CIPM Certified Information Privacy Manager Exam — Questions and Answers

Question 1: In Certified Information Privacy Manager, what does the PDCA cycle stand for?

Process, Design, Create, Analyze
Prioritize, Delegate, Communicate, Approve
Plan, Do, Check, Act (Correct answer)
Prepare, Develop, Control, Assess

Correct answer: Plan, Do, Check, Act

The PDCA cycle (Plan-Do-Check-Act) is a continuous improvement framework where you plan the change, implement it, check the results, and act on what you learned to refine the process.

Question 2: Under GDPR, how must consent be obtained to process children's data for information society services?

Government-issued parental permission documentation
School administrator authorization on behalf of the child
Parental or guardian consent for children under 16 (or lower national threshold) (Correct answer)
Written consent signed by the child only

Correct answer: Parental or guardian consent for children under 16 (or lower national threshold)

GDPR requires parental or guardian consent for children under 16 for information society services, though member states may lower this threshold to 13.

Question 3: Under GDPR, how must organizations handle a request to withdraw consent?

Accept withdrawal only through official regulatory forms
Make withdrawal as easy as giving consent was (Correct answer)
Require written supervisor confirmation before acting on withdrawal
Process the withdrawal within 90 days of receipt

Correct answer: Make withdrawal as easy as giving consent was

GDPR Article 7(3) requires that withdrawing consent be as easy as giving it, ensuring individuals can effectively revoke consent without undue burden.

Question 4: What is the purpose of peer review in Certified Information Privacy Manager cross-border data transfers?

To speed up the publication process
To allow friends to proofread for spelling errors
To guarantee that all research is approved
To have qualified experts evaluate research quality before publication (Correct answer)

Correct answer: To have qualified experts evaluate research quality before publication

Peer review involves independent evaluation of research by qualified experts in the field, assessing methodology, validity, significance, and contribution to knowledge before publication.

Question 5: What is the relationship between theory and practice in Certified Information Privacy Manager monitoring and auditing?

Theory and practice are completely unrelated
Theory provides the foundation and framework that guides effective practical application (Correct answer)
Theory replaces the need for any practical experience
Practice is only important; theory is unnecessary

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

Question 6: Which GDPR right enables data subjects to challenge decisions made solely by automated processing that significantly affects them?

Right to portability
Right to restriction
Right not to be subject to automated decision-making (Correct answer)
Right to erasure

Correct answer: Right not to be subject to automated decision-making

GDPR Article 22 provides data subjects the right to not be subject to solely automated decisions that significantly affect them, including profiling.

Question 7: Which type of assessment in Certified Information Privacy Manager compares an individual's performance to a predetermined standard?

Informal assessment
Norm-referenced assessment
Criterion-referenced assessment (Correct answer)
Ipsative assessment

Correct answer: Criterion-referenced assessment

Criterion-referenced assessment compares performance against a fixed set of criteria or standards, determining whether specific competencies have been met regardless of how others perform.

Question 8: Which resource allocation strategy in Certified Information Privacy Manager vendor management focuses on maximizing output with limited resources?

Optimization of available resources through prioritization (Correct answer)
Acquiring unlimited resources regardless of cost
Delegating resource decisions to external consultants
Reducing all activities to minimum levels

Correct answer: Optimization of available resources through prioritization

Resource optimization involves strategically prioritizing and allocating limited resources to maximize output and achieve objectives efficiently, balancing competing demands.

Question 9: What is a key benefit of implementing performance metrics in Certified Information Privacy Manager vendor management?

Providing measurable data to track progress and inform decision-making (Correct answer)
Replacing strategic planning entirely
Reducing employee autonomy
Eliminating the need for qualitative feedback

Correct answer: Providing measurable data to track progress and inform decision-making

Performance metrics provide objective, quantifiable data that helps track progress toward goals, identify areas for improvement, and support evidence-based decision-making.

Question 10: In Certified Information Privacy Manager, what role does continuing education play in monitoring and auditing?

To increase testing frequency for compliance purposes
To prevent professionals from advancing in their careers
To keep professionals current with evolving standards, technologies, and best practices (Correct answer)
To replace initial certification requirements

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 11: In Certified Information Privacy Manager, what is the purpose of a needs assessment before designing a training program?

To reduce the training budget
To eliminate the need for evaluation
To select the most convenient training dates
To identify gaps between current and desired performance levels (Correct answer)

Correct answer: To identify gaps between current and desired performance levels

A needs assessment identifies the gap between current knowledge/skills and what is needed, ensuring training programs address actual deficiencies and organizational requirements.

Question 12: Which of the following best describes 'anonymization' in the context of data retention?

Replacing a name with an employee ID that can be reversed using a lookup table
Encrypting data so only authorized parties can access identifying information
Irreversibly processing data so it can no longer be related to an identified or identifiable individual (Correct answer)
Aggregating data into statistical summaries while retaining individual records

Correct answer: Irreversibly processing data so it can no longer be related to an identified or identifiable individual

True anonymization irreversibly prevents re-identification; once genuinely anonymized, data falls outside the scope of privacy regulations and retention rules for personal data.

Question 13: In Certified Information Privacy Manager, what role does an audit serve in regulatory compliance?

