Certified Information Privacy Professional/United States (CIPP/US) Exam — Questions and Answers

Question 1: What does the acronym HIPAA stand for?

Health Information Privacy and Access Act
Health Industry Professional Accreditation Act
Health Insurance Portability and Accountability Act (Correct answer)
Healthcare Integrity Protection and Accountability Act

Correct answer: Health Insurance Portability and Accountability Act

HIPAA stands for the Health Insurance Portability and Accountability Act, a federal law enacted in 1996. Its primary purpose is to protect sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA establishes national standards for the security of electronic protected health information (ePHI) and sets rules for how healthcare providers, health plans, and other entities handle and transmit patient data.

Question 2: The CAN-SPAM Act requires commercial email senders to include which of the following in every message?

Opt-in confirmation from each recipient
End-to-end encryption of message content
A clear and conspicuous opt-out mechanism (Correct answer)
Prior written consent from all recipients

Correct answer: A clear and conspicuous opt-out mechanism

CAN-SPAM requires that all commercial emails include a functioning opt-out mechanism that must be honored within 10 business days.

Question 3: Which foundational principle is most critical to professional practice in this field?

Following only traditional methods without adaptation
Evidence-based decision making and continuous improvement (Correct answer)
Maximizing revenue above all other considerations
Prioritizing speed over accuracy in all situations

Correct answer: Evidence-based decision making and continuous improvement

Evidence-based decision making ensures that professional practices are grounded in proven methodologies and current best practices.

Question 4: What is the purpose of a privacy impact assessment (PIA)?

To create employee schedules
To develop marketing strategies
To measure website performance
To evaluate privacy risks and ensure compliance (Correct answer)

Correct answer: To evaluate privacy risks and ensure compliance

A Privacy Impact Assessment (PIA) is a systematic process used to identify, assess, and mitigate privacy risks associated with new projects, systems, or processes that involve the collection, use, or disclosure of personal information. Its purpose is to ensure that privacy considerations are embedded from the outset, helping organizations comply with privacy laws and protect individuals' data.

Question 5: Under the FCRA, how long before taking adverse employment action must an employer wait after providing the pre-adverse action notice?

72 hours
A reasonable period of time (generally interpreted as at least 5 business days) (Correct answer)
30 calendar days
No waiting period is required; the notice is purely informational

Correct answer: A reasonable period of time (generally interpreted as at least 5 business days)

FCRA requires a 'reasonable period of time' between the pre-adverse action notice and final adverse action, which the FTC has interpreted as approximately five business days.

Question 6: Under the Computer Fraud and Abuse Act (CFAA), unauthorized access to a protected computer system is classified as:

A federal crime subject to criminal and civil liability (Correct answer)
An issue governed solely by state law
Not regulated unless financial data is stolen
A civil matter subject only to private lawsuits

Correct answer: A federal crime subject to criminal and civil liability

The CFAA makes unauthorized access to protected computers a federal crime and also provides a civil cause of action for victims.

Question 7: What is the purpose of a feedback mechanism in professional communication?

To evaluate employee performance
To generate metrics for annual reports
To document complaints for legal purposes only
To ensure messages are received, understood, and to identify areas for improvement (Correct answer)

Correct answer: To ensure messages are received, understood, and to identify areas for improvement

Feedback mechanisms verify that communication is effective by confirming messages are received and understood, while also identifying opportunities to improve communication processes.

Question 8: Under HIPAA, a 'business associate' is best described as:

A patient's authorized personal representative
An employee of a covered entity who handles PHI
A person or entity that performs functions on behalf of a covered entity that involve the use or disclosure of PHI (Correct answer)
A government health oversight agency

Correct answer: A person or entity that performs functions on behalf of a covered entity that involve the use or disclosure of PHI

A business associate is a person or organization that performs services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI.

Question 9: Which federal law gives the FTC authority to regulate unfair or deceptive trade practices?

