CIPM Certified Information Privacy Manager Exam — Questions and Answers

Question 1: What is the primary role of a Data Protection Officer (DPO) in an organization's privacy risk management program?

To approve all data processing contracts
To advise on and monitor compliance with data protection laws and serve as a contact point for supervisory authorities (Correct answer)
To manage the organization's incident response team
To conduct technical security penetration tests

Correct answer: To advise on and monitor compliance with data protection laws and serve as a contact point for supervisory authorities

Under GDPR Article 39, the DPO's tasks include informing and advising the controller and processors, monitoring compliance, advising on DPIAs, and cooperating with supervisory authorities.

Question 2: What is the primary objective of privacy operations in Certified Information Privacy Manager?

To ensure competence and proficiency in core privacy operations concepts (Correct answer)
To limit access to the profession
To replace practical experience entirely
To generate revenue for testing organizations

Correct answer: To ensure competence and proficiency in core privacy operations concepts

The primary objective of privacy operations knowledge is to ensure practitioners have the competence and proficiency needed to perform effectively and safely in their professional roles.

Question 3: When a data breach incident has occurred. the first priority is to determine?

When the breach occurred.
Who caused the breach.
How the breach occurred.
How to contain the breach. (Correct answer)

Correct answer: How to contain the breach.

When a data breach incident has occurred, the first priority is to determine how to contain the breach. Containment means stopping or minimizing the further loss or unauthorized disclosure of personal data, as well as preserving evidence for investigation and remediation. Containment may involve isolating affected systems, devices, or networks; changing access credentials; blocking malicious IP addresses; or notifying relevant parties such as law enforcement or security experts. After containing the breach, the next steps are to assess the impact and severity of the breach, notify the affected individuals and authorities if required, evaluate the causes and risks of the breach, and implement measures to prevent future breaches.

Question 4: What is a "control group" in Certified Information Privacy Manager research?

The group that receives the experimental treatment
A group of researchers overseeing the study
A group that does not receive the experimental treatment, serving as a baseline comparison (Correct answer)
The largest group in any experiment

Correct answer: A group that does not receive the experimental treatment, serving as a baseline comparison

The control group does not receive the experimental treatment or intervention, providing a baseline against which the experimental group's results can be compared to determine the effect of the treatment.

Question 5: Which GDPR right enables data subjects to challenge decisions made solely by automated processing that significantly affects them?

Right to portability
Right not to be subject to automated decision-making (Correct answer)
Right to restriction
Right to erasure

Correct answer: Right not to be subject to automated decision-making

GDPR Article 22 provides data subjects the right to not be subject to solely automated decisions that significantly affect them, including profiling.

Question 6: In Certified Information Privacy Manager, what is the primary purpose of formative assessment?

To assign final grades at the end of a program
To determine eligibility for advancement only
To monitor progress and provide feedback during the learning or development process (Correct answer)
To rank individuals against each other

Correct answer: To monitor progress and provide feedback during the learning or development process

Formative assessment is conducted during the process to monitor progress, identify areas needing improvement, and provide timely feedback that can guide adjustments.

Question 7: What is a rubric used for in Certified Information Privacy Manager assessment?

To record attendance data
To define criteria and performance levels for evaluating work quality (Correct answer)
To schedule assessment dates
To calculate statistical averages

Correct answer: To define criteria and performance levels for evaluating work quality

A rubric is a scoring guide that defines specific criteria and describes performance levels for each criterion, providing consistent and transparent evaluation standards.

Question 8: In Certified Information Privacy Manager, what are the fundamental principles of privacy by design?

Only color and size considerations
Speed of completion and cost efficiency
Using as many elements as possible
Balance, contrast, emphasis, movement, pattern, rhythm, and unity (Correct answer)

Correct answer: Balance, contrast, emphasis, movement, pattern, rhythm, and unity

The fundamental principles of design include balance, contrast, emphasis, movement, pattern, rhythm, and unity, which work together to create visually effective and functional compositions.

Question 9: What is the primary objective of monitoring and auditing in Certified Information Privacy Manager?

To ensure competence and proficiency in core monitoring and auditing concepts (Correct answer)
To generate revenue for testing organizations
To replace practical experience entirely
To limit access to the profession

Correct answer: To ensure competence and proficiency in core monitoring and auditing concepts

The primary objective of monitoring and auditing knowledge is to ensure practitioners have the competence and proficiency needed to perform effectively and safely in their professional roles.

Question 10: Under GDPR, can consent be used as a valid legal basis when there is a significant power imbalance between controller and data subject?

Only if the arrangement is approved in advance by a supervisory authority
Yes, as long as it is properly documented
Yes, if the data subject signs a formal written agreement
No, because consent cannot be considered freely given in such situations (Correct answer)

Correct answer: No, because consent cannot be considered freely given in such situations

When a clear power imbalance exists, such as between an employer and employee, consent is generally not considered freely given and thus is not a valid legal basis.