To systematically examine and verify compliance with regulations and standards (Correct answer)
To reorganize departmental structures
To replace self-assessment processes
To punish employees for minor infractions

Correct answer: To systematically examine and verify compliance with regulations and standards

Audits provide systematic, independent examination of processes, records, and activities to verify compliance with applicable regulations, standards, and internal policies.

Question 14: Under GDPR, which conditions must ALL be met for consent to be considered lawful?

Consent must be freely given, specific, informed, and unambiguous (Correct answer)
Consent must be confirmed via email reply
Consent can be bundled within the terms of service agreement
Consent can be implied through continued use of a service

Correct answer: Consent must be freely given, specific, informed, and unambiguous

GDPR Article 7 requires valid consent to be freely given, specific, informed, and unambiguous, typically demonstrated through a clear affirmative act.

Question 15: What is a common objective of conducting regular security audits?

To increase the complexity of the network infrastructure
To identify and address vulnerabilities and compliance issues (Correct answer)
To reduce IT spending
To promote the organization's products

Correct answer: To identify and address vulnerabilities and compliance issues

Regular security audits help to uncover vulnerabilities, ensure compliance with regulations, and improve overall security posture.

Question 16: In Certified Information Privacy Manager, what is the purpose of baseline assessment?

To provide a final evaluation of performance
To compare performance across different organizations
To establish a starting point for measuring future progress (Correct answer)
To determine budget allocations

Correct answer: To establish a starting point for measuring future progress

Baseline assessment establishes the initial level of knowledge, skill, or condition before any intervention or training begins, providing a reference point for measuring subsequent progress.

Question 17: What is the function of a privacy risk register in an organizational privacy program?

To log all employee access to personal data systems
To store copies of all vendor data processing agreements
To document identified privacy risks, their likelihood, impact, owners, and the status of mitigation actions (Correct answer)
To record all data subject requests received by the organization

Correct answer: To document identified privacy risks, their likelihood, impact, owners, and the status of mitigation actions

A privacy risk register is a centralized repository that tracks identified privacy risks, their likelihood and impact ratings, assigned risk owners, chosen treatments, and the current status of mitigations.

Question 18: What is a "control group" in Certified Information Privacy Manager research?

A group of researchers overseeing the study
The group that receives the experimental treatment
The largest group in any experiment
A group that does not receive the experimental treatment, serving as a baseline comparison (Correct answer)

Correct answer: A group that does not receive the experimental treatment, serving as a baseline comparison

The control group does not receive the experimental treatment or intervention, providing a baseline against which the experimental group's results can be compared to determine the effect of the treatment.

Question 19: Which of the following constitutes an 'unambiguous indication' of consent under GDPR?

Scrolling past a privacy notice without stopping
Pre-ticked checkboxes included in a registration form
Actively ticking an unticked checkbox (Correct answer)
Silence or continued inactivity after viewing a notice

Correct answer: Actively ticking an unticked checkbox

An unambiguous indication requires a clear affirmative act, such as ticking an unticked checkbox; passive behavior and pre-selected options do not meet this standard.

Question 20: What is a 'consent receipt' in privacy management practice?

A record provided to individuals confirming the terms of their consent (Correct answer)
A technical specification standard for cookie consent management
A payment acknowledgment for privacy compliance services
A government-issued document authorizing specific data processing activities

Correct answer: A record provided to individuals confirming the terms of their consent

A consent receipt is a record given to individuals at the time of consent documenting what they agreed to, supporting transparency, accountability, and auditability.

Question 21: If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?

Improve communication to reinforce to everyone that breaches must be reported and how they should be reported.
Provide role-specific training to areas where breaches are happening so they are more aware.
Review reporting activity on breaches to understand when incidents are being reported and when they are not to improve communication and training.
Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt. (Correct answer)

Correct answer: Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt.

Distributing a phishing exercise is not advisable when attempting to address the issue of colleagues not reporting personal data breaches. Instead, the recommended steps are to review reporting activity on breaches, improve communication, and provide role-specific training to areas where breaches are happening. These steps will help to ensure that everyone is aware of their responsibilities and that they understand how to report a breach should one occur.

Question 22: What is 'consent fatigue' in the context of digital privacy management?

Technical failures causing consent management platforms to process requests slowly
Excessive regulatory requirements that burden organizations with consent documentation
Users becoming desensitized and clicking 'agree' without reviewing privacy notices (Correct answer)
The automatic expiration of stored consent records after extended inactivity

Correct answer: Users becoming desensitized and clicking 'agree' without reviewing privacy notices

Consent fatigue occurs when individuals are overwhelmed by frequent consent requests and reflexively accept them without reading, undermining the informed nature of consent.

Question 23: Which GDPR right allows individuals to unconditionally object to processing of their data for direct marketing purposes?

Right to erasure
Right to portability
Right to restriction
Right to object (Correct answer)

Correct answer: Right to object

GDPR Article 21 grants data subjects the absolute right to object to processing for direct marketing, and the controller must cease such processing upon objection.

Question 24: Under GDPR, can consent be used as a valid legal basis when there is a significant power imbalance between controller and data subject?

