Latest IAPP CIPP-US Exam Questions and Answers, 2025 Update

Question #1

Which entities must comply with the Telemarketing Sales Rule?

A. For-profit organizations and for-profit telefunders regarding charitable solicitationscorrect

B. Nonprofit organizations calling on their own behalf

C. For-profit organizations calling businesses when a binding contract exists between them

D. For-profit and not-for-profit organizations when selling additional services to establish customerscorrect

View answer

Correct Answer: AD

Question #2

How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act (FCRA)?

A. It expanded the definition of “consumer reports” to include communications relating to employee investigations

B. It increased the obligation of organizations to dispose of consumer data in ways that prevent unauthorized accesscorrect

C. It stipulated the purpose of obtaining a consumer report can only be for a review of the employee’s credit worthiness

D. It required employers to get an employee’s consent in advance of requesting a consumer report for internal investigation purposes

View answer

Correct Answer: B

Question #3

What is the most likely reason that states have adopted their own data breach notification laws?

A. Many states have unique types of businesses that require specific legislation

B. Many lawmakers believe that federal enforcement of current laws has not been effectivecorrect

C. Many types of organizations are not currently subject to federal laws regarding breaches

D. Many large businesses have intentionally breached the personal information of their customers

View answer

Correct Answer: B

Question #4

According to Section 5 of the FTC Act, self-regulation primarily involves a company’s right to do what?

A. Determine which bodies will be involved in adjudicationcorrect

B. Decide if any enforcement actions are justified

C. Adhere to its industry’s code of conduct

D. Appeal decisions made against it

View answer

Correct Answer: A

Question #5

Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?

A. A K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public releasecorrect

B. A university posts a public student directory that includes names, hometowns, e-mail addresses, and majors

C. A newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll

D. University police provide an arrest report to a student’s hometown police, who suspect him of a similar crime

View answer

Correct Answer: A

Question #6

Which of these organizations would be required to provide its customers with an annual privacy notice?

A. The Four Winds Tribal College

B. The Golden Gavel Auction House

C. The King County Savings and Loan

D. The Breezy City Housing Commission

View answer

Correct Answer: B

Question #7

Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report, “Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers”?

A. International data transferscorrect

B. Large platform providers

C. Promoting enforceable self-regulatory codes

D. Do Not Track

View answer

Correct Answer: A

Question #8

According to the FTC Report of 2012, what is the main goal of Privacy by Design?

A. Obtaining consumer consent when collecting sensitive data for certain purposes

B. Establishing a system of self-regulatory codes for mobile-related services

C. Incorporating privacy protections throughout the development processcorrect

D. Implementing a system of standardization for privacy notices

View answer

Correct Answer: C

Question #9

The FTC often negotiates consent decrees with companies found to be in violation of privacy principles. How does this benefit both parties involved?

A. It standardizes the amount of fines

B. It simplifies the audit requirements

C. It avoids potentially harmful publicity

D. It spares the expense of going to trial

View answer

Correct Answer: C

Question #10

A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the student without consent?

A. If the student has not yet turned 18 years of age

B. If the student is in danger of academic suspension

C. If the student is still a dependent for tax purposescorrect

D. If the student has applied to transfer to another institution

View answer

Correct Answer: C

Question #11

In what way does the “Red Flags Rule” under the Fair and Accurate Credit Transactions Act (FACTA) relate to the owner of a grocery store who uses a money wire service?

A. It mandates the use of updated technology for securing credit recordscorrect

B. It requires the owner to implement an identity theft warning system

C. It is not usually enforced in the case of a small financial institution

D. It does not apply because the owner is not a creditor

View answer

Correct Answer: A

Question #12

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?

A. Make electronic health records (EHRs) part of regular carecorrect

B. Bill the majority of patients electronically for their health care

C. Send health information and appointment reminders to patients electronically

D. Keep electronic updates about the Health Insurance Portability and Accountability Act

View answer

Correct Answer: A

Question #13

According to Section 5 of the FTC Act, self-regulation primarily involves a company’s right to do what?

A. Determine which bodies will be involved in adjudication

B. Decide if any enforcement actions are justified

C. Adhere to its industry’s code of conductcorrect

D. Appeal decisions made against it

View answer

Correct Answer: C

Question #14

SCENARIO Please use the following to answer the next QUESTION: A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices. The complainant accuses the retailer of improperly disclosing her personal data, without consent, to par

A. Right of Access

B. Right of Removalcorrect

C. Right of Rectification

D. Right to Be Forgotten

View answer

Correct Answer: B

Question #15

Which jurisdiction must courts have in order to hear a particular case?

A. Subject matter jurisdiction and regulatory jurisdiction

B. Subject matter jurisdiction and professional jurisdiction

C. Personal jurisdiction and subject matter jurisdiction

D. Personal jurisdiction and professional jurisdiction

View answer

Correct Answer: C

Question #16

Under the Telemarketing Sales Rule, what characteristics of consent must be in place for an organization to acquire an exception to the Do-Not-Call rules for a particular consumer?

