Ask Question
IAPP CIPM Practice Test - Questions Answers
Question list
List of questions
Related questions
Question 1
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop 'safely' tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
Which is the best way to ensure that data on personal equipment is protected?
User risk training.
Biometric security.
Encryption of the data.
Frequent data backups.
Explanation:
Encryption of the data is the best way to ensure that data on personal equipment is protected, as it prevents unauthorized access to the data even if the equipment is lost or stolen. Encryption is the process of transforming data into an unreadable format that can only be decrypted with a valid key or password. Encryption can be applied to the entire device, a specific folder or file, or a removable storage media.Encryption is one of the most effective technical safeguards for data protection and is recommended by many privacy laws and standards.Reference: IAPP CIPM Study Guide, page 831; ISO/IEC 27002:2013, section 10.1.1
Question 2
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop 'safely' tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
From a business standpoint, what is the most productive way to view employee use of personal equipment for work-related tasks?
The use of personal equipment is a cost-effective measure that leads to no greater security risks than are always present in a modern organization.
Any computer or other equipment is company property whenever it is used for company business.
While the company may not own the equipment, it is required to protect the business-related data on any equipment used by its employees.
The use of personal equipment must be reduced as it leads to inevitable security risks.
Explanation:
This answer reflects the principle of accountability, which states that the company is responsible for ensuring that personal data is processed in compliance with applicable laws and regulations, regardless of who owns or controls the equipment that stores or processes the data. The company should establish policies and procedures for managing the use of personal equipment for work-related tasks, such as requiring encryption, authentication, remote wipe, backup and reporting of incidents.The company should also provide training and awareness to the employees on how to protect the data on their personal equipment and what are their obligations and liabilities.Reference: IAPP CIPM Study Guide, page 841; ISO/IEC 27002:2013, section 6.2.1
Question 3
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop 'safely' tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
In order to determine the best course of action, how should this incident most productively be viewed?
As the accidental loss of personal property containing data that must be restored.
As a potential compromise of personal information through unauthorized access.
As an incident that requires the abrupt initiation of a notification campaign.
As the premeditated theft of company data, until shown otherwise.
Explanation:
This answer recognizes the risk of data breach that may result from the loss of the laptop, as it may expose the personal information of the clients to unauthorized or unlawful processing. A data breach is defined as a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. A data breach may have serious consequences for the individuals whose data is compromised, such as identity theft, fraud, discrimination, financial loss or reputational damage. Therefore, it is important to view this incident as a potential compromise of personal information and take appropriate measures to contain, assess and mitigate the impact of the breach.Reference: IAPP CIPM Study Guide, page 86; ISO/IEC 27002:2013, section 16.1.1
Question 4
SCENARIO
Please use the following to answer the next QUESTION:
It's just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It's a great deal, and after a month, more than half the organization's employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It's enough to give you data- protection nightmares, and you've pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.
Today you have in your office a representative of the organization's marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop 'safely' tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.
You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.
What should you do first to ascertain additional information about the loss of data?
Interview the person reporting the incident following a standard protocol.
Call the police to investigate even if you are unsure a crime occurred.
Investigate the background of the person reporting the incident.
Check company records of the latest backups to see what data may be recoverable.
Explanation:
This answer is the best way to ascertain additional information about the loss of data, as it allows you to gather relevant facts and details from the person who witnessed or experienced the incident. A standard protocol for interviewing the person reporting the incident should include questions such as:
When and where did the incident occur?
What type and amount of data was involved?
How was the data stored or protected on the laptop?
Who else had access to or knowledge of the laptop or the data?
What actions have been taken so far to recover or secure the laptop or the data?
How did you discover or report the incident?
Do you have any evidence or clues about who may have taken or accessed the laptop or the data?
Do you have any other information that may be relevant or helpful for the investigation? Interviewing the person reporting the incident following a standard protocol can help you to establish a clear timeline and scope of the incident, identify potential sources of evidence, assess the level of risk and harm to the individuals and the organization, and determine the next steps for responding to and resolving the incident.Reference: IAPP CIPM Study Guide, page 87; ISO/IEC 27002:2013, section 16.1.4
Question 5
Which is NOT an influence on the privacy environment external to an organization?
