IAPP CIPM Practice Test - Questions Answers, Page 14
Question list
Related questions
How do privacy audits differ from privacy assessments?
They are non-binding.
They are evidence-based.
They are based on standards.
They are conducted by external parties.
An organization's internal audit team should do all of the following EXCEPT?
Implement processes to correct audit failures.
Verify that technical measures are in place.
Review how operations work in practice.
Ensure policies are being adhered to.
''Respond'' in the privacy operational lifecycle includes which of the following?
Information security practices and functional area integration.
Privacy awareness training and compliance monitoring.
Communication to stakeholders and alignment to laws.
Information requests and privacy rights requests.
If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?
Carry out a root cause analysis on each breach to understand why the incident happened.
Communicate to everyone that breaches must be reported and how they should be reported.
Provide role-specific training to areas where breaches are happening so they are more aware.
Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt.
Which of the following information must be provided by the data controller when complying with GDPR ''right to be informed'' requirements?
The purpose of personal data processing.
The data subject's right to withdraw consent
The contact details of the Data Protection Officer (DPO).
The name of any organizations with whom personal data was shared.
If done correctly, how can a Data Protection Impact Assessment (DPIA) create a win/win scenario for organizations and individuals?
By quickly identifying potentially problematic data attributes and reducing the risk exposure.
By allowing Data Controllers to solicit feedback from individuals about how they feel about the potential data processing.
By enabling Data Controllers to be proactive in their analysis of processing activities and ensuring compliance with the law.
By better informing about the risks associated with the processing activity and improving the organization's transparency with individuals.
Which of the following is NOT recommended for effective Identity Access Management?
Demographics.
Unique user IDs.
User responsibility.
Credentials (e.g.. password).
You would like to better understand how your organization can demonstrate compliance with international privacy standards and identify gaps for remediation. What steps could you take to achieve this objective?
Carry out a second-party audit.
Consult your local privacy regulator.
Conduct an annual self assessment.
Engage a third-party to conduct an audit.
If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?
Review reporting activity on breaches to understand when incidents are being reported and when they are not to improve communication and training.
Improve communication to reinforce to everyone that breaches must be reported and how they should be reported.
Provide role-specific training to areas where breaches are happening so they are more aware.
Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt.
A systems audit uncovered a shared drive folder containing sensitive employee data with no access controls and therefore was available for all employees to view. What is the first step to mitigate further risks?
Notify all employees whose information was contained in the file.
Check access logs to see who accessed the folder.
Notify legal counsel of a privacy incident.
Restrict access to the folder.
Question