CIPA Cheat Sheet 2026

The 30 highest-yield CIPA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A client receives an email asking them to verify their bank account details via a link. What type of attack is this? → Phishing
2. What is the PRIMARY purpose of obtaining CIPA certification in Certified Identity Protection Advisor? → To demonstrate verified competency and adherence to professional standards
3. What is the principle of least privilege? → Users receive access as needed for their role
4. What is account monitoring as a component of identity protection services? → Continuously scanning accounts and credit files for suspicious activity or changes
5. What is 'tax identity theft' and which agency handles related complaints? → Filing a fraudulent tax return using a victim's SSN to claim a refund; reported to the IRS
6. A CIPA candidate is reviewing a client's EOB (Explanation of Benefits) statement for signs of medical identity theft. Which finding is a RED FLAG? → Claims for services at a provider in a city where the client has never received treatment
7. What is key point 5 in Client Education & Protection Strategies? → Option B
8. What psychological principle do social engineers MOST commonly exploit to gain compliance? → Authority and urgency
9. What is the PRIMARY purpose of obtaining CIPA certification in Certified Identity Protection Advisor? → To demonstrate verified competency and adherence to professional standards
10. Under PCI DSS, what is the maximum number of days that audit logs must be retained? → 1 year
11. Which red flag is MOST commonly associated with a phishing email? → The email creates urgency and requests immediate action on personal data
12. Which federal law mandates that financial institutions implement safeguards to protect customer financial information and deliver privacy notices? → GLBA
13. Which US law specifically regulates the accuracy, fairness, and privacy of information in consumer credit reporting files? → FCRA
14. A client asks about the 'dark web.' What is the MOST accurate description to provide? → An encrypted portion of the internet where stolen data is frequently bought and sold
15. What is key point 7 in Fraud Detection Techniques & Reporting? → Option B
16. Which regulation focuses on protecting consumer privacy in the US? → CCPA
17. Which type of attack involves an adversary secretly intercepting communications between two parties to steal identity data? → Man-in-the-middle (MITM) attack
18. What is the first step in assessing identity theft risk? → Identifying personal data and its exposure
19. In CIPA practice, what happens when regulations are updated? → Professionals must update knowledge and practices to meet new requirements
20. How frequently should ongoing assessments be conducted in Certified Identity Protection Advisor practice? → At regular intervals and as conditions change
21. Which practice best helps clients minimize exposure of personally identifiable information (PII) on social media? → Reviewing privacy settings and limiting personal details shared publicly
22. In a risk assessment for a recently divorced client, which asset deserves IMMEDIATE identity theft protection attention? → Joint credit accounts that have not yet been separated
23. When assessing risk for elderly clients, which vulnerability is MOST unique to their demographic? → Higher likelihood of being targeted by trusted family or caregivers
24. A client who owns rental properties asks about risks specific to their situation. Which identity theft risk is MOST elevated for landlords? → The landlord's address appearing in public property records linked to multiple people
25. Why should clients be cautious about using public Wi-Fi networks for sensitive transactions? → Attackers can intercept unencrypted data transmitted over unsecured networks
26. What is the MOST important factor when selecting assessment tools for CIPA certification work? → Validity, reliability, and appropriateness for the specific context
27. Velocity checks in fraud detection systems are primarily designed to flag: → An unusually high number of transactions in a short time period
28. What is key point 1 in Client Education & Protection Strategies? → Option B
29. Which concept ensures that a user or system is granted only the minimum level of access necessary to perform their job function? → Principle of least privilege
30. A client reuses the same password across multiple websites. What is the primary identity theft risk this creates? → Credential stuffing attacks