Latest IAPP CIPM Exam Questions and Answers, Certified Information Privacy Manager

Question #1

When building a data privacy program, what is a good starting point to understand the scope ofprivacy program needs?

A. erform Data Protection Impact Assessments (DPIAs)

B. erform Risk Assessments

C. omplete a Data Inventory

D. eview Audits

View answer

Correct Answer: C

Question #2

Which of the following helps build trust with customers and stakeholders?

A. nly publish what is legally necessary to reduce your liability

B. nable customers to view and change their own personal information within a dedicated portal

C. ublish your privacy policy using broad language to ensure all of your organizations activities are captured

D. rovide a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks

View answer

Correct Answer: C

Question #3

Your company wants to convert paper records that contain customer personal information intoelectronic form, upload the records into a new third-party marketing tool and then merge thecustomer personal information in the marketing tool with information from other applications.As the Privacy Officer, which of the following should you complete to effectively make thesechanges?

A. Record of Authority

B. Personal Data Inventory

C. Privacy Threshold Analysis (PTA)

D. Privacy Impact Assessment (PIA)

View answer

Correct Answer: B

Question #4

Which of the following is the optimum first step to take when creating a Privacy Officer governancemodel?

A. nvolve senior leadership

B. rovide flexibility to the General Counsel Office

C. evelop internal partnerships with IT and information security

D. everage communications and collaboration with public affairs teams

View answer

Correct Answer: C

Question #5

Which of the following is NOT an important factor to consider when developing a data retentionpolicy?

A. echnology resource

B. usiness requirement

C. rganizational culture

D. ompliance requirement

View answer

Correct Answer: A

Question #6

SCENARIOPlease use the following to answer the next QUESTION:Penny has recently joined Ace Space, a company that sells homeware accessories online, as its newprivacy officer. The company is based in California but thanks to some great publicity from a socialmedia influencer last year, the company has received an influx of sales from the EU and has set up aregional office in Ireland to support this expansion. To become familiar with Ace Spaces practicesand assess what her privacy priorities will be, Penny ha

A. nalyze the data inventory to map data flows

B. udit all vendors’ privacy practices and safeguards

C. onduct a Privacy Impact Assessment for the company

D. eview all cloud contracts to identify the location of data servers used

View answer

Correct Answer: B

Question #7

A minimum requirement for carrying out a Data Protection Impact Assessment (DPIA) wouldinclude?

A. rocessing on a large scale of special categories of data

B. onitoring of a publicly accessible area on a large scale

C. ssessment of the necessity and proportionality

D. ssessment of security measures

View answer

Correct Answer: C

Question #8

SCENARIOPlease use the following to answer the next QUESTION:Penny has recently joined Ace Space, a company that sells homeware accessories online, as its newprivacy officer. The company is based in California but thanks to some great publicity from a socialmedia influencer last year, the company has received an influx of sales from the EU and has set up aregional office in Ireland to support this expansion. To become familiar with Ace Spaces practicesand assess what her privacy priorities will be, Penny ha

A. ce Space’s documented procedures

B. ce Space’s employee training program

C. ce Space’s vendor engagement protocols

D. ce Space’s content sharing practices on social media

View answer

Correct Answer: A

Question #9

Which of the following is a physical control that can limit privacy risk?

A. eypad or biometric access

B. ser access reviews

C. ncryption

D. okenization

View answer

Correct Answer: A

Question #10

Your company wants to convert paper records that contain customer personal information into electronic form, upload the records into a new third-party marketing tool and then merge the customer personal information in the marketing tool with information from other applications.As the Privacy Officer, which of the following should you complete to effectively make these changes?

A. Record of Authority

B. Personal Data Inventory

C. Privacy Threshold Analysis (PTA)

D. Privacy Impact Assessment (PIA)

View answer

Correct Answer: D

Question #11

When supporting the business and data privacy program expanding into a new jurisdiction, it isimportant to do all of the following EXCEPT?

A. dentify the stakeholders

B. ppoint a new Privacy Officer (PO) for that jurisdiction

C. erform an assessment of the laws applicable in that new jurisdiction

D. onsider culture and whether the privacy framework will need to account for changes in culture

View answer

Correct Answer: D

Question #12

While trying to e-mail her manager, an employee has e-mailed a list of all the company's customers, including their bank details, to an employee with the same name at a different company. Which of the following would be the first stage in the incident response plan under the General Data Protection Regulation (GDPR)?

A. otification to data subjects

B. ontainment of impact of breach

C. emediation offers to data subjects

D. otification to the Information Commissioner's Office (ICO)

View answer

Correct Answer: B

Question #13

Which of the following best supports implementing controls to bring privacy policies into effect?

A. he internal audit department establishing the audit controls which test for policy effectiveness

B. he legal department or outside counsel conducting a thorough review of the privacy program and policies

C. he Chief Information Officer as part of the Senior Management Team creating enterprise privacy policies to ensure controls are available

D. he information technology (IT) group supporting and enhancing the privacy program and privacy policy by developing processes and controls

View answer

Correct Answer: A

Question #14

A systems audit uncovered a shared drive folder containing sensitive employee data with no access controls and therefore was available for all employees to view. What is the first step to mitigate further risks?

