IAPP CIPM Exam Dumps

Certified Information Privacy Manager (CIPM)

IAPP CIPM Sample Questions

Question # 1

The General Data Protection Regulation (GDPR) specifies fines that may be levied againstdata controllers for certain infringements. Which of the following will be subject toadministrative fines of up to 10 000 000 EUR, or in the case of an undertaking, up to 2% ofthe total worldwide annual turnover of the preceding financial year?

A. Failure to demonstrate that consent was given by the data subject to the processing oftheir personal data where it is used as the basis for processing 
B. Failure to implement technical and organizational measures to ensure data protection isenshrined by design and default 
C. Failure to process personal information in a manner compatible with its original purpose 
D. Failure to provide the means for a data subject to rectify inaccuracies in personal data 

Answer: A

Show Answer

Question # 2

SCENARIOPlease use the following to answer the next QUESTION:It's just what you were afraid of. Without consulting you, the information technology directorat your organization launched a new initiative to encourage employees to use personaldevices for conducting business. The initiative made purchasing a new, high-specificationlaptop computer an attractive option, with discounted laptops paid for as a payrolldeduction spread over a year of paychecks. The organization is also paying the salestaxes. It's a great deal, and after a month, more than half the organization's employeeshave signed on and acquired new laptops. Walking through the facility, you see themhappily customizing and comparing notes on their new computers, and at the end of theday, most take their laptops with them, potentially carrying personal data to their homes orother unknown locations. It's enough to give you data- protection nightmares, and you'vepointed out to the information technology Director and many others in the organization thepotential hazards of this new practice, including the inevitability of eventual data loss ortheft.Today you have in your office a representative of the organization's marketing departmentwho shares with you, reluctantly, a story with potentially serious consequences. The nightbefore, straight from work, with laptop in hand, he went to the Bull and Horn Pub to playbilliards with his friends. A fine night of sport and socializing began, with the laptop "safely"tucked on a bench, beneath his jacket. Later that night, when it was time to depart, heretrieved the jacket, but the laptop was gone. It was not beneath the bench or on anotherbench nearby. The waitstaff had not seen it. His friends were not playing a joke on him.After a sleepless night, he confirmed it this morning, stopping by the pub to talk to thecleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks atyou, embarrassed and upset.You ask him if the laptop contains any personal data from clients, and, sadly, he nods hishead, yes. He believes it contains files on about 100 clients, including names, addressesand governmental identification numbers. He sighs and places his head in his hands indespair.Which is the best way to ensure that data on personal equipment is protected?

A. User risk training. 
B. Biometric security. 
C. Encryption of the data. 
D. Frequent data backups. 

Answer: A

Show Answer

Question # 3

Read the following steps:Perform frequent data back-ups.Perform test restorations to verify integrity of backed-up data.Maintain backed-up data offline or on separate servers.These steps can help an organization recover from what

A. Phishing attacks
B. Authorization errors 
C. Ransomware attacks
D. Stolen encryption keys

Answer: c

Show Answer

Question # 4

“Collection”, “access” and “destruction” are aspects of what privacy management process?