Question 11: Under the GDPR's storage limitation principle, personal data should be:

Stored in encrypted form indefinitely as encryption satisfies the requirement
Kept in a form that permits identification no longer than necessary (Correct answer)
Deleted only upon a data subject's explicit request
Retained for at least five years to ensure business continuity

Correct answer: Kept in a form that permits identification no longer than necessary

GDPR Article 5(1)(e) requires that personal data be kept in a form permitting identification of data subjects for no longer than necessary for the stated purpose.

Question 12: What is a key benefit of implementing performance metrics in Certified Information Privacy Manager vendor management?

Eliminating the need for qualitative feedback
Replacing strategic planning entirely
Reducing employee autonomy
Providing measurable data to track progress and inform decision-making (Correct answer)

Correct answer: Providing measurable data to track progress and inform decision-making

Performance metrics provide objective, quantifiable data that helps track progress toward goals, identify areas for improvement, and support evidence-based decision-making.

Question 13: What does Kirkpatrick's Level 2 evaluation measure in Certified Information Privacy Manager training?

Behavior — changes in on-the-job performance
Learning — the degree to which participants acquired knowledge and skills (Correct answer)
Results — organizational impact of the training
Reaction — how participants felt about the training

Correct answer: Learning — the degree to which participants acquired knowledge and skills

Kirkpatrick's Level 2 (Learning) measures the degree to which participants acquired the intended knowledge, skills, attitudes, and confidence based on their participation in the training.

Question 14: What does validity mean in the context of assessment within Certified Information Privacy Manager?

The assessment measures what it is intended to measure (Correct answer)
The assessment is easy to administer
The assessment produces consistent results over time
The assessment takes minimal time to complete

Correct answer: The assessment measures what it is intended to measure

Validity refers to whether an assessment actually measures the construct or skill it claims to measure. A valid assessment produces meaningful and accurate results for its intended purpose.

Question 15: Which document typically outlines an organization's approach to regulatory compliance in Certified Information Privacy Manager?

A customer satisfaction survey
An employee vacation schedule
A marketing brochure
A compliance policy or framework document (Correct answer)

Correct answer: A compliance policy or framework document

A compliance policy or framework document establishes the organization's commitment to regulatory compliance, defines roles and responsibilities, outlines procedures, and sets expectations for all personnel.

Question 16: What is 'residual risk' in the context of a privacy risk management program?

The initial risk before any assessment is done
Risk arising from regulatory non-compliance only
The risk that remains after privacy controls and mitigations have been applied (Correct answer)
Risk transferred to a third-party vendor

Correct answer: The risk that remains after privacy controls and mitigations have been applied

Residual risk is the level of risk that remains after the organization has implemented its chosen controls and mitigation measures, which management must accept or address further.

Question 17: Under GDPR, when may organizations charge a fee for responding to a data subject access request?

Always, to cover administrative costs
Never under any circumstances
Only for requests involving more than 100 records
Only for requests that are manifestly unfounded or excessive (Correct answer)

Correct answer: Only for requests that are manifestly unfounded or excessive

GDPR allows organizations to charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, particularly repetitive ones.

Question 18: In Certified Information Privacy Manager, what is the purpose of baseline assessment?

To determine budget allocations
To compare performance across different organizations
To provide a final evaluation of performance
To establish a starting point for measuring future progress (Correct answer)

Correct answer: To establish a starting point for measuring future progress

Baseline assessment establishes the initial level of knowledge, skill, or condition before any intervention or training begins, providing a reference point for measuring subsequent progress.

Question 19: What is the purpose of peer review in Certified Information Privacy Manager cross-border data transfers?

To speed up the publication process
To allow friends to proofread for spelling errors
To have qualified experts evaluate research quality before publication (Correct answer)
To guarantee that all research is approved

Correct answer: To have qualified experts evaluate research quality before publication

Peer review involves independent evaluation of research by qualified experts in the field, assessing methodology, validity, significance, and contribution to knowledge before publication.

Question 20: When personal data is collected for research purposes under GDPR, what special retention provision applies?

Research is exempt from all retention requirements once ethics board approval is obtained
Research data must be deleted within 12 months of collection regardless of the research timeline
Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place (Correct answer)
Research data can only be retained if data subjects provide renewed consent annually

Correct answer: Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place

GDPR Article 89 permits derogations to the storage limitation for research purposes when appropriate safeguards like pseudonymization protect data subject rights.

Question 21: What is a best practice in Certified Information Privacy Manager monitoring and auditing?

A practice used only by large organizations
Any practice that is easy to implement
A method or technique recognized as superior based on evidence and expert consensus (Correct answer)
The cheapest available approach

Correct answer: A method or technique recognized as superior based on evidence and expert consensus

Best practices are methods, techniques, or approaches that are recognized through evidence, research, and expert consensus as producing superior results and are recommended for adoption.

Question 22: How should an organization prioritize privacy risks identified during an assessment?