Management team priorities.
Regulations.
Consumer demand.
Technological advances.
Explanation:
The privacy environment external to an organization refers to the factors that are outside the control of the organization, such as regulations, consumer demand, technological advances, and social norms. These factors can affect the organization's privacy practices and policies, and require the organization to adapt and comply. Management team priorities are an internal factor that influence the privacy environment within the organization, as they reflect the organization's vision, mission, values, and goals.Reference:CIPM Study Guide, page 14.
Question 6
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. 'It's going to be great,' the developer, Deidre Hoffman, tells you, 'if, that is, we actually get it working!' She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. 'It's just three young people,' she says, 'but they do great work.' She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. 'They do good work, so I chose them.'
Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, 'I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!'
Which is the best first step in understanding the data security practices of a potential vendor?
Requiring the vendor to complete a questionnaire assessing International Organization for Standardization (ISO) 27001 compliance.
Conducting a physical audit of the vendor's facilities.
Conducting a penetration test of the vendor's data security structure.
Examining investigation records of any breaches the vendor has experienced.
Explanation:
This answer is the best first step in understanding the data security practices of a potential vendor, as it can provide a quick and easy way to evaluate the vendor's alignment with a widely recognized and respected standard for information security management systems (ISMS). Requiring the vendor to complete a questionnaire assessing ISO 27001 compliance can help you to obtain relevant and consistent information about the vendor's data security policies, objectives, risks, controls, processes and performance. The questionnaire can also help you to compare different vendors based on their level of compliance and identify any areas that need further clarification or verification.Reference: IAPP CIPM Study Guide, page 82; ISO/IEC 27002:2013, section 15.1.2
Question 7
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. 'It's going to be great,' the developer, Deidre Hoffman, tells you, 'if, that is, we actually get it working!' She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. 'It's just three young people,' she says, 'but they do great work.' She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. 'They do good work, so I chose them.'
Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, 'I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!'
What safeguard can most efficiently ensure that privacy protection is a dimension of relationships with vendors?
Include appropriate language about privacy protection in vendor contracts.
Perform a privacy audit on any vendor under consideration.
Require that a person trained in privacy protection be part of all vendor selection teams.
Do business only with vendors who are members of privacy trade associations.
Explanation:
This answer is the best way to ensure that privacy protection is a dimension of relationships with vendors, as it can establish clear and binding terms and conditions for both parties regarding their roles and responsibilities for data processing activities. Including appropriate language about privacy protection in vendor contracts can help to define the scope, purpose, duration and type of data processing, as well as the rights and obligations of both parties. The contracts can also specify the technical and organizational measures that the vendor must implement to protect the data from unauthorized or unlawful access, use, disclosure, alteration or destruction, and to notify the organization of any security incidents or breaches. The contracts can also allow the organization to monitor, audit or inspect the vendor's performance and compliance with the contract terms and applicable laws and regulations.Reference: IAPP CIPM Study Guide, page 82; ISO/IEC 27002:2013, section 15.1.2
Question 8
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. 'It's going to be great,' the developer, Deidre Hoffman, tells you, 'if, that is, we actually get it working!' She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. 'It's just three young people,' she says, 'but they do great work.' She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. 'They do good work, so I chose them.'
Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, 'I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!'
You want to point out that normal protocols have NOT been followed in this matter. Which process in particular has been neglected?
Forensic inquiry.
Data mapping.
Privacy breach prevention.
Vendor due diligence vetting.