Only if the arrangement is approved in advance by a supervisory authority
Yes, if the data subject signs a formal written agreement
Yes, as long as it is properly documented
No, because consent cannot be considered freely given in such situations (Correct answer)

Correct answer: No, because consent cannot be considered freely given in such situations

When a clear power imbalance exists, such as between an employer and employee, consent is generally not considered freely given and thus is not a valid legal basis.

Question 25: What is the key operational difference between the right to erasure and the right to restriction under GDPR?

Erasure applies to third parties; restriction applies only to the original controller
Erasure is granted automatically; restriction requires supervisory authority approval
Erasure applies only to digital data; restriction applies to paper records too
Erasure removes data permanently; restriction limits how data is processed without deleting it (Correct answer)

Correct answer: Erasure removes data permanently; restriction limits how data is processed without deleting it

Erasure permanently deletes personal data, while restriction suspends or limits its processing without removing it, allowing the data to be retained for specific purposes.

Question 26: In Certified Information Privacy Manager, what does "resolution" refer to in digital design?

The file format used for saving images
The number of pixels per unit of measurement, determining image clarity (Correct answer)
The physical size of the printed output
The color scheme of a design

Correct answer: The number of pixels per unit of measurement, determining image clarity

Resolution refers to the density of pixels (measured in PPI/DPI), with higher resolution providing greater detail and clarity. Standard screen resolution is 72 PPI, while print typically requires 300 DPI.

Question 27: What is the primary principle behind data retention schedules in a privacy program?

Retaining data based solely on business unit preferences
Keeping data only as long as necessary for its specified purpose (Correct answer)
Storing all data indefinitely to comply with potential legal holds
Retaining data as long as technically possible to support future needs

Correct answer: Keeping data only as long as necessary for its specified purpose

The data minimization and storage limitation principles require that personal data be kept only as long as necessary for the purpose for which it was collected.

Question 28: Which of the following scenarios mandates a DPIA under GDPR?

Collecting cookies with user consent
Storing employee contact information in an HR system
Large-scale processing of special categories of personal data (Correct answer)
Sending a monthly newsletter to opted-in subscribers

Correct answer: Large-scale processing of special categories of personal data

GDPR Article 35(3) explicitly requires DPIAs for large-scale processing of special categories of data such as health, biometric, or racial data.

Question 29: What is the primary purpose of a Privacy Impact Assessment (PIA)?

To train employees on privacy regulations
To respond to data subject access requests
To document all existing data processing activities
To identify and mitigate privacy risks before implementing a new project or system (Correct answer)

Correct answer: To identify and mitigate privacy risks before implementing a new project or system

A PIA systematically identifies privacy risks associated with a new project, product, or process and proposes measures to mitigate those risks before implementation.

Question 30: Which learning principle is most important for adult learners in Certified Information Privacy Manager training and awareness?

Adults prefer memorization of abstract theories
Adults learn best in competitive environments only
Adults require constant supervision during learning
Adults learn best when content is immediately applicable to real situations (Correct answer)

Correct answer: Adults learn best when content is immediately applicable to real situations

Adult learning theory (andragogy) emphasizes that adults are motivated to learn when they can see immediate practical application, drawing on their experience and self-direction.

Question 31: While trying to e-mail her manager, an employee has e-mailed a list of all the company's customers, including their bank details, to an employee with the same name at a different company. Which of the following would be the first stage in the incident response plan under the General Data Protection Regulation (GDPR)?

Notification to data subjects.
Notification to the Information Commissioner's Office (ICO).
Remediation offers to data subjects.
Containment of impact of breach. (Correct answer)

Correct answer: Containment of impact of breach.

The first stage in the incident response plan under the General Data Protection Regulation (GDPR) for this scenario would be to contain the impact of the breach. This means taking immediate action to stop the unauthorized access or disclosure of personal data, and to prevent it from happening again in the future. This could involve revoking access to the data, notifying the employee who mistakenly sent the data, and implementing security measures to prevent similar breaches from occurring in the future.

Question 32: What is the purpose of a privacy threshold assessment (PTA)?

To determine whether a full PIA or DPIA is required for a given project (Correct answer)
To assess vendor compliance with contractual privacy terms
To calculate the financial cost of a privacy breach
To evaluate employee adherence to privacy policies

Correct answer: To determine whether a full PIA or DPIA is required for a given project

A privacy threshold assessment is a preliminary screening tool that evaluates whether a proposed project or system involves sufficient privacy risk to warrant a full PIA or DPIA.

Question 33: Which principle ensures data subjects receive equal service regardless of whether they exercise their privacy rights?

Purpose limitation
Storage limitation
Non-discrimination (Correct answer)
Data minimization

Correct answer: Non-discrimination

The non-discrimination principle, reflected in laws like CCPA, ensures consumers are not penalized or receive inferior service for exercising their privacy rights.

Question 34: What does Kirkpatrick's Level 2 evaluation measure in Certified Information Privacy Manager training?

Learning — the degree to which participants acquired knowledge and skills (Correct answer)
Reaction — how participants felt about the training
Behavior — changes in on-the-job performance
Results — organizational impact of the training

Correct answer: Learning — the degree to which participants acquired knowledge and skills

Kirkpatrick's Level 2 (Learning) measures the degree to which participants acquired the intended knowledge, skills, attitudes, and confidence based on their participation in the training.