By prioritizing risks flagged by external auditors exclusively
By addressing the most expensive risks first
By evaluating the likelihood of harm and the severity of impact on data subjects (Correct answer)
By focusing only on risks that have resulted in past incidents

Correct answer: By evaluating the likelihood of harm and the severity of impact on data subjects

Privacy risk prioritization involves assessing both the probability that harm will occur and the severity of that harm to individuals, enabling resources to focus on the highest-impact risks first.

Question 23: What is the primary purpose of a Consent Management Platform (CMP)?

To encrypt personal data before it is stored
To automatically generate privacy notices for websites
To collect, store, and manage records of user consents (Correct answer)
To monitor and respond to data breach incidents

Correct answer: To collect, store, and manage records of user consents

A CMP helps organizations obtain, record, and manage user consents, enabling them to demonstrate compliance and honor consent withdrawal requests.

Question 24: When establishing retention periods, which factor should take highest priority?

Employee convenience and workflow preferences
Vendor contract terms
Legal and regulatory requirements (Correct answer)
Internal storage cost reduction targets

Correct answer: Legal and regulatory requirements

Legal and regulatory requirements set the minimum baseline for retention periods, and failure to comply can result in penalties and liability.

Question 25: Which type of assessment in Certified Information Privacy Manager compares an individual's performance to a predetermined standard?

Criterion-referenced assessment (Correct answer)
Informal assessment
Norm-referenced assessment
Ipsative assessment

Correct answer: Criterion-referenced assessment

Criterion-referenced assessment compares performance against a fixed set of criteria or standards, determining whether specific competencies have been met regardless of how others perform.

Question 26: What is a best practice in Certified Information Privacy Manager privacy program governance?

A method or technique recognized as superior based on evidence and expert consensus (Correct answer)
A practice used only by large organizations
Any practice that is easy to implement
The cheapest available approach

Correct answer: A method or technique recognized as superior based on evidence and expert consensus

Best practices are methods, techniques, or approaches that are recognized through evidence, research, and expert consensus as producing superior results and are recommended for adoption.

Question 27: Which GDPR criteria help determine whether a DPIA is required for a processing activity?

Any processing of personal data by a controller with more than 50 employees
Systematic and extensive profiling, large-scale processing of special data, or systematic monitoring of public areas (Correct answer)
All processing activities in the financial services sector
Processing that involves data transfers to the United States

Correct answer: Systematic and extensive profiling, large-scale processing of special data, or systematic monitoring of public areas

GDPR Article 35 and WP29 guidelines identify high-risk criteria including large-scale special category data processing, systematic profiling, and systematic monitoring of publicly accessible areas.

Question 28: What is the relationship between theory and practice in Certified Information Privacy Manager privacy operations?

Practice is only important; theory is unnecessary
Theory and practice are completely unrelated
Theory provides the foundation and framework that guides effective practical application (Correct answer)
Theory replaces the need for any practical experience

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

Question 29: Which management approach in Certified Information Privacy Manager emphasizes continuous improvement through small, incremental changes?

Laissez-faire management
Crisis management approach
Kaizen methodology (Correct answer)
Complete organizational restructuring

Correct answer: Kaizen methodology

Kaizen is a Japanese management philosophy that focuses on continuous improvement through small, incremental changes involving all employees, leading to sustained improvement over time.

Question 30: Which of the following best describes a data retention schedule?

A log of all employees who accessed personal data
A list of data subjects who have opted out of data collection
A document mapping data categories to their required retention periods and disposal methods (Correct answer)
A backup policy for archiving data to offsite storage

Correct answer: A document mapping data categories to their required retention periods and disposal methods

A data retention schedule maps each category of data to its mandated or appropriate retention period and the method of secure disposal at end of life.

Question 31: What is the purpose of a compliance training program in Certified Information Privacy Manager?

To educate personnel about applicable regulations and their responsibilities (Correct answer)
To reduce the number of regulations that apply
To eliminate the need for audits
To replace written policies and procedures

Correct answer: To educate personnel about applicable regulations and their responsibilities

Compliance training programs educate employees about relevant regulations, organizational policies, and individual responsibilities, helping prevent violations and promote a culture of compliance.

Question 32: Under GDPR, what determines how long a previously obtained consent record remains valid?

Consents expire after two years by regulation
Consents expire after one year automatically
Consent remains valid until the purpose is fulfilled or the individual withdraws it (Correct answer)
Consent is valid forever unless the controller chooses to refresh it

Correct answer: Consent remains valid until the purpose is fulfilled or the individual withdraws it

Consent remains valid only as long as the processing purpose exists and the individual has not withdrawn it; organizations should periodically review consent records.

Question 33: What is the relationship between theory and practice in Certified Information Privacy Manager privacy program governance?

Theory replaces the need for any practical experience
Theory and practice are completely unrelated
Practice is only important; theory is unnecessary
Theory provides the foundation and framework that guides effective practical application (Correct answer)

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

Question 34: What is the primary purpose of information security in the context of privacy management?

To ensure physical security of office premises
To protect the confidentiality, integrity, and availability of data (Correct answer)
To increase website traffic
To promote marketing campaigns

Correct answer: To protect the confidentiality, integrity, and availability of data

Information security aims to safeguard data against unauthorized access, alteration, and ensuring it is available when needed.