Privacy Act of 1974
Communications Act
Federal Trade Commission Act (Correct answer)
Health Insurance Portability Act

Correct answer: Federal Trade Commission Act

The Federal Trade Commission Act (FTC Act) is the foundational law that established the Federal Trade Commission and granted it broad authority to prevent unfair methods of competition and unfair or deceptive acts or practices in commerce. This authority is the basis for the FTC's extensive role in enforcing consumer protection and privacy laws in the United States.

Question 10: What is the first phase of strategic planning?

Performance evaluation and reporting
Implementation of tactical initiatives
Environmental analysis and assessment of current position (Correct answer)
Budget allocation and resource distribution

Correct answer: Environmental analysis and assessment of current position

Strategic planning begins with analyzing the current environment, including internal strengths and weaknesses and external opportunities and threats (SWOT analysis).

Question 11: The FTC Act's authority to regulate health data practices applies in which of the following circumstances?

Only to entities already subject to HIPAA
Only when a data breach has already occurred
Only to pharmaceutical manufacturers
To companies not covered by HIPAA that collect health-related information, under the prohibition on unfair or deceptive practices (Correct answer)

Correct answer: To companies not covered by HIPAA that collect health-related information, under the prohibition on unfair or deceptive practices

The FTC uses Section 5 of the FTC Act to regulate health data privacy for entities outside HIPAA's scope, such as fitness apps and direct-to-consumer health platforms.

Question 12: What does the concept of 'reasonable expectation of privacy' from Katz v. United States mean in the context of public-sector workplace monitoring?

Government employees may have Fourth Amendment protections against unreasonable searches of their workplace spaces (Correct answer)
Government employees have no privacy rights in any government-owned property
Only private-sector employees can invoke the reasonable expectation of privacy doctrine
Reasonable expectation of privacy applies only to physical spaces, not digital communications

Correct answer: Government employees may have Fourth Amendment protections against unreasonable searches of their workplace spaces

The Katz standard establishes that government employees can have Fourth Amendment protections against unreasonable workplace searches, subject to balancing tests.

Question 13: When a company uses a cloud service provider to process personal data on its behalf, the cloud provider is typically considered a:

Regulatory authority
Independent third party with no restrictions
Data controller
Service provider or data processor (Correct answer)

Correct answer: Service provider or data processor

A cloud provider processing data on behalf of a customer acts as a service provider or processor, bound by the customer's instructions and applicable contractual obligations.

Question 14: Under COPPA, operators of websites or online services directed to children must obtain verifiable parental consent before collecting personal information from children under what age?

Under 21
Under 16
Under 13 (Correct answer)
Under 18

Correct answer: Under 13

COPPA protects children under 13 by requiring verifiable parental consent before operators collect, use, or disclose their personal information.

Question 15: An employer in California wants to monitor employee social media accounts. Which California law most directly addresses this practice?

California Labor Code Section 980, which prohibits employers from demanding access to personal social media accounts (Correct answer)
The California Confidentiality of Medical Information Act (CMIA)
California's unfair business practices statute under Business & Professions Code Section 17200
The California Consumer Privacy Act (CCPA), which treats employee social media as personal data

Correct answer: California Labor Code Section 980, which prohibits employers from demanding access to personal social media accounts

California Labor Code Section 980 prohibits employers from requiring employees or applicants to disclose their personal social media usernames or passwords.

Question 16: Why is data mapping critical to privacy compliance?

It helps develop advertisements.
It ensures better customer service only.
It slows down compliance efforts.
It helps track how personal data is collected, stored, and used (Correct answer)

Correct answer: It helps track how personal data is collected, stored, and used

Data mapping is a foundational process for privacy compliance as it creates a visual representation or inventory of an organization's data flows. By identifying where personal data originates, where it is stored, how it is processed, and with whom it is shared, organizations can understand their privacy risks, demonstrate accountability, and ensure compliance with various data protection regulations.

Question 17: Why is regular risk reassessment important?

Because the risk landscape changes as conditions, activities, and environments evolve (Correct answer)
Because regulators require it exactly once per year
Because initial assessments are always wrong
Because it provides work for risk management teams

Correct answer: Because the risk landscape changes as conditions, activities, and environments evolve

Regular risk reassessment is essential because risks are dynamic — new threats emerge, existing risks change in severity, and the effectiveness of controls may vary over time.

