Quiz IT certification exam

Question 1

The Video Privacy Protection Act of 1988 restricted which of the following?

Accepted Answer

Which purchase records of audio visual materials may be disclosed

Answer

When downloading of copyrighted audio visual materials is allowed

Answer

When a user's viewing of online video content can be monitored

Answer

Who advertisements for videos and video games may target

Question 2

The Cable Communications Policy Act of 1984 requires which activity?

Accepted Answer

Delivery of an annual notice detailing how subscriber information is to be used

Answer

Destruction of personal information a maximum of six months after it is no longer needed

Answer

Notice to subscribers of any investigation involving unauthorized reception of cable services

Answer

Obtaining subscriber consent for disseminating any personal information necessary to render cable services

Question 3

What is the main purpose of requiring marketers to use the Wireless Domain Registry?

Accepted Answer

To prevent unauthorized emails to mobile devices

Answer

To access a current list of wireless domain names

Answer

To acquire authorization to send emails to mobile devices

Answer

To ensure their emails are sent to actual wireless subscribers

Question 4

SCENARIOPlease use the following to answer the next QUESTION:You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A.  HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo's business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth's security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals -- ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual's ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient's attorney has submitted a discovery request for the ePHI exposed in the breach. What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might impose a penalty on HealthCo?

Accepted Answer

Because HealthCo did not conduct due diligence to verify or monitor CloudHealth's security measures

Answer

Because HealthCo did not require CloudHealth to implement appropriate physical and administrative measures to safeguard the ePHI

Answer

Because HIPAA requires the imposition of a fine if a data breach of this magnitude has occurred

Answer

Because CloudHealth violated its contract with HealthCo by not encrypting the ePHI

Question 5

Which jurisdiction must courts have in order to hear a particular case?

Accepted Answer

Personal jurisdiction and subject matter jurisdiction

Answer

Subject matter jurisdiction and regulatory jurisdiction

Answer

Subject matter jurisdiction and professional jurisdiction

Answer

Personal jurisdiction and professional jurisdiction

Question 6

Which authority supervises and enforces laws regarding advertising to children via the Internet?

Accepted Answer

The Federal Trade Commission

Answer

The Office for Civil Rights

Answer

The Federal Communications Commission

Answer

The Department of Homeland Security

Question 7

According to Section 5 of the FTC Act, self-regulation primarily involves a company's right to do what?

Accepted Answer

Adhere to its industry's code of conduct

Answer

Determine which bodies will be involved in adjudication

Answer

Decide if any enforcement actions are justified

Answer

Appeal decisions made against it

Question 8

Which was NOT one of the five priority areas listed by the Federal Trade Commission in its 2012 report, ''Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers''?

Accepted Answer

Do Not Track

Answer

International data transfers

Answer

Large platform providers

Answer

Promoting enforceable self-regulatory codes

Question 9

The ''Consumer Privacy Bill of Rights'' presented in a 2012 Obama administration report is generally based on?

Accepted Answer

Traditional fair information practices

Answer

The 1974 Privacy Act

Answer

Common law principles

Answer

European Union Directive

Question 10

What is a legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party called?

Accepted Answer

A consent decree

Answer

Stare decisis decree

Answer

A judgment rider

Answer

Common law judgment

Question 11

Read this notice:Our website uses cookies. Cookies allow us to identify the computer or device you're using to access the site, but they don't identify you personally. For instructions on setting your Web browser to refuse cookies, click here.What type of legal choice does not notice provide?

Accepted Answer

Implied consent

Answer

Mandatory

Answer

Opt-in

Answer

Opt-out

Question 12

SCENARIOPlease use the following to answer the next QUESTION:Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.What is the best reason for Cheryl to follow Janice's suggestion about classifying customer data?

Accepted Answer

It will increase the security of customers' personal information (PI)

Answer

It will help employees stay better organized

Answer

It will help the company meet a federal mandate

Answer

It will prevent the company from collecting too much personal information (PI)

Question 13

SCENARIOPlease use the following to answer the next QUESTION:Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.What is the most likely risk of Fitness Coach, Inc. adopting Janice's first draft of the privacy policy?