Question 35: What is the function of a privacy risk register in an organizational privacy program?

To record all data subject requests received by the organization
To document identified privacy risks, their likelihood, impact, owners, and the status of mitigation actions (Correct answer)
To log all employee access to personal data systems
To store copies of all vendor data processing agreements

Correct answer: To document identified privacy risks, their likelihood, impact, owners, and the status of mitigation actions

A privacy risk register is a centralized repository that tracks identified privacy risks, their likelihood and impact ratings, assigned risk owners, chosen treatments, and the current status of mitigations.

Question 36: In Certified Information Privacy Manager, what does "statistical significance" mean?

The result is practically important in real-world terms
The study used a large sample size
The findings confirm the researcher's hypothesis
The result is unlikely to have occurred by chance alone (typically p < 0.05) (Correct answer)

Correct answer: The result is unlikely to have occurred by chance alone (typically p < 0.05)

Statistical significance indicates that an observed result is unlikely to have occurred by random chance, typically when the p-value is less than 0.05 (5% probability of occurring by chance).

Question 37: Which of the following constitutes an 'unambiguous indication' of consent under GDPR?

Pre-ticked checkboxes included in a registration form
Actively ticking an unticked checkbox (Correct answer)
Silence or continued inactivity after viewing a notice
Scrolling past a privacy notice without stopping

Correct answer: Actively ticking an unticked checkbox

An unambiguous indication requires a clear affirmative act, such as ticking an unticked checkbox; passive behavior and pre-selected options do not meet this standard.

Question 38: Which regulation requires 'explicit consent' — a higher standard than standard consent — for processing sensitive categories of personal data?

COPPA
FERPA
GDPR (Correct answer)
CAN-SPAM

Correct answer: GDPR

GDPR Article 9 requires explicit consent for processing special categories of data such as health, biometric, racial, or religious data, which is a stricter standard than ordinary consent.

Question 39: In Certified Information Privacy Manager, what role does an audit serve in regulatory compliance?

To replace self-assessment processes
To reorganize departmental structures
To systematically examine and verify compliance with regulations and standards (Correct answer)
To punish employees for minor infractions

Correct answer: To systematically examine and verify compliance with regulations and standards

Audits provide systematic, independent examination of processes, records, and activities to verify compliance with applicable regulations, standards, and internal policies.

Question 40: Under GDPR Article 17, which of the following would allow a data controller to REFUSE an erasure request?

The data is needed for exercising the right of legal defense (Correct answer)
The data was collected more than two years ago
The data subject's contract has expired
The data subject no longer uses the service

Correct answer: The data is needed for exercising the right of legal defense

Under GDPR Article 17, data controllers may refuse erasure requests when the data is necessary for establishing, exercising, or defending legal claims.

Question 41: What is the purpose of competency-based training in Certified Information Privacy Manager?

To cover as much content as possible in limited time
To provide entertainment during work hours
To ensure learners can demonstrate specific skills before advancing (Correct answer)
To replace all classroom instruction with reading

Correct answer: To ensure learners can demonstrate specific skills before advancing

Competency-based training focuses on learners demonstrating mastery of specific, defined competencies before progressing, ensuring they can actually perform required skills rather than just completing seat time.

Question 42: In Certified Information Privacy Manager, what role does continuing education play in privacy operations?

To increase testing frequency for compliance purposes
To replace initial certification requirements
To prevent professionals from advancing in their careers
To keep professionals current with evolving standards, technologies, and best practices (Correct answer)

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 43: Which of the following is a physical control that can limit privacy risk?

Keypad or biometric access. (Correct answer)
user access reviews.
Encryption
Tokenization.

Correct answer: Keypad or biometric access.

A physical control that can limit privacy risk is keypad or biometric access. This is a type of access control that restricts who can enter or access a physical location or device where personal data is stored or processed. Keypad or biometric access requires a code or a biological feature (such as a fingerprint or a face scan) to authenticate the identity and authorization of the person seeking access. This can prevent unauthorized access, theft, loss, or damage of personal data by outsiders or insiders.

Question 44: Which of the following best defines "data integrity"?

Ensuring data is accurate and unaltered (Correct answer)
Backing up data regularly
Making data available to users at all times
Restricting access to data

Correct answer: Ensuring data is accurate and unaltered

Data integrity involves maintaining and assuring the accuracy and consistency of data over its lifecycle.

Question 45: In Certified Information Privacy Manager, why is monitoring and auditing knowledge important for professional certification?

It is only required for administrative purposes
It demonstrates competence and ensures practitioners meet established standards (Correct answer)
It is important only for entry-level positions
It has no practical relevance to daily work

Correct answer: It demonstrates competence and ensures practitioners meet established standards

Professional certification in specific knowledge areas demonstrates that practitioners have met established competency standards, ensuring quality of service and public protection.

Question 46: In Certified Information Privacy Manager, what role does continuing education play in monitoring and auditing?