A. The consent must be in writing, must state the times when calls can be made to the consumer and must be signed

B. The consent must be in writing, must contain the number to which calls can be made and must have an end date

C. The consent must be in writing, must contain the number to which calls can be made and must be signedcorrect

D. The consent must be in writing, must have an end data and must state the times when calls can be made

View answer

Correct Answer: C

Question #17

All of the following common law torts are relevant to employee privacy under US law EXCEPT?

A. Infliction of emotional distress

B. Intrusion upon seclusion

C. Defamation

D. Conversion

View answer

Correct Answer: B

Question #18

What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

A. Conduct annual consumer surveys regarding satisfaction with user preferences

B. Process requests for changes to user preferences within a designated time frame

C. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls

D. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter’s own usecorrect

View answer

Correct Answer: D

Question #19

What is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party called?

A. A consent decreecorrect

B. Stare decisis decree

C. A judgment rider

D. Common law judgment

View answer

Correct Answer: A

Question #20

If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

A. The organization will still be in compliance with most sector-specific privacy and security laws

B. The impact of an organizational data breach will be more severe than if the data had been segregated

C. Temporary employees will be able to find the data necessary to fulfill their responsibilities

D. The organization will be able to address legal discovery requests efficiently without producing more information than necessary

View answer

Correct Answer: D

Question #21

Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?

A. The entity must conduct business in the statecorrect

B. The entity must have employees in the state

C. The entity must be registered in the state

D. The entity must be an information broker

View answer

Correct Answer: A

Question #22

SCENARIO Please use the following to answer the next QUESTION: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state’s Do Not Call list, as well as the people on it. “If they were really serious about not being bothered,” Evan said, “They’d be on the national DNC list. That’s the only one we’re required to follow. At SunriseLynx, we call until they ask us not to.” Bizarrely, E

A. The conditions under which recipients can opt out

B. The wishes of recipients who request callbackscorrect

C. The right to monitor calls for quality assurance

D. The relationship of state law to federal law

View answer

Correct Answer: B

Question #23

In which situation would a policy of “no consumer choice” or “no option” be expected?

A. When a job applicant’s credit report is provided to an employer

B. When a customer’s financial information is requested by the government

C. When a patient’s health record is made available to a pharmaceutical company

D. When a customer’s street address is shared with a shipping companycorrect

View answer

Correct Answer: D

Question #24

All of the following are tasks in the “Discover” phase of building an information management program EXCEPT?

A. Facilitating participation across departments and levels

B. Developing a process for review and update of privacy policies

C. Deciding how aggressive to be in the use of personal information

D. Understanding the laws that regulate a company’s collection of informationcorrect

View answer

Correct Answer: D

Question #25

Which of the following federal agencies does NOT enforce the Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA)?

A. The Office of the Comptroller of the Currency

B. The Consumer Financial Protection Bureau

C. The Department of Health and Human Servicescorrect

D. The Federal Trade Commission

View answer

Correct Answer: C

Question #26

SCENARIO Please use the following to answer the next question: Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse. Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’ Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issu

A. By suggesting that Declan look at the hospital’s publicly posted privacy policy

B. By assuring Declan that third parties are prevented from seeing Private Health Information (PHI)

C. By pointing out that contracts are in place to help ensure the observance of minimum security standardscorrect

D. By describing how the billing system is integrated into the hospital’s electronic health records (EHR) system

View answer

Correct Answer: C

Question #27

In which situation would a policy of “no consumer choice” or “no option” be expected?

A. When a job applicant’s credit report is provided to an employercorrect

B. When a customer’s financial information is requested by the government

C. When a patient’s health record is made available to a pharmaceutical company

D. When a customer’s street address is shared with a shipping companycorrect

View answer

Correct Answer: AD

Question #28

Which entities must comply with the Telemarketing Sales Rule?

A. For-profit organizations and for-profit telefunders regarding charitable solicitationscorrect

B. Nonprofit organizations calling on their own behalf

C. For-profit organizations calling businesses when a binding contract exists between them

D. For-profit and not-for-profit organizations when selling additional services to establish customers

View answer

Correct Answer: A

Question #29

SCENARIO Please use the following to answer the next QUESTION: Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state’s Do Not Call list, as well as the people on it. “If they were really serious about not being bothered,” Evan said, “They’d be on the national DNC list. That’s the only one we’re required to follow. At SunriseLynx, we call until they ask us not to.” Bizarrely, E

A. The applicability of federal lawcorrect

B. The enforceability of local law

C. The strict nature of state law

D. The definition of tort law

View answer

Correct Answer: A

Question #30

What is an exception to the Electronic Communications Privacy Act of 1986 ban on interception of wire, oral and electronic communications?

A. Where one of the parties has given consentcorrect

B. Where state law permits such interception

C. If an organization intercepts an employee’s purely personal callcorrect

D. Only if all parties have given consent

View answer

Correct Answer: AC

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Latest IAPP CIPP-US Exam Questions and Answers, 2025 Update | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Latest IAPP CIPP-US Exam Questions and Answers, 2025 Update | SPOTO

View The Updated IAPP Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now