A. otify all employees whose information was contained in the file

B. heck access logs to see who accessed the folder

C. otify legal counsel of a privacy incident

D. estrict access to the folder

View answer

Correct Answer: D

Question #15

You would like to better understand how your organization can demonstrate compliance with international privacy standards and identify gaps for remediation. What steps could you take to achieve this objective?

A. arry out a second-party audit

B. onsult your local privacy regulator

C. onduct an annual self assessment

D. ngage a third-party to conduct an audit

View answer

Correct Answer: D

Question #16

Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?

A. orward the request to the contact on file for the client asking them how they would like you to proceed

B. edirect the individual back to their employer to understand their rights and how this might impact access to company tools

C. rocess the request assuming that the individual understands the implications to their organization if their information is deleted

D. xplain you are unable to process the request because business contact information and associated data is not covered under privacy rights laws

View answer

Correct Answer: B

Question #17

When building a data privacy program, what is a good starting point to understand the scope of privacy program needs?

A. erform Data Protection Impact Assessments (DPIAs)

B. erform Risk Assessments

C. omplete a Data Inventory

D. eview Audits

View answer

Correct Answer: C

Question #18

Which of the following is NOT an important factor to consider when developing a data retention policy?

A. echnology resource

B. usiness requirement

C. rganizational culture

D. ompliance requirement

View answer

Correct Answer: C

Question #19

What is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program?

A. educing storage costs

B. nsuring data is kept for no longer than necessary

C. rafting policies which ensure minimal data is collected

D. ncreasing awareness of the importance of confidentiality

View answer

Correct Answer: C

Question #20

When supporting the business and data privacy program expanding into a new jurisdiction, it is important to do all of the following EXCEPT?

A. dentify the stakeholders

B. ppoint a new Privacy Officer (PO) for that jurisdiction

C. erform an assessment of the laws applicable in that new jurisdiction

D. onsider culture and whether the privacy framework will need to account for changes in culture

View answer

Correct Answer: B

Question #21

SCENARIOPlease use the following to answer the next QUESTION:Penny has recently joined Ace Space, a company that sells homeware accessories online, as its newprivacy officer. The company is based in California but thanks to some great publicity from a socialmedia influencer last year, the company has received an influx of sales from the EU and has set up aregional office in Ireland to support this expansion. To become familiar with Ace Spaces practicesand assess what her privacy priorities will be, Penny ha

A. udit rights

B. iability for a data breach

C. ricing for data security protections

D. he data a vendor will have access to

View answer

Correct Answer: C

Question #22

Which of the following helps build trust with customers and stakeholders?

A. nly publish what is legally necessary to reduce your liability

B. nable customers to view and change their own personal information within a dedicated portal

C. ublish your privacy policy using broad language to ensure all of your organization's activities are captured

D. rovide a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks

View answer

Correct Answer: D

Question #23

If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?

A. eview reporting activity on breaches to understand when incidents are being reported and when they are not to improve communication and training

B. mprove communication to reinforce to everyone that breaches must be reported and how they should be reported

C. rovide role-specific training to areas where breaches are happening so they are more aware

D. istribute a phishing exercise to all employees to test their ability to recognize a threat attempt

View answer

Correct Answer: D

Question #24

Which of the documents below assists the Privacy Manager in identifying and responding to arequest from an individual about what personal information the organization holds about then withwhom the information is shared?

A. isk register

B. rivacy policy

C. ecords retention schedule

D. ersonal information inventory

View answer

Correct Answer: C

Question #25

Which of the following actions is NOT required during a data privacy diligence process for Merger &Acquisition (M&A) deals?

A. evise inventory of applications that house personal data and data mapping

B. pdate business processes to handle Data Subject Requests (DSRs)

C. ompare the original use of personal data to post-merger use

D. erform a privacy readiness assessment before the deal

View answer

Correct Answer: D

Question #26

When devising effective employee policies to address a particular issue, which of the followingshould be included in the first draft?

A. ationale for the policy

B. oints of contact for the employee

C. oles and responsibilities of the different groups of individuals

D. xplanation of how the policy is applied within the organization

View answer

Correct Answer: B

Question #27

What is most critical when outsourcing data destruction service?

A. btain a certificate of data destruction

B. onfirm data destruction must be done on-site

C. onduct an annual in-person audit of the provider’s facilities

D. nsure that they keep an asset inventory of the original data

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Latest IAPP CIPM Exam Questions and Answers, Certified Information Privacy Manager | SPOTO

View The Updated CIPM Exam Questions

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Latest IAPP CIPM Exam Questions and Answers, Certified Information Privacy Manager | SPOTO

View The Updated CIPM Exam Questions

View The Updated IAPP Exam Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now