To keep professionals current with evolving standards, technologies, and best practices (Correct answer)
To replace initial certification requirements
To prevent professionals from advancing in their careers
To increase testing frequency for compliance purposes

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 47: What is the primary purpose of a Privacy Impact Assessment (PIA)?

To document all existing data processing activities
To train employees on privacy regulations
To identify and mitigate privacy risks before implementing a new project or system (Correct answer)
To respond to data subject access requests

Correct answer: To identify and mitigate privacy risks before implementing a new project or system

A PIA systematically identifies privacy risks associated with a new project, product, or process and proposes measures to mitigate those risks before implementation.

Question 48: Which right allows a data subject to request that processing be limited while the accuracy of their data is contested?

Right to restriction of processing (Correct answer)
Right to erasure
Right to object
Right to portability

Correct answer: Right to restriction of processing

The right to restriction of processing allows data subjects to limit how their data is processed, such as when they contest its accuracy or object to processing.

Question 49: In Certified Information Privacy Manager, why is incident response knowledge important for professional certification?

It has no practical relevance to daily work
It demonstrates competence and ensures practitioners meet established standards (Correct answer)
It is important only for entry-level positions
It is only required for administrative purposes

Correct answer: It demonstrates competence and ensures practitioners meet established standards

Professional certification in specific knowledge areas demonstrates that practitioners have met established competency standards, ensuring quality of service and public protection.

Question 50: Under GDPR, what is a Data Protection Impact Assessment (DPIA) specifically designed to address?

Vendor contracts involving personal data
Data breaches that have already occurred
All routine data processing activities
Processing operations likely to result in high risk to individuals' rights and freedoms (Correct answer)

Correct answer: Processing operations likely to result in high risk to individuals' rights and freedoms

GDPR Article 35 requires a DPIA for processing operations that are likely to result in high risk to the rights and freedoms of natural persons.

Question 51: What is a 'consent receipt' in privacy management practice?

A payment acknowledgment for privacy compliance services
A technical specification standard for cookie consent management
A government-issued document authorizing specific data processing activities
A record provided to individuals confirming the terms of their consent (Correct answer)

Correct answer: A record provided to individuals confirming the terms of their consent

A consent receipt is a record given to individuals at the time of consent documenting what they agreed to, supporting transparency, accountability, and auditability.

Question 52: Which approach is most effective for mastering monitoring and auditing in Certified Information Privacy Manager?

Studying only immediately before examinations
Combining theoretical study with practical application and regular review (Correct answer)
Relying solely on on-the-job experience
Memorizing textbook definitions without understanding

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 53: Which NIST Special Publication provides a catalog of security and privacy controls for federal information systems?

NIST SP 800-37
NIST SP 800-53 (Correct answer)
NIST SP 800-171
NIST SP 800-61

Correct answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls that federal agencies and contractors can use to protect information systems and personal data.

Question 54: What is the difference between raster and vector graphics in Certified Information Privacy Manager?

There is no practical difference between them
Vector graphics cannot display colors
Raster uses pixels and loses quality when scaled; vector uses mathematical paths and scales infinitely (Correct answer)
Raster is always better quality than vector

Correct answer: Raster uses pixels and loses quality when scaled; vector uses mathematical paths and scales infinitely

Raster graphics are made of pixels and become pixelated when enlarged. Vector graphics use mathematical curves and lines, allowing them to be scaled to any size without losing quality.

Question 55: Which of the following is an example of a technical control in information security?

Firewalls and intrusion detection systems (Correct answer)
Security policies
Security awareness campaigns
Employee training programs

Correct answer: Firewalls and intrusion detection systems

Technical controls include hardware and software mechanisms used to protect information systems and data.

Question 56: What is the difference between qualitative and quantitative research in Certified Information Privacy Manager?

Qualitative is always more rigorous than quantitative
There is no meaningful difference between them
Qualitative explores experiences and meanings; quantitative measures and counts numerical data (Correct answer)
Quantitative cannot be used in social sciences

Correct answer: Qualitative explores experiences and meanings; quantitative measures and counts numerical data

Qualitative research explores experiences, perceptions, and meanings through methods like interviews and observation. Quantitative research measures variables numerically through surveys, experiments, and statistical analysis.

Question 57: In Certified Information Privacy Manager, what is the primary function of strategic planning in vendor management?

To set long-term goals and determine the best approach to achieve them (Correct answer)
To conduct annual performance reviews
To handle day-to-day operational tasks
To manage the organization's social media presence

Correct answer: To set long-term goals and determine the best approach to achieve them

Strategic planning involves defining the organization's direction, making decisions on allocating resources, and establishing priorities to achieve long-term objectives.

Question 58: Under GDPR, what must an organization do when it intends to use previously collected data for a new, incompatible purpose?

Delete the data and collect it again under the new purpose
Inform data subjects of the new purpose and obtain fresh consent (Correct answer)
Notify the relevant supervisory authority within 72 hours
No action is required if the same controller is involved

Correct answer: Inform data subjects of the new purpose and obtain fresh consent

If new processing is incompatible with the original consented purpose, organizations must inform data subjects about the new purpose and obtain fresh consent.