Question 18: What is the most important element of effective professional communication?

Clarity and accuracy of the message tailored to the audience (Correct answer)
Communicating as quickly as possible
Sending messages through multiple channels simultaneously
Using the most technical language possible

Correct answer: Clarity and accuracy of the message tailored to the audience

Effective professional communication requires clarity and accuracy, with the message tailored to the audience's level of understanding and needs.

Question 19: What constitutes a conflict of interest in professional practice?

When a client requests a service outside normal hours
When multiple projects have the same deadline
When two colleagues disagree on a procedure
When personal interests could improperly influence professional judgment (Correct answer)

Correct answer: When personal interests could improperly influence professional judgment

A conflict of interest occurs when personal, financial, or other interests could compromise or appear to compromise professional objectivity and judgment.

Question 20: The HIPAA Privacy Rule's 'minimum necessary' standard requires covered entities to:

Delete patient records within one year of the last treatment
Collect as much patient data as possible for comprehensive care
Obtain written patient consent before every internal use of PHI
Limit PHI uses and disclosures to the minimum necessary to accomplish the intended purpose (Correct answer)

Correct answer: Limit PHI uses and disclosures to the minimum necessary to accomplish the intended purpose

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI access and disclosure to only what is needed for the specific purpose.

Question 21: What is the main objective of a data retention policy?

To increase file sizes.
To comply with data storage and deletion timelines (Correct answer)
To block user access to data.
To ensure infinite data storage.

Correct answer: To comply with data storage and deletion timelines

The main objective of a data retention policy is to define how long specific types of data should be kept and when they should be securely disposed of. This policy ensures compliance with legal, regulatory, and business requirements for data storage, minimizes the risk associated with holding excessive data, and supports efficient information lifecycle management.

Question 22: Under HIPAA, how must an employer handle employee health information obtained through a self-insured health plan?

It is exempt from HIPAA because employment records are excluded
It must be destroyed within 60 days of receipt
It may be freely shared with supervisors for accommodation purposes
It must be kept separate from other personnel records and accessed only by those who need it to administer the plan (Correct answer)

Correct answer: It must be kept separate from other personnel records and accessed only by those who need it to administer the plan

HIPAA requires employers who sponsor self-insured health plans to maintain health information separately and limit access to plan administration personnel only.

Question 23: Which of the following is the best practice when an employer wants to implement video surveillance of the workplace?

Obtain signed waivers from each employee consenting to 24-hour surveillance
Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms (Correct answer)
Install cameras in all areas including restrooms to deter theft
Notify only senior management and security personnel to preserve the deterrent effect

Correct answer: Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms

Best practice requires advance notice to employees and avoidance of locations (restrooms, changing rooms) where employees retain a reasonable expectation of privacy, balancing business interests with employee rights.

Question 24: Under the Stored Communications Act (SCA), which of the following employer actions would most likely be permissible?

Accessing emails stored on the company's own email server without employee consent (Correct answer)
Compelling a third-party cloud provider to disclose employee personal communications without legal process
Intercepting employee messages on a third-party messaging platform in real time
Accessing an employee's personal Gmail account without consent

Correct answer: Accessing emails stored on the company's own email server without employee consent

The SCA generally permits system operators (including employers) to access communications stored on their own systems, as they are considered an authorized party.

Question 25: When an employer uses a third-party vendor to conduct social media screening of job applicants, the employer must be aware that this practice may trigger obligations under:

HIPAA, because social media may contain protected health information
The ADA, because social media may reveal disability status
The ECPA, because accessing social media constitutes electronic interception
The FCRA, if the vendor is considered a consumer reporting agency compiling consumer reports (Correct answer)

Correct answer: The FCRA, if the vendor is considered a consumer reporting agency compiling consumer reports

If a third-party vendor compiles social media information into a report used for employment decisions, it may constitute a consumer report under FCRA, triggering disclosure and adverse action requirements.

Question 26: A terminated employee requests access to their personnel file. Under which legal framework are they most likely to have this right?

