to be known as a leader in data protection. Goddard recently served as the chief financial officer of Hoopy.com, a pioneer in online video viewing with millions of users around the world. Unfortunately, Hoopy is infamous within privacy protection circles for its ethically Questionable practices, including unauthorized sales of personal data to marketers. Hoopy also was the targe

A. An external audit conducted by a panel of industry experts

B. An internal audit team accountable to upper management

C. Creation of a self-certification framework based on company policies

D. Revision of the strategic plan to provide a system of technical controlscorrect

View answer

Correct Answer: D

Question #11

Rationalizing requirements in order to comply with the various privacy requirements required by applicable law and regulation does NOT include which of the following?

A. Harmonizing shared obligations and privacy rights across varying legislation and/or regulators

B. Implementing a solution that significantly addresses shared obligations and privacy rights

C. Applying the strictest standard for obligations and privacy rights that doesn't violate privacy laws elsewhere

D. Addressing requirements that fall outside the common obligations and rights (outliers) on a case-by-case basis

View answer

Correct Answer: C

Question #12

SCENARIO Please use the following to answer the next QUESTION: Martin Brise?o is the director of human resources at the Canyon City location of the U.S. hotel chain Pacific Suites. In 1998, Brise?o decided to change the hotel’s on-the-job mentoring model to a standardized training program for employees who were progressing from line positions into supervisory positions. He developed a curriculum comprising a series of lessons, scenarios, and assessments, which was delivered in-person to small groups. Intere

A. Collecting too much information and keeping it for too long

B. Overlooking the need to organize and categorize datacorrect

C. Failing to outsource training and data management to professionals

D. Neglecting to make a backup copy of archived electronic files

View answer

Correct Answer: B

Question #13

SCENARIO Please use the following to answer the next QUESTION: Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious. Last week, a data processing firm used by the company reported that its system may have been hacked, and customer data such as names, addresses, and birthdays may have been compromised. Although the attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to Question the company's privacy program at today's m

A. By requiring training only on an as-needed basis

B. By offering alternative delivery methods for trainings

C. By introducing a system of periodic refresher trainings

D. By customizing training based on length of employee tenure

View answer

Correct Answer: B

Question #14

Which statement is FALSE regarding the use of technical security controls?

A. Most privacy legislation enumerates the types of technical security controls that must be implemented

B. Technical security controls are part of a data governance strategy

C. Technical security controls deployed for one jurisdiction often satisfy another jurisdictioncorrect

D. A security engineer should be involved with the deployment of technical security controls

View answer

Correct Answer: C

Question #15

Which is NOT an influence on the privacy environment external to an organization?

A. Management team priorities

B. Regulations

C. Consumer demandcorrect

D. Technological advances

View answer

Correct Answer: C

Question #16

Which of the following best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?

A. Employees must sign an ad hoc contractual agreement each time personal data is exported

B. All employees are subject to the rules in their entirety, regardless of where the work is taking place

C. All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established

D. Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement

View answer

Correct Answer: C

Question #17

SCENARIO Please use the following to answer the next QUESTION: John is the new privacy officer at the prestigious international law firm C A&M LLP. A&M LLP is very proud of its reputation in the practice areas of Trusts & Estates and Merger & Acquisition in both U.S. and Europe. During lunch with a colleague from the Information Technology department, John heard that the Head of IT, Derrick, is about to outsource the firm's email continuity service to their existing email security vendor C MessageSafe. Bein

A. Cloud Inc

B. MessageSafe is liable if Cloud Inc

C. Cloud Inc

D. A&M LLP's service contract must be amended to list Cloud Inc

View answer

Correct Answer: B

Question #18

SCENARIO Please use the following to answer the next QUESTION: As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with your accomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series of relatively minor data breaches that could easily have been worse. However, you have not had a reportable incident for the three years that you have been with the company. In fact, you consider your program a model that others

A. Through targeted curricula designed for specific departments

B. By adopting e-learning to reduce the need for instructors

C. By using industry standard off-the-shelf programs

D. Through a review of recent data breaches

View answer

Correct Answer: A

Question #19

In regards to the collection of personal data conducted by an organization, what must the data subject be allowed to do?