Question 59: Which of the following scenarios mandates a DPIA under GDPR?

Collecting cookies with user consent
Large-scale processing of special categories of personal data (Correct answer)
Sending a monthly newsletter to opted-in subscribers
Storing employee contact information in an HR system

Correct answer: Large-scale processing of special categories of personal data

GDPR Article 35(3) explicitly requires DPIAs for large-scale processing of special categories of data such as health, biometric, or racial data.

Question 60: Which four options are commonly used to treat privacy risks identified during a risk assessment?

Encrypt, pseudonymize, anonymize, and delete
Avoid, mitigate, transfer, and accept (Correct answer)
Identify, assess, remediate, and report
Detect, respond, recover, and review

Correct answer: Avoid, mitigate, transfer, and accept

The four standard risk treatment options are: avoid (stop the risky activity), mitigate (reduce the risk), transfer (share risk via insurance or contracts), and accept (acknowledge and proceed with residual risk).

Question 61: What does 'residual risk acceptance' mean in a privacy risk management program?

Deleting all data associated with unresolved risks
Escalating all residual risks to a supervisory authority
Automatically transferring all remaining risk to a third-party insurer
Management's formal decision to tolerate remaining risk after controls have been applied (Correct answer)

Correct answer: Management's formal decision to tolerate remaining risk after controls have been applied

Residual risk acceptance is a formal management decision acknowledging that the remaining risk after controls is within the organization's risk appetite and does not require further mitigation.

Question 62: In privacy risk management, what does 'inherent risk' refer to?

The risk remaining after all controls have been implemented
Risk arising from third-party vendors only
Risk identified after a privacy breach
The level of risk present before any controls or mitigations are applied (Correct answer)

Correct answer: The level of risk present before any controls or mitigations are applied

Inherent risk is the raw level of risk associated with a processing activity before any privacy or security controls are applied to reduce it.

Question 63: What is the difference between reliability and validity in Certified Information Privacy Manager assessment?

Reliability refers to consistency of results; validity refers to accuracy of measurement (Correct answer)
They are synonymous terms with identical meanings
Reliability is about speed; validity is about cost
Reliability applies only to written tests; validity applies only to practical tests

Correct answer: Reliability refers to consistency of results; validity refers to accuracy of measurement

Reliability means the assessment produces consistent, stable results across repeated administrations. Validity means the assessment accurately measures what it is intended to measure. Both are needed for quality assessment.

Question 64: What is the purpose of a wireframe in Certified Information Privacy Manager privacy by design?

To write the technical code for implementation
To create a simplified visual guide showing the structure and layout of a design (Correct answer)
To test the physical durability of materials
To produce a final, polished design ready for production

Correct answer: To create a simplified visual guide showing the structure and layout of a design

A wireframe is a simplified, low-fidelity visual representation of a design's structure and layout, used for planning and communication before detailed design work begins.

Question 65: Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?

Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.
Redirect the individual back to their employer to understand their rights and how this might impact access to company tools. (Correct answer)
Process the request assuming that the individual understands the implications to their organization if their information is deleted.
Forward the request to the contact on file for the client asking them how they would like you to proceed.

Correct answer: Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.

If your organization provides a SaaS tool for B2B services and does not interact with individual consumers, and a client's current employee reaches out with a right to delete request, the most appropriate response is to redirect the individual back to their employer to understand their rights and how this might impact access to company tools. This is because your organization is acting as a processor for the client, who is the controller of the employee's personal data.

Question 66: In Certified Information Privacy Manager, what is the primary purpose of regulatory compliance?

To maximize organizational profits
To eliminate the need for internal policies
To reduce employee workloads
To ensure adherence to laws, rules, and standards that govern the profession (Correct answer)

Correct answer: To ensure adherence to laws, rules, and standards that govern the profession

Regulatory compliance ensures that organizations and professionals follow all applicable laws, regulations, and standards, protecting the public and maintaining professional integrity.

Question 67: What is the primary purpose of stakeholder analysis in Certified Information Privacy Manager vendor management?

To schedule project timelines
To evaluate employee attendance records
To identify and understand the interests and influence of all parties affected by decisions (Correct answer)
To calculate financial returns on investment

Correct answer: To identify and understand the interests and influence of all parties affected by decisions

Stakeholder analysis identifies all parties who have an interest in or are affected by a project or decision, assessing their level of influence and interest to develop appropriate engagement strategies.

Question 68: Which NIST publication provides a voluntary privacy framework to help organizations manage privacy risk?

NIST Privacy Framework Version 1.0 (Correct answer)
NIST Cybersecurity Framework 2.0
NIST SP 800-37
NIST SP 800-53

Correct answer: NIST Privacy Framework Version 1.0

The NIST Privacy Framework Version 1.0, published in January 2020, provides a voluntary, flexible tool for organizations to manage privacy risk through five functions: Identify, Govern, Control, Communicate, and Protect.