State law, as there is no federal law granting private-sector employees access to their personnel files (Correct answer)
HIPAA, because personnel files contain health-related information
The FCRA, which mandates employer disclosure of all records used in employment decisions
The Privacy Act of 1974, which covers all employment records

Correct answer: State law, as there is no federal law granting private-sector employees access to their personnel files

The right of private-sector employees to access their personnel files is governed by state law; states like California, Michigan, and Illinois have specific personnel file access statutes.

Question 27: What is the first step in the risk management process?

Risk acceptance — deciding to live with all risks
Risk transfer — purchasing insurance immediately
Risk avoidance — canceling all activities
Risk identification — recognizing potential threats and vulnerabilities (Correct answer)

Correct answer: Risk identification — recognizing potential threats and vulnerabilities

Risk identification is the critical first step in risk management, involving systematic recognition and documentation of potential threats and vulnerabilities.

Question 28: What does a risk matrix assess?

The number of employees affected
Only the financial cost of risks
The probability and impact of identified risks (Correct answer)
The timeline for risk resolution

Correct answer: The probability and impact of identified risks

A risk matrix evaluates risks based on two dimensions: the probability (likelihood) of occurrence and the potential impact (severity) if the risk materializes.

Question 29: Which of the following best describes the general legal standard for employee privacy expectations in the workplace?

Employees retain full Fourth Amendment protections in private workplaces
Employees have a diminished expectation of privacy compared to the general public (Correct answer)
Employees and employers share equal privacy rights in the workplace
Employers may never monitor employee communications without a court order

Correct answer: Employees have a diminished expectation of privacy compared to the general public

Courts generally recognize that employees have a reduced expectation of privacy in the workplace, particularly when using employer-owned equipment and systems.

Question 30: Which document established the FTC's framework recommending that companies build privacy protections into their practices from the start rather than as an afterthought?

The Safe Harbor Framework
The COPPA Rule
Protecting Consumer Privacy in an Era of Rapid Change (FTC Privacy Report) (Correct answer)
The NIST Cybersecurity Framework

Correct answer: Protecting Consumer Privacy in an Era of Rapid Change (FTC Privacy Report)

The FTC's 2012 report 'Protecting Consumer Privacy in an Era of Rapid Change' recommended privacy by design, simplified consumer choice, and greater transparency as core principles.

Question 31: Which method helps verify if the privacy program is effective?

Sales performance reviews
New product launches
Technical support calls
Privacy audits and compliance assessments (Correct answer)

Correct answer: Privacy audits and compliance assessments

Privacy audits and compliance assessments are systematic evaluations that review an organization's privacy practices, policies, and procedures against established standards and regulations. These methods are crucial for verifying the effectiveness of a privacy program. They help identify gaps, weaknesses, and areas of non-compliance, providing objective evidence for continuous improvement and accountability in privacy management.

Question 32: Why is stakeholder buy-in important for strategic implementation?

Because it eliminates the need for project management
Because successful implementation requires support and cooperation from those affected (Correct answer)
Because it generates positive media coverage
Because it is a legal requirement in all organizations

Correct answer: Because successful implementation requires support and cooperation from those affected

Stakeholder buy-in is critical because successful implementation depends on the active support, cooperation, and engagement of the people who will be affected by or involved in executing the strategy.

Question 33: The Electronic Communications Privacy Act (ECPA) primarily regulates which of the following?

Interception of wire, oral, and electronic communications (Correct answer)
Collection of children's online data
Sharing of financial information among affiliates
Healthcare data breach notifications

Correct answer: Interception of wire, oral, and electronic communications

ECPA regulates government and private interception of wire, oral, and electronic communications, as well as access to stored electronic communications.

Question 34: Which federal law primarily governs the privacy of employee polygraph testing in the private sector?

The Employee Polygraph Protection Act (EPPA) (Correct answer)
The Fair Labor Standards Act (FLSA)
The Privacy Act of 1974
The National Labor Relations Act (NLRA)

Correct answer: The Employee Polygraph Protection Act (EPPA)

The Employee Polygraph Protection Act (EPPA) generally prohibits most private employers from using polygraph tests for pre-employment screening or during employment.

