IAPP CIPM Practice Exam Questions

IAPP CIPM Sample Question Answers

Question # 1

What does it mean to œrationalize data protection requirements? 

A. Evaluate the costs and risks of applicable laws and regulations and address those that have the greatest penalties 
B. Look for overlaps in laws and regulations from which a common solution can be developed 
C. Determine where laws and regulations are redundant in order to eliminate some from requiring compliance 
D. Address the less stringent laws and regulations, and inform stakeholders why they are applicable 

Show Answer

Question # 2

œCollection , œaccess and œdestruction are aspects of what privacy management process? 

A. The data governance strategy
 B. The breach response plan 
C. The metric life cycle 
D. The business case 

Show Answer

Question # 3

SCENARIO Please use the following to answer the next QUESTIO N: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Spaces practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Pennys colleague in Marketing is excited by the new sales and the companys plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her œI heard someone in the breakroom talking about some new privacy laws but I really dont think it affects us. Were just a small company. I mean we just sell accessories online, so whats the real risk? He has also told her that he works with a number of small companies that help him get projects completed in a hurry. œWeve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just dont have. In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Pennys colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team œdidnt know what to do or who should do what. We hadnt been trained on it but were a small team though, so it worked out OK in the end. Penny is concerned that these issues will compromise Ace Spaces privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data œshake up . Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Spaces CEO today and has been asked to give her first impressions and an overview of her next steps. To help Penny and her CEO with their objectives, what would be the most helpful approach to address her IT concerns?

A. Roll out an encryption policy 
B. Undertake a tabletop exercise 
C. Ensure inventory of IT assets is maintained
 D. Host a town hall discussion for all IT employees 

Show Answer

Question # 4

SCENARIO Please use the following to answer the next QUESTIO N: For 15 years, Albert has worked at Treasure Box “ a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change. He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the companys privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the companys outdated policies and procedures. For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Boxs ability to protect personal dat a. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available. Albert does want to show a positive outlook during his interview. He intends to praise the companys commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures. In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover. He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the companys insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail. In addition to his suggestions for improvement, Albert believes that his knowledge of the companys recent business maneuvers will also impress the interviewers. For example, Albert is aware of the companys intention to acquire a medical supply company in the coming weeks. With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job. In consideration of the companys new initiatives, which of the following laws and regulations would be most appropriate for Albert to mention at the interview as a priority concern for the privacy team? 

A. Gramm-Leach-Bliley Act (GLBA) 
B. The General Data Protection Regulation (GDPR) 
C. The Telephone Consumer Protection Act (TCPA) 
D. Health Insurance Portability and Accountability Act (HIPAA) 

Show Answer

Question # 5

What is the key factor that lays the foundation for all other elements of a privacy program? 

A. The applicable privacy regulations 
B. The structure of a privacy team 
C. A privacy mission statement 
D. A responsible internal stakeholder 

Show Answer

Question # 6

Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay? 

A. When the data subject is a public authority. 
B. When the erasure is in the public interest.
 C. When the processing is carried out by automated means. 
D. When the data is no longer necessary for its original purpose. 

Show Answer

Question # 7

What is the main reason to begin with 3-5 key metrics during the program development process? 

A. To avoid undue financial costs. 
B. To keep the focus on the main organizational objectives. 
C. To minimize selective data use. 
D. To keep the process limited to as few people as possible. 

Show Answer

Question # 8

Which of the following is NOT typically a function of a Privacy Officer? 

A. Managing an organization's information security infrastructure. 
B. Serving as an interdepartmental liaison for privacy concerns. 
C. Monitoring an organization's compliance with privacy laws. 
D. Responding to information access requests from the public.

Show Answer

Question # 9

All of the following changes will likely trigger a data inventory update EXCEPT? 

A. Outsourcing the Customer Relationship Management (CRM) function. 
B. Acquisition of a new subsidiary. 
C. Onboarding of a new vendor. 
D. Passage of a new privacy regulation. 

Show Answer

Question # 10

An executive for a multinational online retail company in the United States is looking for guidance in developing her company's privacy program beyond what is specifically required by law. What would be the most effective resource for the executive to consult?

A. Internal auditors. 
B. Industry frameworks. 
C. Oversight organizations. 
D. Breach notifications from competitors. 

Show Answer