Question 69: Under GDPR, which conditions must ALL be met for consent to be considered lawful?

Consent can be implied through continued use of a service
Consent can be bundled within the terms of service agreement
Consent must be confirmed via email reply
Consent must be freely given, specific, informed, and unambiguous (Correct answer)

Correct answer: Consent must be freely given, specific, informed, and unambiguous

GDPR Article 7 requires valid consent to be freely given, specific, informed, and unambiguous, typically demonstrated through a clear affirmative act.

Question 70: In the US, which federal law grants individuals rights to access and correct records about themselves held by federal agencies?

FERPA
COPPA
HIPAA
The Privacy Act of 1974 (Correct answer)

Correct answer: The Privacy Act of 1974

The Privacy Act of 1974 grants US citizens and lawful permanent residents rights to access and request correction of records held about them by federal agencies.

Question 71: Which of the following must be provided when responding to a data subject access request?

The organization's revenue and data storage costs
The purposes of processing and categories of recipients (Correct answer)
The technical architecture of the data storage system
The names of all employees who accessed the data

Correct answer: The purposes of processing and categories of recipients

DSARs must be fulfilled with information including the purposes of processing, categories of data held, and recipients or categories of recipients.

Question 72: Which of the following metrics would best demonstrate the effectiveness of a data retention program to senior management?

Total volume of data stored across all systems
Number of employees who completed retention training
Percentage of data categories covered by an approved retention schedule and rate of on-time disposal (Correct answer)
Cost savings from reduced storage infrastructure

Correct answer: Percentage of data categories covered by an approved retention schedule and rate of on-time disposal

Coverage of data categories by retention schedules and compliance with disposal timelines directly measure whether the retention program is achieving its privacy and compliance objectives.

Question 73: In privacy risk assessment, what is meant by 'privacy harm'?

Loss of data due to a cyberattack
Adverse impacts on individuals resulting from the processing of their personal data (Correct answer)
Financial penalties issued by regulators to organizations
Damage to an organization's reputation after a breach

Correct answer: Adverse impacts on individuals resulting from the processing of their personal data

Privacy harm refers to the negative consequences experienced by individuals — such as discrimination, financial loss, or reputational damage — that result from the processing of their personal information.

Question 74: Which CAN-SPAM Act requirement relates most directly to email consent management?

All commercial emails must be pre-approved by the FTC before sending
Recipients must be given a clear and conspicuous way to opt out of future emails (Correct answer)
Senders must retain consent records for a minimum of ten years
Senders must obtain affirmative opt-in before sending any commercial email

Correct answer: Recipients must be given a clear and conspicuous way to opt out of future emails

The CAN-SPAM Act requires commercial email senders to include a clear opt-out mechanism and honor opt-out requests within 10 business days.

Question 75: What is the purpose of layers in Certified Information Privacy Manager privacy by design software?

To organize different elements independently so they can be edited without affecting others (Correct answer)
To limit the number of colors available
To prevent any changes to the design
To increase the file size of the project

Correct answer: To organize different elements independently so they can be edited without affecting others

Layers allow designers to organize different elements on separate, transparent levels that can be edited, hidden, or rearranged independently without affecting other parts of the design.

Question 76: Which factor most affects knowledge retention in Certified Information Privacy Manager training and awareness?

The instructor's academic credentials
The physical appearance of training materials
Regular practice and reinforcement of learned concepts (Correct answer)
The length of the training manual

Correct answer: Regular practice and reinforcement of learned concepts

Research consistently shows that spaced practice and reinforcement significantly improve long-term retention. Without review and application, most new information is forgotten within days.

Question 77: Under GDPR, how must consent be obtained to process children's data for information society services?

School administrator authorization on behalf of the child
Written consent signed by the child only
Government-issued parental permission documentation
Parental or guardian consent for children under 16 (or lower national threshold) (Correct answer)

Correct answer: Parental or guardian consent for children under 16 (or lower national threshold)

GDPR requires parental or guardian consent for children under 16 for information society services, though member states may lower this threshold to 13.

Question 78: Which approach is most effective for mastering incident response in Certified Information Privacy Manager?

Relying solely on on-the-job experience
Memorizing textbook definitions without understanding
Studying only immediately before examinations
Combining theoretical study with practical application and regular review (Correct answer)

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 79: What does the principle of "least privilege" entail in information security?

Granting users full access to all systems
Keeping security policies secret from employees
Regularly changing system passwords
Providing users with the minimum level of access necessary to perform their job functions (Correct answer)

Correct answer: Providing users with the minimum level of access necessary to perform their job functions

The principle of least privilege ensures that users only have access to the information and resources they need to do their jobs.

Question 80: What should an organization do when it cannot fulfill a data subject rights request within the required initial timeframe?

Delete the data immediately to avoid liability
Transfer processing responsibility to a third party
Ignore the request until resources are available
Notify the data subject of the delay and provide an extended completion date (Correct answer)

Correct answer: Notify the data subject of the delay and provide an extended completion date

When extensions are needed, organizations must inform the data subject within the initial response period, explaining the reason for the delay and the new expected completion date.