Question 35: What enforcement power does the FTC NOT have?

Enforce consent decrees
Investigate unfair practices
Issue criminal indictments (Correct answer)
Pursue civil penalties

Correct answer: Issue criminal indictments

While the Federal Trade Commission (FTC) has broad powers to investigate unfair or deceptive practices, pursue civil penalties, and enforce consent decrees, it does not have the authority to issue criminal indictments. Criminal enforcement typically falls under the purview of the Department of Justice (DOJ) or state attorneys general.

Question 36: What is the consequence of non-compliance with mandatory regulations?

Penalties including fines, license revocation, and potential legal action (Correct answer)
A verbal warning with no further consequences
Reduced insurance premiums
Automatic extension of compliance deadline

Correct answer: Penalties including fines, license revocation, and potential legal action

Non-compliance with mandatory regulations can result in serious consequences including financial penalties, loss of licensure, and legal proceedings.

Question 37: How should best practices be adapted when applied to new situations?

Use them only if specifically required by regulation
Apply them exactly as written regardless of circumstances
Abandon them entirely and create new methods each time
Evaluate the specific context and modify as needed while maintaining core principles (Correct answer)

Correct answer: Evaluate the specific context and modify as needed while maintaining core principles

Best practices should be adapted to specific contexts and situations while maintaining their core principles and evidence-based foundations.

Question 38: The Driver's Privacy Protection Act (DPPA) restricts state DMVs from disclosing personal information contained in motor vehicle records except for:

Any purpose if the recipient signs a data use agreement
Any commercial purpose
Any use by a licensed private investigator
Permissible uses enumerated in the statute, such as government functions or litigation (Correct answer)

Correct answer: Permissible uses enumerated in the statute, such as government functions or litigation

The DPPA prohibits state DMVs from disclosing personal information from motor vehicle records except for the specific permissible uses listed in the statute.

Question 39: Which U.S. regulatory agency focuses on financial privacy and data protection?

FDA
FAA
CPUC
CFPB (Correct answer)

Correct answer: CFPB

The Consumer Financial Protection Bureau (CFPB) is a U.S. government agency responsible for consumer protection in the financial sector. It focuses on ensuring fair and transparent practices for financial products and services, including aspects related to financial privacy and the protection of consumer financial data.

Question 40: Which law grants consumers the right to access and delete their personal information in California?

FCRA
COPPA
HIPAA
CCPA (Correct answer)

Correct answer: CCPA

The California Consumer Privacy Act (CCPA) is a groundbreaking state law that grants California consumers significant rights over their personal information. Among these rights are the ability to know what personal data is being collected about them, to request its deletion, and to opt-out of its sale. The CCPA aims to enhance privacy protections and transparency for consumers regarding how businesses handle their data.

Question 41: Which approach best describes the integration of theory and practice in this profession?

Applying theoretical knowledge to solve real-world problems while adapting to specific contexts (Correct answer)
Ignoring theory and relying solely on experience
Following theory exactly without any modification
Using theory only during examinations

Correct answer: Applying theoretical knowledge to solve real-world problems while adapting to specific contexts

Effective professional practice involves applying theoretical foundations to real-world situations while adapting approaches to specific contexts and needs.

Question 42: The National Labor Relations Act (NLRA) intersects with workplace privacy because it:

Requires employers to preserve all employee communications for labor dispute resolution
Grants unions the right to access all employer monitoring records
Protects employees' rights to engage in concerted activities, which can limit how employers monitor and discipline workers for discussing wages or working conditions (Correct answer)
Prohibits all surveillance of union employees without NLRB approval

Correct answer: Protects employees' rights to engage in concerted activities, which can limit how employers monitor and discipline workers for discussing wages or working conditions

The NLRA protects concerted activity, meaning employer monitoring policies that chill employees' rights to discuss wages or working conditions may constitute unfair labor practices.