A. Evaluate the qualifications of a third-party processor before any data is transferred to that processor

B. Obtain a guarantee of prompt notification in instances involving unauthorized access of the data

C. Set a time-limit as to how long the personal data may be stored by the organizationcorrect

D. Challenge the authenticity of the personal data and have it corrected if needed

View answer

Correct Answer: C

Question #20

What is one reason the European Union has enacted more comprehensive privacy laws than the United States?

A. To ensure adequate enforcement of existing laws

B. To ensure there is adequate funding for enforcement

C. To allow separate industries to set privacy standards

D. To allow the free movement of data between member countries

View answer

Correct Answer: D

Question #21

SCENARIO Please use the following to answer the next QUESTION: Henry Home Furnishings has built high-end furniture for nearly forty years. However, the new owner, Anton, has found some degree of disorganization after touring the company headquarters. His uncle Henry had always focused on production C not data processing C and Anton is concerned. In several storage rooms, he has found paper files, disks, and old computers that appear to contain the personal data of current and former employees and customers.

A. To send consistent communication

B. To shift to electronic communication

C. To delay communications until local authorities are informed

D. To consider under what circumstances communication is necessary

View answer

Correct Answer: D

Question #22

SCENARIO Please use the following to answer the next QUESTION: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company's flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging

A. Obtain express written consent from users of the Handy Helper regarding marketing

B. Work with Sanjay to review any necessary privacy requirements to be built into the product

C. Certify that the Handy Helper meets the requirements of the EU-US Privacy Shield Framework

D. Build the artificial intelligence feature so that users would not have to input sensitive informationinto the Handy Helper

View answer

Correct Answer: B

Question #23

SCENARIO Please use the following to answer the next QUESTION: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, P

A. Analyze the data inventory to map data flows

B. Audit all vendors’ privacy practices and safeguardscorrect

C. Conduct a Privacy Impact Assessment for the company

D. Review all cloud contracts to identify the location of data servers used

View answer

Correct Answer: B

Question #24

What should a privacy professional keep in mind when selecting which metrics to collect?

A. Metrics should be reported to the public

B. The number of metrics should be limited at first

C. Metrics should reveal strategies for increasing company earnings

D. A variety of metrics should be collected before determining their specific functions

View answer

Correct Answer: A

Question #25

What does it mean to “rationalize” data protection requirements?

A. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties

B. Look for overlaps in laws and regulations from which a common solution can be developed

C. Determine where laws and regulations are redundant in order to eliminate some from requiring compliancecorrect

D. Address the less stringent laws and regulations, and inform stakeholders why they are applicable

View answer

Correct Answer: C

Question #26

What should be the first major goal of a company developing a new privacy program?

A. To survey potential funding sources for privacy team resources

B. To schedule conversations with executives of affected departments

C. To identify potential third-party processors of the organization's information

D. To create Data Lifecycle Management policies and procedures to limit data collection

View answer

Correct Answer: B

Question #27

What does it mean to “rationalize” data protection requirements?

A. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties

B. Look for overlaps in laws and regulations from which a common solution can be developed

C. Determine where laws and regulations are redundant in order to eliminate some from requiring compliancecorrect

D. Address the less stringent laws and regulations, and inform stakeholders why they are applicable

View answer

Correct Answer: C

Question #28

SCENARIO Please use the following to answer the next question: For 15 years, Albert has worked at Treasure Box C a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motiva

A. Access

B. Correction

C. Escalation

D. Data Integritycorrect

View answer

Correct Answer: D

Question #29

Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?

A. When the data subject is a public authority

B. When the erasure is in the public interest

C. When the processing is carried out by automated means

D. When the data is no longer necessary for its original purpose

View answer

Correct Answer: D

Question #30

SCENARIO Please use the following to answer the next QUESTION: Amira is thrilled about the sudden expansion of NatGen. As the joint Chief Executive Officer (CEO) with her long-time business partner Sadie, Amira has watched the company grow into a major competitor in the green energy market. The current line of products includes wind turbines, solar energy panels, and equipment for geothermal systems. A talented team of developers means that NatGen's line of products will only continue to grow. With the expa

A. Outsourcing the hotline

B. A system for staff education

C. Strict communication channels

D. An ethics complaint department

View answer

Correct Answer: B

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

IAPP CIPM Exam Sample Questions | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

IAPP CIPM Exam Sample Questions | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now