Question 35: What is a best practice in Certified Information Privacy Manager privacy program governance?

A method or technique recognized as superior based on evidence and expert consensus (Correct answer)
The cheapest available approach
Any practice that is easy to implement
A practice used only by large organizations

Correct answer: A method or technique recognized as superior based on evidence and expert consensus

Best practices are methods, techniques, or approaches that are recognized through evidence, research, and expert consensus as producing superior results and are recommended for adoption.

Question 36: How do privacy audits differ from privacy assessments?

They are non-binding.
They are evidence-based. (Correct answer)
They are based on standards.
They are conducted by external parties.

Correct answer: They are evidence-based.

Privacy audits differ from privacy assessments in that they are evidence-based, meaning that they rely on objective and verifiable data to evaluate the compliance and effectiveness of the privacy program. Privacy assessments, on the other hand, are based on standards, meaning that they use a set of criteria or best practices to measure the performance and maturity of the privacy program. Privacy audits are usually conducted by external parties, while privacy assessments can be done internally or externally.

Question 37: In Certified Information Privacy Manager, what role does continuing education play in privacy program governance?

To increase testing frequency for compliance purposes
To keep professionals current with evolving standards, technologies, and best practices (Correct answer)
To replace initial certification requirements
To prevent professionals from advancing in their careers

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 38: Which of the following metrics would best demonstrate the effectiveness of a data retention program to senior management?

Number of employees who completed retention training
Percentage of data categories covered by an approved retention schedule and rate of on-time disposal (Correct answer)
Cost savings from reduced storage infrastructure
Total volume of data stored across all systems

Correct answer: Percentage of data categories covered by an approved retention schedule and rate of on-time disposal

Coverage of data categories by retention schedules and compliance with disposal timelines directly measure whether the retention program is achieving its privacy and compliance objectives.

Question 39: What does 'freely given' consent mean in the GDPR framework?

Consent given without any solicitation by the organization
Consent provided in the individual's native language
Consent provided at no financial cost to the individual
Consent not conditioned on a service unless processing is necessary for that service (Correct answer)

Correct answer: Consent not conditioned on a service unless processing is necessary for that service

Freely given consent means there is no power imbalance and service delivery is not conditioned on consent to processing that is unnecessary for that service.

Question 40: What is a rubric used for in Certified Information Privacy Manager assessment?

To define criteria and performance levels for evaluating work quality (Correct answer)
To record attendance data
To schedule assessment dates
To calculate statistical averages

Correct answer: To define criteria and performance levels for evaluating work quality

A rubric is a scoring guide that defines specific criteria and describes performance levels for each criterion, providing consistent and transparent evaluation standards.

Question 41: What is the purpose of a compliance training program in Certified Information Privacy Manager?

To reduce the number of regulations that apply
To educate personnel about applicable regulations and their responsibilities (Correct answer)
To replace written policies and procedures
To eliminate the need for audits

Correct answer: To educate personnel about applicable regulations and their responsibilities

Compliance training programs educate employees about relevant regulations, organizational policies, and individual responsibilities, helping prevent violations and promote a culture of compliance.

Question 42: Under GDPR Article 17, which of the following would allow a data controller to REFUSE an erasure request?

The data was collected more than two years ago
The data subject no longer uses the service
The data subject's contract has expired
The data is needed for exercising the right of legal defense (Correct answer)

Correct answer: The data is needed for exercising the right of legal defense

Under GDPR Article 17, data controllers may refuse erasure requests when the data is necessary for establishing, exercising, or defending legal claims.

Question 43: What is the purpose of competency-based training in Certified Information Privacy Manager?

To replace all classroom instruction with reading
To provide entertainment during work hours
To ensure learners can demonstrate specific skills before advancing (Correct answer)
To cover as much content as possible in limited time

Correct answer: To ensure learners can demonstrate specific skills before advancing

Competency-based training focuses on learners demonstrating mastery of specific, defined competencies before progressing, ensuring they can actually perform required skills rather than just completing seat time.

Question 44: What is the primary purpose of a Data Subject Access Request (DSAR)?

To allow individuals to obtain a copy of their personal data (Correct answer)
To allow individuals to correct their data
To allow individuals to opt out of marketing
To allow individuals to delete their data

Correct answer: To allow individuals to obtain a copy of their personal data

A DSAR enables individuals to obtain a copy of their personal data held by an organization and learn how it is being processed.

Question 45: Under GDPR, when may organizations charge a fee for responding to a data subject access request?

Always, to cover administrative costs
Only for requests that are manifestly unfounded or excessive (Correct answer)
Only for requests involving more than 100 records
Never under any circumstances

Correct answer: Only for requests that are manifestly unfounded or excessive

GDPR allows organizations to charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, particularly repetitive ones.

Question 46: What is 'residual risk' in the context of a privacy risk management program?

Risk arising from regulatory non-compliance only
Risk transferred to a third-party vendor
The initial risk before any assessment is done
The risk that remains after privacy controls and mitigations have been applied (Correct answer)

Correct answer: The risk that remains after privacy controls and mitigations have been applied

Residual risk is the level of risk that remains after the organization has implemented its chosen controls and mitigation measures, which management must accept or address further.