Accepted Answer

Leaving the company susceptible to violations by setting unrealistic goals

Answer

Failing to meet the needs of customers who are concerned about privacy

Answer

Showing a lack of trust in the organization's privacy practices

Answer

Not being in standard compliance with applicable laws

Question 14

SCENARIOPlease use the following to answer the next QUESTION:Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.What is the main problem with Cheryl's suggested method of communicating the new privacy policy?

Accepted Answer

The policy might not be implemented consistency across departments.

Answer

The policy would not be considered valid if not communicated in full.

Answer

Employees would not be comfortable with a policy that is put into action over time.

Answer

Employees might not understand how the documents relate to the policy as a whole.

Question 15

SCENARIOPlease use the following to answer the next QUESTION:Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals realize their physical fitness goals through classes, individual instruction, and access to an extensive indoor gym. She has owned the company for ten years and has always been concerned about protecting customer's privacy while maintaining the highest level of service. She is proud that she has built long-lasting customer relationships.Although Cheryl and her staff have tried to make privacy protection a priority, the company has no formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and was concerned about the many changes the policy would bring throughout the company. For example, the draft policy stipulates that a customer's personal information can only be held for one year after paying for a service such as a session with personal trainer. It also promises that customer information will not be shared with third parties without the written consent of the customer. The wording of these rules worry Cheryl since stored personal information often helps her company to serve her customers, even if there are long pauses between their visits. In addition, there are some third parties that provide crucial services, such as aerobics instructors who teach classes on a contract basis. Having access to customer files and understanding the fitness levels of their students helps instructors to organize their classes.Janice understood Cheryl's concerns and was already formulating some ideas for revision. She tried to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying data and treating each type differently would cause undue difficulties in the company's day-to-day operations. Cheryl wants one simple data storage and access system that any employee can access if needed.Even though the privacy policy was only a draft, she was beginning to see that changes within her company were going to be necessary. She told Janice that she would be more comfortable with implementing the new policy gradually over a period of several months, one department at a time. She was also interested in a layered approach by creating documents listing applicable parts of the new policy for each department.Based on the scenario, which of the following would have helped Janice to better meet the company's needs?

Accepted Answer

Spending more time understanding the company's information goals

Answer

Creating a more comprehensive plan for implementing a new policy

Answer

Explaining the importance of transparency in implementing a new policy

Answer

Removing the financial burden of the company's employee training program

Question 16

According to the FTC Report of 2012, what is the main goal of Privacy by Design?

Accepted Answer

Incorporating privacy protections throughout the development process

Answer

Obtaining consumer consent when collecting sensitive data for certain purposes

Answer

Establishing a system of self-regulatory codes for mobile-related services

Answer

Implementing a system of standardization for privacy notices

Question 17

What is the main reason some supporters of the European approach to privacy are skeptical about self- regulation of privacy practices?

Accepted Answer

Industries may not be strict enough in the creation and enforcement of rules

Answer

A large amount of money may have to be sent on improved technology and security

Answer

A new business owner may not understand the regulations

Answer

Human rights may be disregarded for the sake of privacy

Question 18

What is the main purpose of the Global Privacy Enforcement Network?

Accepted Answer

To promote universal cooperation among privacy authorities

Answer

To investigate allegations of privacy violations internationally

Answer

To protect the interests of privacy consumer groups worldwide

Answer

To arbitrate disputes between countries over jurisdiction for privacy laws

Question 19

In 2014, Google was alleged to have violated the Family Educational Rights and Privacy Act (FERPA) through its Apps for Education suite of tools. For what specific practice did students sue the company?

Accepted Answer

Scanning emails sent to and received by students

Answer

Making student education records publicly available

Answer

Relying on verbal consent for a disclosure of education records

Answer

Disclosing education records without obtaining required consent

Question 20

Which venture would be subject to the requirements of Section 5 of the Federal Trade Commission Act?