Explanation:
This answer is the best way to point out that normal protocols have not been followed in this matter, as it shows that the vendor selection process was not conducted properly and that the vendor's privacy and security practices were not assessed or verified before engaging them for the app development project. Vendor due diligence vetting is a process that involves evaluating and comparing potential vendors based on their qualifications, capabilities, reputation, experience, performance and compliance with the organization's standards and expectations, as well as the applicable laws and regulations. Vendor due diligence vetting can help to ensure that the vendor can deliver the project on time, on budget and on quality, as well as protect the personal data that they process on behalf of the organization.Vendor due diligence vetting can also help to identify and mitigate any risks or issues that may arise from the vendor relationship, such as data breaches, legal actions, fines, sanctions or investigations.Reference: IAPP CIPM Study Guide, page 821; ISO/IEC 27002:2013, section 15.1.1
Question 9
SCENARIO
Please use the following to answer the next QUESTION:
Edufox has hosted an annual convention of users of its famous e-learning software platform, and over time, it has become a grand event. It fills one of the large downtown conference hotels and overflows into the others, with several thousand attendees enjoying three days of presentations, panel discussions and networking. The convention is the centerpiece of the company's product rollout schedule and a great training opportunity for current users. The sales force also encourages prospective clients to attend to get a better sense of the ways in which the system can be customized to meet diverse needs and understand that when they buy into this system, they are joining a community that feels like family.
This year's conference is only three weeks away, and you have just heard news of a new initiative supporting it: a smartphone app for attendees. The app will support late registration, highlight the featured presentations and provide a mobile version of the conference program. It also links to a restaurant reservation system with the best cuisine in the areas featured. 'It's going to be great,' the developer, Deidre Hoffman, tells you, 'if, that is, we actually get it working!' She laughs nervously but explains that because of the tight time frame she'd been given to build the app, she outsourced the job to a local firm. 'It's just three young people,' she says, 'but they do great work.' She describes some of the other apps they have built. When asked how they were selected for this job, Deidre shrugs. 'They do good work, so I chose them.'
Deidre is a terrific employee with a strong track record. That's why she's been charged to deliver this rushed project. You're sure she has the best interests of the company at heart, and you don't doubt that she's under pressure to meet a deadline that cannot be pushed back. However, you have concerns about the app's handling of personal data and its security safeguards. Over lunch in the break room, you start to talk to her about it, but she quickly tries to reassure you, 'I'm sure with your help we can fix any security issues if we have to, but I doubt there'll be any. These people build apps for a living, and they know what they're doing. You worry too much, but that's why you're so good at your job!'
You see evidence that company employees routinely circumvent the privacy officer in developing new initiatives.
How can you best draw attention to the scope of this problem?
Insist upon one-on-one consultation with each person who works around the privacy officer.
Develop a metric showing the number of initiatives launched without consultation and include it in reports, presentations, and consultation.
Hold discussions with the department head of anyone who fails to consult with the privacy officer.
Take your concerns straight to the Chief Executive Officer.
Explanation:
This answer is the best way to draw attention to the scope of this problem, as it can provide quantitative and objective evidence of how often the privacy officer is bypassed or ignored in the organization's data processing activities. Developing a metric showing the number of initiatives launched without consultation can help to measure and monitor the level of compliance and alignment with the organization's privacy program and policies, as well as the applicable laws and regulations. Including this metric in reports, presentations and consultation can help to communicate and raise awareness of this problem among the relevant stakeholders, such as senior management, project managers, developers or vendors.It can also help to demonstrate the value and importance of involving the privacy officer in the early stages of any initiative that involves personal data, as well as the potential consequences and risks of not doing so.Reference: IAPP CIPM Study Guide, page 891; ISO/IEC 27002:2013, section 18.1.3
Question 10
What is one obligation that the General Data Protection Regulation (GDPR) imposes on data processors?
To honor all data access requests from data subjects.
To inform data subjects about the identity and contact details of the controller.
To implement appropriate technical and organizational measures that ensure an appropriate level of security.
To carry out data protection impact assessments in cases where processing is likely to result in high risk to the rights and freedoms of individuals.
Explanation:
The GDPR imposes several obligations on data processors, such as maintaining records of processing activities, cooperating with supervisory authorities, and notifying data controllers of personal data breaches. One of these obligations is to implement appropriate technical and organizational measures that ensure an appropriate level of security for the personal data processed on behalf of the data controller.This is stated in Article 28(1) and Article 32 of the GDPR1. The other options are not obligations of data processors under the GDPR, but rather of data controllers or joint responsibilities of both parties.Reference:GDPR
Question