Question 81: How does an organization's 'risk appetite' influence its privacy program decisions?

It specifies which data subjects can exercise their rights
It defines the level of risk the organization is willing to accept before taking additional action (Correct answer)
It sets the budget for privacy training
It determines the number of privacy staff required

Correct answer: It defines the level of risk the organization is willing to accept before taking additional action

Risk appetite establishes the threshold of acceptable risk, guiding decisions on which privacy risks require treatment and which residual risks can be tolerated without further controls.

Question 82: Under CCPA, what does the 'right to know' allow consumers to request from a business?

Access to their financial transaction records
The organization's cybersecurity audit results
The names of all third-party advertisers using their data
Categories and specific pieces of personal information collected about them (Correct answer)

Correct answer: Categories and specific pieces of personal information collected about them

The CCPA right to know allows consumers to request disclosure of the categories and specific pieces of personal information a business has collected about them.

Question 83: In Certified Information Privacy Manager, what is the purpose of a needs assessment before designing a training program?

To eliminate the need for evaluation
To reduce the training budget
To select the most convenient training dates
To identify gaps between current and desired performance levels (Correct answer)

Correct answer: To identify gaps between current and desired performance levels

A needs assessment identifies the gap between current knowledge/skills and what is needed, ensuring training programs address actual deficiencies and organizational requirements.

Question 84: In Certified Information Privacy Manager, what does "resolution" refer to in digital design?

The color scheme of a design
The file format used for saving images
The number of pixels per unit of measurement, determining image clarity (Correct answer)
The physical size of the printed output

Correct answer: The number of pixels per unit of measurement, determining image clarity

Resolution refers to the density of pixels (measured in PPI/DPI), with higher resolution providing greater detail and clarity. Standard screen resolution is 72 PPI, while print typically requires 300 DPI.

Question 85: Which learning principle is most important for adult learners in Certified Information Privacy Manager training and awareness?

Adults learn best in competitive environments only
Adults require constant supervision during learning
Adults learn best when content is immediately applicable to real situations (Correct answer)
Adults prefer memorization of abstract theories

Correct answer: Adults learn best when content is immediately applicable to real situations

Adult learning theory (andragogy) emphasizes that adults are motivated to learn when they can see immediate practical application, drawing on their experience and self-direction.

Question 86: In Certified Information Privacy Manager, what role does continuing education play in incident response?

To replace initial certification requirements
To keep professionals current with evolving standards, technologies, and best practices (Correct answer)
To prevent professionals from advancing in their careers
To increase testing frequency for compliance purposes

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 87: What is the fundamental difference between opt-in and opt-out consent models?

Opt-in requires a written signature; opt-out can be communicated verbally
Opt-in is a US regulatory requirement; opt-out is the GDPR standard
Opt-in is only required for marketing; opt-out is required for all processing activities
Opt-in requires active agreement before processing; opt-out assumes consent exists unless the individual declines (Correct answer)

Correct answer: Opt-in requires active agreement before processing; opt-out assumes consent exists unless the individual declines

Opt-in models require individuals to actively indicate consent before processing occurs, while opt-out models assume consent exists unless the individual takes action to decline.

Question 88: Which best practice most effectively helps organizations demonstrate the ongoing validity of consent for marketing communications?

Encrypting all consent collection forms to prevent tampering
Maintaining timestamped records of when, how, and to what individuals consented (Correct answer)
Storing only original IP addresses as proof of consent
Re-requesting consent from all subscribers every 30 days

Correct answer: Maintaining timestamped records of when, how, and to what individuals consented

Maintaining detailed records with timestamps, the exact consent language presented, and the collection method provides the audit trail needed to demonstrate valid and current consent.

Question 89: What is the right to erasure also commonly known as under GDPR?

Right to be forgotten (Correct answer)
Right to portability
Right to access
Right to rectification

Correct answer: Right to be forgotten

The right to erasure is commonly called the 'right to be forgotten,' allowing individuals to request deletion of their personal data under GDPR Article 17.

Question 90: What is a primary role of a Certified Information Privacy Manager (CIPM) in information security?

Coding software applications
Implementing and overseeing privacy and data protection policies (Correct answer)
Managing financial audits
Designing network hardware

Correct answer: Implementing and overseeing privacy and data protection policies

CIPMs are responsible for creating, managing, and ensuring adherence to privacy and data protection policies within an organization.

CIPM Certified Information Privacy Manager Exam

The CIPM (Certified Information Privacy Manager) Exam, administered by IAPP (International Association of Privacy Professionals), certifies professionals who manage privacy programs within organizations. It covers developing a privacy framework, establishing program governance, assessing data, protecting personal data, sustaining program performance, and responding to data subject requests and incidents.

Questions

150 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

store.iapp.org — Test delivery, fees, exam format · verified Oct 2026
iapp.org — Retake fee · verified Oct 2026
assets.contentstack.io — Renewal, score validity, passing score, retake policy, score release, test dates · verified Oct 2026