Accepted Answer

An online merchant's free shipping offer

Answer

A local nonprofit charity's fundraiser

Answer

A national bank's no-fee checking promotion

Answer

A city bus system's frequent rider program

Question 21

An organization self-certified under Privacy Shield must, upon request by an individual, do what?

Accepted Answer

Provide the identities of third parties with whom the organization shares personal information.

Answer

Suspend the use of all personal information collected by the organization to fulfill its original purpose.

Answer

Provide the identities of third and fourth parties that may potentially receive personal information.

Answer

Identify all personal information disclosed during a criminal investigation.

Question 22

Which of the following federal agencies does NOT enforce the Disposal Rule under the Fair and Accurate Credit Transactions Act (FACTA)?

Accepted Answer

The Department of Health and Human Services

Answer

The Office of the Comptroller of the Currency

Answer

The Consumer Financial Protection Bureau

Answer

The Federal Trade Commission

Question 23

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.At this stage of the investigation, what should the data privacy leader review first?

Accepted Answer

Available data flow diagrams

Answer

The text of the original complaint

Answer

The company's data privacy policies

Answer

Prevailing regulation on this subject

Question 24

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.Upon review, the data privacy leader discovers that the Company's documented data inventory is obsolete. What is the data privacy leader's next best source of information to aid the investigation?

Accepted Answer

Interviews with key marketing personnel

Answer

Reports on recent purchase histories

Answer

Database schemas held by the retailer

Answer

Lists of all customers, sorted by country

Question 25

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?

Accepted Answer

As a data processor

Answer

As a data supervisor

Answer

As a data controller

Answer

As a data manager

Question 26

SCENARIOPlease use the following to answer the next QUESTION:A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.Under the GDPR, the complainant's request regarding her personal information is known as what?

Accepted Answer

Right to Be Forgotten

Answer

Right of Access

Answer

Right of Removal

Answer

Right of Rectification

Question 27

In which situation would a policy of ''no consumer choice'' or ''no option'' be expected?

Accepted Answer

When a customer's financial information is requested by the government

Answer

When a job applicant's credit report is provided to an employer

Answer

When a patient's health record is made available to a pharmaceutical company

Answer

When a customer's street address is shared with a shipping company

Question 28

What is the main challenge financial institutions face when managing user preferences?

Accepted Answer

Ensuring that preferences are applied consistently across channels and platforms

Answer

Ensuring they are in compliance with numerous complex state and federal privacy laws

Answer

Developing a mechanism for opting out that is easy for their consumers to navigate

Answer

Determining the legal requirements for sharing preferences with their affiliates

Question 29

A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?

Accepted Answer

The vendor's employee retention rates

Answer

The vendor's reputation

Answer

The vendor's financial health

Answer

The vendor's employee training program

Question 30

In which situation is a company operating under the assumption of implied consent?

Accepted Answer

An employer contacts the professional references provided on an applicant's resume

Answer

An online retailer subscribes new customers to an e-mail list by default

Answer

A landlord uses the information on a completed rental application to run a credit report

Answer

A retail clerk asks a customer to provide a zip code at the check-out counter

Question 31

All of the following are tasks in the ''Discover'' phase of building an information management program EXCEPT?

Accepted Answer

Developing a process for review and update of privacy policies

Answer

Facilitating participation across departments and levels

Answer

Deciding how aggressive to be in the use of personal information

Answer

Understanding the laws that regulate a company's collection of information

Question 32

Which of the following describes the most likely risk for a company developing a privacy policy with standards that are much higher than its competitors?

Accepted Answer

Being more closely scrutinized for any breaches of policy

Answer

Getting accused of discriminatory practices

Answer

Attracting skepticism from auditors

Answer

Having a security system failure

Question 33

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an agent, the organization must ensure the third party does all of the following EXCEPT?