Question 47: Which approach is most effective for mastering privacy operations in Certified Information Privacy Manager?

Combining theoretical study with practical application and regular review (Correct answer)
Relying solely on on-the-job experience
Memorizing textbook definitions without understanding
Studying only immediately before examinations

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 48: Which best practice most effectively helps organizations demonstrate the ongoing validity of consent for marketing communications?

Maintaining timestamped records of when, how, and to what individuals consented (Correct answer)
Storing only original IP addresses as proof of consent
Re-requesting consent from all subscribers every 30 days
Encrypting all consent collection forms to prevent tampering

Correct answer: Maintaining timestamped records of when, how, and to what individuals consented

Maintaining detailed records with timestamps, the exact consent language presented, and the collection method provides the audit trail needed to demonstrate valid and current consent.

Question 49: In Certified Information Privacy Manager, what is the primary purpose of formative assessment?

To determine eligibility for advancement only
To assign final grades at the end of a program
To rank individuals against each other
To monitor progress and provide feedback during the learning or development process (Correct answer)

Correct answer: To monitor progress and provide feedback during the learning or development process

Formative assessment is conducted during the process to monitor progress, identify areas needing improvement, and provide timely feedback that can guide adjustments.

Question 50: Under CCPA, what term is used for the consumer right equivalent to GDPR's right to erasure?

Right to delete (Correct answer)
Right to know
Right to non-discrimination
Right to opt-out

Correct answer: Right to delete

The CCPA uses the term 'right to delete' for consumers to request deletion of their personal information collected by businesses.

Question 51: What is the primary purpose of a Consent Management Platform (CMP)?

To automatically generate privacy notices for websites
To collect, store, and manage records of user consents (Correct answer)
To encrypt personal data before it is stored
To monitor and respond to data breach incidents

Correct answer: To collect, store, and manage records of user consents

A CMP helps organizations obtain, record, and manage user consents, enabling them to demonstrate compliance and honor consent withdrawal requests.

Question 52: How should an organization prioritize privacy risks identified during an assessment?

By focusing only on risks that have resulted in past incidents
By evaluating the likelihood of harm and the severity of impact on data subjects (Correct answer)
By addressing the most expensive risks first
By prioritizing risks flagged by external auditors exclusively

Correct answer: By evaluating the likelihood of harm and the severity of impact on data subjects

Privacy risk prioritization involves assessing both the probability that harm will occur and the severity of that harm to individuals, enabling resources to focus on the highest-impact risks first.

Question 53: Which of the following best defines "data integrity"?

Backing up data regularly
Ensuring data is accurate and unaltered (Correct answer)
Making data available to users at all times
Restricting access to data

Correct answer: Ensuring data is accurate and unaltered

Data integrity involves maintaining and assuring the accuracy and consistency of data over its lifecycle.

Question 54: What is the significance of conducting a privacy impact assessment (PIA)?

To develop new marketing strategies
To evaluate the risks and impacts of processing personal data (Correct answer)
To increase data storage capacity
To measure employee performance

Correct answer: To evaluate the risks and impacts of processing personal data

PIAs help identify and mitigate potential privacy risks related to data processing activities.

Question 55: In Certified Information Privacy Manager, why is privacy operations knowledge important for professional certification?

It demonstrates competence and ensures practitioners meet established standards (Correct answer)
It has no practical relevance to daily work
It is only required for administrative purposes
It is important only for entry-level positions

Correct answer: It demonstrates competence and ensures practitioners meet established standards

Professional certification in specific knowledge areas demonstrates that practitioners have met established competency standards, ensuring quality of service and public protection.

Question 56: If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?

Provide role-specific training to areas where breaches are happening so they are more aware.
Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt. (Correct answer)
Carry out a root cause analysis on each breach to understand why the incident happened.
Communicate to everyone that breaches must be reported and how they should be reported.

Correct answer: Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt.

Distributing a phishing exercise to all employees is not advisable to do if your organization has a recurring issue with colleagues not reporting personal data breaches. A phishing exercise is a simulated attack that tests the awareness and response of employees to malicious emails that attempt to obtain sensitive information or compromise systems. While phishing exercises can be useful to train employees on how to recognize and avoid phishing attacks, they are not directly related to the issue of reporting personal data breaches. The other options are more appropriate to address the root cause of the issue, communicate the expectations and procedures for reporting breaches, and provide specific training to areas where breaches are happening

Question 57: When a data breach incident has occurred. the first priority is to determine?

When the breach occurred.
How to contain the breach. (Correct answer)
Who caused the breach.
How the breach occurred.

Correct answer: How to contain the breach.

When a data breach incident has occurred, the first priority is to determine how to contain the breach. Containment means stopping or minimizing the further loss or unauthorized disclosure of personal data, as well as preserving evidence for investigation and remediation. Containment may involve isolating affected systems, devices, or networks; changing access credentials; blocking malicious IP addresses; or notifying relevant parties such as law enforcement or security experts. After containing the breach, the next steps are to assess the impact and severity of the breach, notify the affected individuals and authorities if required, evaluate the causes and risks of the breach, and implement measures to prevent future breaches.