A. The data governance strategy 
B. The breach response plan 
C. The metric life cycle 
D. The business case 

Answer: A

Show Answer

Question # 5

SCENARIOPlease use the following to answer the next QUESTION.Manasa is a product manager at Omnipresent Omnimedia, where she is responsible forleading the development of the company’s flagship product, the Handy Helper. The HandyHelper is an application that can be used in the home to manage family calendars, doonline shopping, and schedule doctor appointments.After having had a successful launch in the United States, the Handy Helper is about to bemade available for purchase worldwide.The packaging and user guide for the Handy Helper indicate that it is a “privacy friendly”product suitable for the whole family, including children, but does not provide any furtherdetail or privacy notice. In order to use the application, a family creates a single account,and the primary user has access to all information about the other users. Upon start up, theprimary user must check a box consenting to receive marketing emails from OmnipresentOmnimedia and selected marketing partners in order to be able to use the application.Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreementwith a European distributor of Handy Helper when he fielded many Questions about theproduct from the distributor. Sanjay needed to look more closely at the product in order tobe able to answer the Questions as he was not involved in the product developmentprocess.In speaking with the product team, he learned that the Handy Helper collected and storedall of a user’s sensitive medical information for the medical appointment scheduler. In fact,all of the user’s information is stored by Handy Helper for the additional purpose of creatingadditional products and to analyze usage of the product. This data is all stored in the cloudand is encrypted both during transmission and at rest.Consistent with the CEO’s philosophy that great new product ideas can come from anyone,all Omnipresent Omnimedia employees have access to user data under a program called“Eureka.” Omnipresent Omnimedia is hoping that at some point in the future, the data willreveal insights that could be used to create a fully automated application that runs onartificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-termgoal.What security controls are missing from the Eureka program?

A. Storage of medical data in the cloud is not permissible under the General DataProtection Regulation (GDPR) 
B. Data access is not limited to those who “need to know” for their role 
C. Collection of data without a defined purpose might violate the fairness principle 
D. Encryption of the data at rest prevents European users from having the right of accessand the right of portability of their data 

Answer: B

Show Answer

Question # 6

SCENARIOPlease use the following to answer the next QUESTION:Richard McAdams recently graduated law school and decided to return to the small town ofLexington, Virginia to help run his aging grandfather's law practice. The elder McAdamsdesired a limited, lighter role in the practice, with the hope that his grandson wouldeventually take over when he fully retires. In addition to hiring Richard, Mr. McAdamsemploys two paralegals, an administrative assistant, and a part-time IT specialist whohandles all of their basic networking needs. He plans to hire more employees once Richardgets settled and assesses the office's strategies for growth.Immediately upon arrival, Richard was amazed at the amount of work that needed to donein order to modernize the office, mostly in regard to the handling of clients' personal data.His first goal is to digitize all the records kept in file cabinets, as many of the documentscontain personally identifiable financial and medical data. Also, Richard has noticed themassive amount of copying by the administrative assistant throughout the day, a practicethat not only adds daily to the number of files in the file cabinets, but may create securityissues unless a formal policy is firmly in place Richard is also concerned with the overuseof the communal copier/ printer located in plain view of clients who frequent the building.Yet another area of concern is the use of the same fax machine by all of the employees.Richard hopes to reduce its use dramatically in order to ensure that personal data receivesthe utmost security and protection, and eventually move toward a strict Internet faxingpolicy by the year's end.Richard expressed his concerns to his grandfather, who agreed, that updating datastorage, data security, and an overall approach to increasing the protection of personaldata in all facets is necessary Mr. McAdams granted him the freedom and authority to doso. Now Richard is not only beginning a career as an attorney, but also functioning as theprivacy officer of the small firm. Richard plans to meet with the IT employee thefollowing day, to get insight into how the office computer system is currently set-up andmanaged.Richard believes that a transition from the use of fax machine to Internet faxing provides allof the following security benefits EXCEPT?

A. Greater accessibility to the faxes at an off-site location. 
B. The ability to encrypt the transmitted faxes through a secure server. 
C. Reduction of the risk of data being seen or copied by unauthorized personnel. 
D. The ability to store faxes electronically, either on the user's PC or a password-protectednetwork server. 

Answer: A

Show Answer

Question # 7

Which of the following is NOT a type of privacy program metric? 

A. Business enablement metrics. 
B. Data enhancement metrics. 
C. Value creation metrics. 
D. Risk-reduction metrics. 

Answer: c

Show Answer

Question # 8

An organization's business continuity plan or disaster recovery plan does NOT typicallyinclude what?

A. Recovery time objectives. 
B. Emergency response guidelines. 
C. Statement of organizational responsibilities. 
D. Retention schedule for storage and destruction of information. 

Answer: D

Show Answer