Question 43: Under most U.S. state data breach notification laws, notification obligations are triggered when:

Any employee accesses data outside normal hours
Personal information of state residents is compromised by unauthorized access or acquisition (Correct answer)
A company experiences any cybersecurity incident regardless of data exposure
A federal agency independently discovers the breach

Correct answer: Personal information of state residents is compromised by unauthorized access or acquisition

State breach notification laws are generally triggered when personal information of state residents is acquired or accessed by an unauthorized party, creating a risk of harm.

Question 44: What defines a "best practice" in professional settings?

Any procedure that is commonly used regardless of outcomes
The most expensive approach available
A method or technique that has consistently shown superior results through evidence (Correct answer)
A method recommended by a single authority

Correct answer: A method or technique that has consistently shown superior results through evidence

Best practices are methods or techniques that have consistently demonstrated superior results through evidence, research, and widespread professional validation.

Question 45: How should negative or difficult information be communicated to stakeholders?

Buried within positive information to minimize impact
Delayed until the situation has fully resolved
Only when specifically asked about it
Honestly and promptly, with proposed solutions or mitigation steps (Correct answer)

Correct answer: Honestly and promptly, with proposed solutions or mitigation steps

Negative information should be communicated honestly and promptly, accompanied by proposed solutions or mitigation plans to maintain trust and enable timely action.

Question 46: Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach of unsecured PHI within:

6 months of discovery
30 days of discovery
60 days of discovery (Correct answer)
90 days of discovery

Correct answer: 60 days of discovery

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of the breach.

Question 47: What should an organization do first when implementing a privacy program?

Conduct a privacy risk assessment (Correct answer)
Develop marketing materials
Implement encryption
Hire new staff

Correct answer: Conduct a privacy risk assessment

When implementing a privacy program, the first critical step is to conduct a comprehensive privacy risk assessment. This assessment identifies potential privacy risks, evaluates their likelihood and impact, and helps prioritize mitigation strategies. Understanding the risks allows an organization to build a privacy program that effectively addresses its specific challenges and compliance obligations.

Question 48: What is the purpose of setting SMART goals in strategic planning?

To create goals that are Specific, Measurable, Achievable, Relevant, and Time-bound (Correct answer)
To make goals Scale-able, Mobile, Accessible, Redundant, and Transparent
To ensure goals are Simple, Mandatory, Automatic, Routine, and Traditional
To define goals that are Strategic, Managed, Approved, Registered, and Tracked

Correct answer: To create goals that are Specific, Measurable, Achievable, Relevant, and Time-bound

SMART goals provide a framework for creating clear, actionable objectives that are Specific, Measurable, Achievable, Relevant, and Time-bound.

Question 49: Which risk response strategy involves reducing the likelihood or impact of a risk?

Risk escalation
Risk mitigation (Correct answer)
Risk acceptance
Risk transfer

Correct answer: Risk mitigation

Risk mitigation involves taking proactive steps to reduce either the probability of a risk occurring or its potential impact if it does occur.

Question 50: Which of the following is an accurate statement about drug testing in the workplace under federal law?

The Drug-Free Workplace Act requires all federal contractors to test employees for drugs
There is no comprehensive federal law mandating private-sector drug testing, though certain industries are federally regulated (Correct answer)
OSHA mandates random drug testing for all employees in safety-sensitive positions
The ADA prohibits all workplace drug testing as a form of disability-related inquiry

Correct answer: There is no comprehensive federal law mandating private-sector drug testing, though certain industries are federally regulated

No single federal law mandates drug testing for all private-sector employees; however, sector-specific regulations (e.g., DOT for transportation workers) require testing in certain industries.

Question 51: What distinguishes inherent risk from residual risk?

Inherent risk is financial; residual risk is operational
Inherent risk is internal; residual risk is external
There is no meaningful difference between them
Inherent risk exists before controls; residual risk remains after controls are applied (Correct answer)

Correct answer: Inherent risk exists before controls; residual risk remains after controls are applied

Inherent risk is the level of risk present before any controls are implemented, while residual risk is the level that remains after controls and mitigations are applied.

Question 52: What is the primary role of the FTC in privacy enforcement?