Question 58: What is the purpose of a wireframe in Certified Information Privacy Manager privacy by design?

To produce a final, polished design ready for production
To write the technical code for implementation
To create a simplified visual guide showing the structure and layout of a design (Correct answer)
To test the physical durability of materials

Correct answer: To create a simplified visual guide showing the structure and layout of a design

A wireframe is a simplified, low-fidelity visual representation of a design's structure and layout, used for planning and communication before detailed design work begins.

Question 59: Under GDPR, what determines how long a previously obtained consent record remains valid?

Consents expire after two years by regulation
Consent remains valid until the purpose is fulfilled or the individual withdraws it (Correct answer)
Consents expire after one year automatically
Consent is valid forever unless the controller chooses to refresh it

Correct answer: Consent remains valid until the purpose is fulfilled or the individual withdraws it

Consent remains valid only as long as the processing purpose exists and the individual has not withdrawn it; organizations should periodically review consent records.

Question 60: In Certified Information Privacy Manager, what is blended learning?

Combining multiple instructional methods such as online and face-to-face training (Correct answer)
Mixing different age groups in the same class
Using only online resources for all training
Having one instructor teach all subjects

Correct answer: Combining multiple instructional methods such as online and face-to-face training

Blended learning combines different instructional modalities (e.g., face-to-face, online, self-paced) to leverage the strengths of each approach and create a more effective learning experience.

Question 61: What does validity mean in the context of assessment within Certified Information Privacy Manager?

The assessment takes minimal time to complete
The assessment is easy to administer
The assessment measures what it is intended to measure (Correct answer)
The assessment produces consistent results over time

Correct answer: The assessment measures what it is intended to measure

Validity refers to whether an assessment actually measures the construct or skill it claims to measure. A valid assessment produces meaningful and accurate results for its intended purpose.

Question 62: In the US, which federal law grants individuals rights to access and correct records about themselves held by federal agencies?

FERPA
HIPAA
The Privacy Act of 1974 (Correct answer)
COPPA

Correct answer: The Privacy Act of 1974

The Privacy Act of 1974 grants US citizens and lawful permanent residents rights to access and request correction of records held about them by federal agencies.

Question 63: Which four options are commonly used to treat privacy risks identified during a risk assessment?

Avoid, mitigate, transfer, and accept (Correct answer)
Encrypt, pseudonymize, anonymize, and delete
Detect, respond, recover, and review
Identify, assess, remediate, and report

Correct answer: Avoid, mitigate, transfer, and accept

The four standard risk treatment options are: avoid (stop the risky activity), mitigate (reduce the risk), transfer (share risk via insurance or contracts), and accept (acknowledge and proceed with residual risk).

Question 64: Which of the following is a physical control that can limit privacy risk?

Keypad or biometric access. (Correct answer)
Tokenization.
Encryption
user access reviews.

Correct answer: Keypad or biometric access.

A physical control that can limit privacy risk is keypad or biometric access. This is a type of access control that restricts who can enter or access a physical location or device where personal data is stored or processed. Keypad or biometric access requires a code or a biological feature (such as a fingerprint or a face scan) to authenticate the identity and authorization of the person seeking access. This can prevent unauthorized access, theft, loss, or damage of personal data by outsiders or insiders.

Question 65: What is the primary goal of threat modeling in a privacy risk management context?

To respond to active data breaches in real time
To identify potential threats to personal data and design controls before they are exploited (Correct answer)
To audit vendor privacy practices
To train employees on phishing awareness

Correct answer: To identify potential threats to personal data and design controls before they are exploited

Threat modeling proactively identifies potential adversaries, attack vectors, and vulnerabilities that could compromise personal data, enabling the design of appropriate preventive controls.

Question 66: Which of the following is an example of a technical control in information security?

Firewalls and intrusion detection systems (Correct answer)
Employee training programs
Security policies
Security awareness campaigns

Correct answer: Firewalls and intrusion detection systems

Technical controls include hardware and software mechanisms used to protect information systems and data.

Question 67: Respond'' in the privacy operational lifecycle includes which of the following?

Communication to stakeholders and alignment to laws.
Information security practices and functional area integration.
Information requests and privacy rights requests. (Correct answer)
Privacy awareness training and compliance monitoring.

Correct answer: Information requests and privacy rights requests.

'Respond'' in the privacy operational lifecycle includes information requests and privacy rights requests, which are requests from individuals or authorities to access, correct, delete, or restrict the processing of personal data. The privacy program must have processes and procedures to handle such requests in a timely and compliant manner. The other options are not part of the ''respond'' phase, but rather belong to other phases such as ''protect'', ''aware'', or ''align'.

Question 68: What is the difference between qualitative and quantitative research in Certified Information Privacy Manager?

Qualitative explores experiences and meanings; quantitative measures and counts numerical data (Correct answer)
There is no meaningful difference between them
Quantitative cannot be used in social sciences
Qualitative is always more rigorous than quantitative

Correct answer: Qualitative explores experiences and meanings; quantitative measures and counts numerical data

Qualitative research explores experiences, perceptions, and meanings through methods like interviews and observation. Quantitative research measures variables numerically through surveys, experiments, and statistical analysis.