Accepted Answer

Enters a contract with the organization that states the third party will process data according to the consent agreement

Answer

Uses the transferred data for limited purposes

Answer

Provides the same level of privacy protection as the organization

Answer

Notifies the organization if it can no longer meet its requirements for proper data handling

Question 34

What was the original purpose of the Federal Trade Commission Act?

Accepted Answer

To enforce antitrust laws

Answer

To ensure privacy rights of U.S. citizens

Answer

To protect consumers

Answer

To negotiate consent decrees with companies violating personal privacy

Question 35

SCENARIOPlease use the following to answer the next QUESTION:Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.''No,'' the boy said. ''I'm filling out a survey.''Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.Based on the incident, the FTC's enforcement actions against the marketer would most likely include what violation?

Accepted Answer

Collecting information from a child under the age of thirteen.

Answer

Intruding upon the privacy of a family with young children.

Answer

Failing to notify of a breach of children's private information.

Answer

Disregarding the privacy policy of the children's marketing industry.

Question 36

SCENARIOPlease use the following to answer the next QUESTION:Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.''No,'' the boy said. ''I'm filling out a survey.''Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.How does Matt come to the decision to report the marketer's activities?

Accepted Answer

The marketer seems to have distributed his son's information without Matt's permission

Answer

The marketer failed to make an adequate attempt to provide Matt with information

Answer

The marketer did not provide evidence that the prize books were appropriate for children

Answer

The marketer failed to identify himself and indicate the purpose of the messages

Question 37

SCENARIOPlease use the following to answer the next QUESTION:Matt went into his son's bedroom one evening and found him stretched out on his bed typing on his laptop. ''Doing your network?'' Matt asked hopefully.''No,'' the boy said. ''I'm filling out a survey.''Matt looked over his son's shoulder at his computer screen. ''What kind of survey?'' ''It's asking Questions about my opinions.''''Let me see,'' Matt said, and began reading the list of Questions that his son had already answered. ''It's asking your opinions about the government and citizenship. That's a little odd. You're only ten.''Matt wondered how the web link to the survey had ended up in his son's email inbox. Thinking the message might have been sent to his son by mistake he opened it and read it. It had come from an entity called the Leadership Project, and the content and the graphics indicated that it was intended for children. As Matt read further he learned that kids who took the survey were automatically registered in a contest to win the first book in a series about famous leaders.To Matt, this clearly seemed like a marketing ploy to solicit goods and services to children. He asked his son if he had been prompted to give information about himself in order to take the survey. His son told him he had been asked to give his name, address, telephone number, and date of birth, and to answer Questions about his favorite games and toys.Matt was concerned. He doubted if it was legal for the marketer to collect information from his son in the way that it was. Then he noticed several other commercial emails from marketers advertising products for children in his son's inbox, and he decided it was time to report the incident to the proper authorities.How could the marketer have best changed its privacy management program to meet COPPA ''Safe Harbor'' requirements?

Accepted Answer

By participating in an approved self-regulatory program

Answer

By receiving FTC approval for the content of its emails

Answer

By making a COPPA privacy notice available on website

Answer

By regularly assessing the security risks to consumer privacy

Question 38

What important action should a health care provider take if the she wants to qualify for funds under the Health Information Technology for Economic and Clinical Health Act (HITECH)?

Accepted Answer

Make electronic health records (EHRs) part of regular care

Answer

Bill the majority of patients electronically for their health care

Answer

Send health information and appointment reminders to patients electronically

Answer

Keep electronic updates about the Health Insurance Portability and Accountability Act

Question 39

All of the following organizations are specified as covered entities under the Health Insurance Portability and Accountability Act (HIPAA) EXCEPT?

Accepted Answer

Healthcare providers

Answer

Healthcare information clearinghouses

Answer

Pharmaceutical companies

Answer

Health plans

Question 40

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

Accepted Answer

Medical providers

Answer

Department of Health and Human Services

Answer

The affected individuals

Answer

The local media

IAPP CIPP-US Practice Test 1

IAPP CIPP-US Practice Tests