Enforcing consumer protection and privacy laws (Correct answer)
Managing telecommunications policy
Drafting state legislation
Providing healthcare services

Correct answer: Enforcing consumer protection and privacy laws

The Federal Trade Commission (FTC) serves as the primary federal agency for consumer protection in the United States. Its main role in privacy enforcement involves investigating and taking action against companies that engage in unfair or deceptive practices related to consumer data, including violations of privacy policies, data security failures, and non-compliance with specific privacy laws like COPPA.

Question 53: The FTC's approach to mobile app privacy requires that apps:

Use only government-approved encryption algorithms
Honor the privacy promises they make to users and avoid deceptive practices (Correct answer)
Register their data practices with the FTC annually
Submit to government certification before launch

Correct answer: Honor the privacy promises they make to users and avoid deceptive practices

Under Section 5 of the FTC Act, mobile apps must honor their stated privacy policies and not engage in deceptive or unfair data practices.

Question 54: Which organization enforces data privacy laws in the United States?

FBI
FDA
IRS
FTC (Correct answer)

Correct answer: FTC

The Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing data privacy laws in the United States, particularly those related to consumer protection. The FTC investigates companies for unfair or deceptive practices concerning data collection, use, and security, and it enforces laws like COPPA and sections of the FTC Act that prohibit unfair privacy practices. It plays a crucial role in safeguarding consumer data across various industries.

Question 55: Social media platforms have COPPA obligations when they have:

Actual knowledge that a particular user is under 13 years of age (Correct answer)
Offices in more than one U.S. state
Advertising revenue exceeding a federal threshold
More than one million active users

Correct answer: Actual knowledge that a particular user is under 13 years of age

COPPA applies to general audience sites and apps when the operator has actual knowledge that a user is under 13, even if the platform is not directed at children.

Question 56: An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:

Disclose it to HR and the employee's entire team to facilitate the accommodation
File it with the EEOC within 30 days
Retain it in the general personnel file for documentation purposes
Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis (Correct answer)

Correct answer: Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis

The ADA requires that medical information obtained through the accommodation process be kept confidential and disclosed only to those with a legitimate need to know.

Question 57: Under the FCRA, what right does a consumer have when adverse action is taken based on information in a credit report?

The right to a refund of any fees paid
The right to have negative information immediately deleted
The right to sue the creditor immediately
The right to receive notice of the adverse action and the name of the consumer reporting agency that provided the report (Correct answer)

Correct answer: The right to receive notice of the adverse action and the name of the consumer reporting agency that provided the report

The FCRA requires that when adverse action is taken based on a consumer report, the consumer must be notified and given the name of the reporting agency so they can access and dispute the report.

Question 58: FERPA primarily protects which type of information?

Medical records
Education records (Correct answer)
Credit card transactions
Government documents

Correct answer: Education records

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It grants parents certain rights with respect to their children's education records, and these rights transfer to the student when he or she reaches 18 years of age or attends a school beyond the high school level. FERPA generally requires schools to obtain written permission from the parent or eligible student before releasing any information from a student's education record.

Question 59: Why is it important to document and standardize best practices?

To limit creativity and prevent any changes
To ensure consistency, enable training, and facilitate continuous improvement (Correct answer)
To satisfy insurance requirements only
To reduce the number of employees needed

Correct answer: To ensure consistency, enable training, and facilitate continuous improvement

Documenting and standardizing best practices ensures consistency across operations, enables effective training, and provides a baseline for continuous improvement.

Question 60: What is the role of benchmarking in establishing best practices?

Matching exactly what competitors are doing
Eliminating all practices that differ from the industry average
Setting the lowest acceptable standard for performance
Comparing performance against top performers to identify improvement opportunities (Correct answer)

Correct answer: Comparing performance against top performers to identify improvement opportunities

Benchmarking involves comparing your performance against top performers or industry leaders to identify gaps and opportunities for improvement.

Question 61: Which regulation is enforced by state-level privacy agencies like the California Privacy Protection Agency (CPPA)?

GDPR
FERPA
HIPAA
CCPA/CPRA (Correct answer)

Correct answer: CCPA/CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is a landmark state-level privacy regulation in the U.S. It is enforced by state-level agencies, primarily the California Privacy Protection Agency (CPPA), which has investigative and enforcement powers to ensure businesses comply with its provisions regarding consumer data rights.