Question 69: What is the difference between reliability and validity in Certified Information Privacy Manager assessment?

Reliability refers to consistency of results; validity refers to accuracy of measurement (Correct answer)
Reliability applies only to written tests; validity applies only to practical tests
They are synonymous terms with identical meanings
Reliability is about speed; validity is about cost

Correct answer: Reliability refers to consistency of results; validity refers to accuracy of measurement

Reliability means the assessment produces consistent, stable results across repeated administrations. Validity means the assessment accurately measures what it is intended to measure. Both are needed for quality assessment.

Question 70: Which of the following best describes a data retention schedule?

A log of all employees who accessed personal data
A document mapping data categories to their required retention periods and disposal methods (Correct answer)
A backup policy for archiving data to offsite storage
A list of data subjects who have opted out of data collection

Correct answer: A document mapping data categories to their required retention periods and disposal methods

A data retention schedule maps each category of data to its mandated or appropriate retention period and the method of secure disposal at end of life.

Question 71: A systems audit uncovered a shared drive folder containing sensitive employee data with no access controls and therefore was available for all employees to view. What is the first step to mitigate further risks?

Check access logs to see who accessed the folder.
Notify legal counsel of a privacy incident.
Restrict access to the folder. (Correct answer)
Notify all employees whose information was contained in the file.

Correct answer: Restrict access to the folder.

The first step to mitigate further risks when a systems audit uncovers a shared drive folder containing sensitive employee data with no access controls is to restrict access to the folder. This can be done by implementing appropriate access controls, such as user authentication, role-based access, and permissions, to ensure that only authorized individuals can view and access the sensitive data.

Question 72: What is the fundamental difference between opt-in and opt-out consent models?

Opt-in is a US regulatory requirement; opt-out is the GDPR standard
Opt-in requires active agreement before processing; opt-out assumes consent exists unless the individual declines (Correct answer)
Opt-in requires a written signature; opt-out can be communicated verbally
Opt-in is only required for marketing; opt-out is required for all processing activities

Correct answer: Opt-in requires active agreement before processing; opt-out assumes consent exists unless the individual declines

Opt-in models require individuals to actively indicate consent before processing occurs, while opt-out models assume consent exists unless the individual takes action to decline.

Question 73: In Certified Information Privacy Manager, what are the fundamental principles of privacy by design?

Only color and size considerations
Balance, contrast, emphasis, movement, pattern, rhythm, and unity (Correct answer)
Using as many elements as possible
Speed of completion and cost efficiency

Correct answer: Balance, contrast, emphasis, movement, pattern, rhythm, and unity

The fundamental principles of design include balance, contrast, emphasis, movement, pattern, rhythm, and unity, which work together to create visually effective and functional compositions.

Question 74: When establishing retention periods, which factor should take highest priority?

Internal storage cost reduction targets
Vendor contract terms
Employee convenience and workflow preferences
Legal and regulatory requirements (Correct answer)

Correct answer: Legal and regulatory requirements

Legal and regulatory requirements set the minimum baseline for retention periods, and failure to comply can result in penalties and liability.

Question 75: Which approach is most effective for mastering incident response in Certified Information Privacy Manager?

Relying solely on on-the-job experience
Studying only immediately before examinations
Memorizing textbook definitions without understanding
Combining theoretical study with practical application and regular review (Correct answer)

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 76: Which right allows individuals to move their personal data from one service provider to another?

Right to rectification
Right to data portability (Correct answer)
Right to object
Right to restriction

Correct answer: Right to data portability

The right to data portability allows individuals to receive their personal data in a machine-readable format and transfer it to another controller.

Question 77: Which management approach in Certified Information Privacy Manager emphasizes continuous improvement through small, incremental changes?

Complete organizational restructuring
Crisis management approach
Laissez-faire management
Kaizen methodology (Correct answer)

Correct answer: Kaizen methodology

Kaizen is a Japanese management philosophy that focuses on continuous improvement through small, incremental changes involving all employees, leading to sustained improvement over time.

Question 78: Under GDPR, within how many days must a data controller respond to a data subject access request (DSAR)?

30 days (Correct answer)
45 days
14 days
60 days

Correct answer: 30 days

GDPR requires data controllers to respond to DSARs within one month (approximately 30 days) of receiving the request.

Question 79: In Certified Information Privacy Manager, what role does continuing education play in privacy operations?

To replace initial certification requirements
To keep professionals current with evolving standards, technologies, and best practices (Correct answer)
To increase testing frequency for compliance purposes
To prevent professionals from advancing in their careers

Correct answer: To keep professionals current with evolving standards, technologies, and best practices

Continuing education ensures professionals stay current with new developments, evolving standards, and emerging best practices in their field, maintaining competence throughout their careers.

Question 80: Which of the following best describes due diligence in Certified Information Privacy Manager privacy regulations?

Relying solely on past experience
Conducting thorough investigation and analysis before making decisions (Correct answer)
Following only the most basic requirements
Making quick decisions without research

Correct answer: Conducting thorough investigation and analysis before making decisions

Due diligence involves comprehensive investigation, analysis, and verification of relevant facts before making decisions, ensuring all regulatory and professional requirements are understood and met.

Question 81: Which approach is most effective for mastering monitoring and auditing in Certified Information Privacy Manager?

Memorizing textbook definitions without understanding
Combining theoretical study with practical application and regular review (Correct answer)
Studying only immediately before examinations
Relying solely on on-the-job experience

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 82: What is the primary purpose of stakeholder analysis in Certified Information Privacy Manager vendor management?

To evaluate employee attendance records
To identify and understand the interests and influence of all parties affected by decisions (Correct answer)
To schedule project timelines
To calculate financial returns on investment

Correct answer: To identify and understand the interests and influence of all parties affected by decisions

Stakeholder analysis identifies all parties who have an interest in or are affected by a project or decision, assessing their level of influence and interest to develop appropriate engagement strategies.

Question 83: What must an organization verify before fulfilling a data subject rights request?

The subject's country of residence
The subject's credit score
The subject's employment status
The identity of the requestor (Correct answer)

Correct answer: The identity of the requestor

Organizations must verify the identity of the person making a data subject rights request before fulfilling it to prevent unauthorized disclosure.

Question 84: An organization's HR department wants to retain employee performance reviews indefinitely for historical benchmarking. What should the privacy officer advise?

Approve the request as HR data is generally exempt from retention limitations
Allow indefinite retention provided the data is encrypted
Deny the request and establish a defined retention period tied to a legitimate purpose, with a disposal process (Correct answer)
Transfer the records to a third-party HR firm to remove organizational liability

Correct answer: Deny the request and establish a defined retention period tied to a legitimate purpose, with a disposal process

Storage limitation principles prohibit indefinite retention of personal data; the privacy officer should work with HR to define a purpose-based retention period and secure disposal process.

Question 85: Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?

Forward the request to the contact on file for the client asking them how they would like you to proceed.
Redirect the individual back to their employer to understand their rights and how this might impact access to company tools. (Correct answer)
Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.
Process the request assuming that the individual understands the implications to their organization if their information is deleted.

Correct answer: Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.

If your organization provides a SaaS tool for B2B services and does not interact with individual consumers, and a client's current employee reaches out with a right to delete request, the most appropriate response is to redirect the individual back to their employer to understand their rights and how this might impact access to company tools. This is because your organization is acting as a processor for the client, who is the controller of the employee's personal data.

Question 86: In Certified Information Privacy Manager, what is the primary function of strategic planning in vendor management?

To set long-term goals and determine the best approach to achieve them (Correct answer)
To manage the organization's social media presence
To conduct annual performance reviews
To handle day-to-day operational tasks

Correct answer: To set long-term goals and determine the best approach to achieve them

Strategic planning involves defining the organization's direction, making decisions on allocating resources, and establishing priorities to achieve long-term objectives.

Question 87: When personal data is collected for research purposes under GDPR, what special retention provision applies?

Research is exempt from all retention requirements once ethics board approval is obtained
Research data can only be retained if data subjects provide renewed consent annually
Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place (Correct answer)
Research data must be deleted within 12 months of collection regardless of the research timeline

Correct answer: Data may be kept longer than the original purpose would allow, provided appropriate safeguards such as pseudonymization are in place

GDPR Article 89 permits derogations to the storage limitation for research purposes when appropriate safeguards like pseudonymization protect data subject rights.

Question 88: In privacy risk management, what does 'inherent risk' refer to?

The risk remaining after all controls have been implemented
Risk arising from third-party vendors only
Risk identified after a privacy breach
The level of risk present before any controls or mitigations are applied (Correct answer)

Correct answer: The level of risk present before any controls or mitigations are applied

Inherent risk is the raw level of risk associated with a processing activity before any privacy or security controls are applied to reduce it.

Question 89: Which NIST publication provides a voluntary privacy framework to help organizations manage privacy risk?

NIST Privacy Framework Version 1.0 (Correct answer)
NIST SP 800-53
NIST Cybersecurity Framework 2.0
NIST SP 800-37

Correct answer: NIST Privacy Framework Version 1.0

The NIST Privacy Framework Version 1.0, published in January 2020, provides a voluntary, flexible tool for organizations to manage privacy risk through five functions: Identify, Govern, Control, Communicate, and Protect.

Question 90: What is the relationship between theory and practice in Certified Information Privacy Manager privacy program governance?

Theory provides the foundation and framework that guides effective practical application (Correct answer)
Practice is only important; theory is unnecessary
Theory and practice are completely unrelated
Theory replaces the need for any practical experience

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

CIPM Certified Information Privacy Manager Exam

The CIPM (Certified Information Privacy Manager) Exam, administered by IAPP (International Association of Privacy Professionals), certifies professionals who manage privacy programs within organizations. It covers developing a privacy framework, establishing program governance, assessing data, protecting personal data, sustaining program performance, and responding to data subject requests and incidents.

Questions

150 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

store.iapp.org — Test delivery, fees, exam format · verified Oct 2026
iapp.org — Retake fee · verified Oct 2026
assets.contentstack.io — Renewal, score validity, passing score, retake policy, score release, test dates · verified Oct 2026