Question 62: The HITECH Act significantly strengthened HIPAA by making which of the following changes?

All PHI was made publicly accessible for research purposes
Business associates became directly liable for compliance with certain HIPAA provisions (Correct answer)
Healthcare providers were permitted to share PHI without restrictions for treatment
Patient consent requirements for PHI disclosures were eliminated

Correct answer: Business associates became directly liable for compliance with certain HIPAA provisions

The HITECH Act extended direct HIPAA liability to business associates, increased civil monetary penalties, and strengthened breach notification requirements.

Question 63: Why is training important in privacy program management?

To educate employees on data protection (Correct answer)
To reduce server downtime
To meet contractual obligations
To boost sales

Correct answer: To educate employees on data protection

Training and awareness programs are crucial in privacy program management because they educate employees about their roles and responsibilities in protecting personal data. By understanding privacy policies, procedures, and potential risks, employees can help prevent data breaches, ensure compliance with regulations, and foster a privacy-aware culture within the organization.

Question 64: What does "informed consent" require in professional practice?

Providing complete, understandable information so individuals can make voluntary decisions (Correct answer)
Implied agreement through participation
Getting a signature on any available form
Verbal agreement without explanation

Correct answer: Providing complete, understandable information so individuals can make voluntary decisions

Informed consent requires that individuals receive complete, understandable information about procedures, risks, and alternatives to make truly voluntary decisions.

Question 65: Under the GLBA's opt-out provision, consumers may prevent financial institutions from doing which of the following?

Collecting any financial data about them
Sharing their nonpublic personal information with non-affiliated third parties for marketing purposes (Correct answer)
Closing their accounts
Reporting them to credit bureaus

Correct answer: Sharing their nonpublic personal information with non-affiliated third parties for marketing purposes

The GLBA's opt-out right allows consumers to prevent financial institutions from sharing their nonpublic personal information with non-affiliated third parties.

Question 66: Under the Video Privacy Protection Act (VPPA), a video service provider generally cannot disclose a consumer's video rental or viewing history without:

The consumer's informed, written consent or a court order (Correct answer)
An arbitration agreement signed by the consumer
Prior notice posted on its website
A written request from law enforcement

Correct answer: The consumer's informed, written consent or a court order

The VPPA prohibits video tape service providers from disclosing personally identifiable information about rental or purchase records without the consumer's informed written consent or a court order.

Question 67: The Right to Financial Privacy Act (RFPA) generally requires the federal government to do which of the following before accessing customer financial records from a bank?

File a report with the FTC explaining the purpose of the access
Provide the bank with compensation for compliance costs
Notify the public 30 days in advance
Obtain customer authorization, serve an administrative subpoena, or obtain a court order or search warrant (Correct answer)

Correct answer: Obtain customer authorization, serve an administrative subpoena, or obtain a court order or search warrant

The RFPA establishes procedural requirements the federal government must follow when seeking access to customers' financial records held by financial institutions.

Question 68: What does SWOT analysis evaluate?

Systems, Workflows, Operations, and Technology
Standards, Warranties, Objectives, and Targets
Sales, Workers, Outputs, and Timelines
Strengths, Weaknesses, Opportunities, and Threats (Correct answer)

Correct answer: Strengths, Weaknesses, Opportunities, and Threats

SWOT analysis is a strategic planning framework that evaluates internal Strengths and Weaknesses and external Opportunities and Threats.

Question 69: Which agency enforces HIPAA privacy regulations?

Office of Civil Rights (HHS) (Correct answer)
Securities and Exchange Commission
Federal Trade Commission
Federal Communications Commission

Correct answer: Office of Civil Rights (HHS)

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting sensitive patient health information. The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) is the primary federal agency responsible for enforcing the HIPAA Privacy, Security, and Breach Notification Rules, investigating complaints, and imposing penalties for violations.

Question 70: Which state attorney general is often involved in privacy-related enforcement?

City council offices
Library boards
Local police departments
State attorneys general (Correct answer)

Correct answer: State attorneys general

State attorneys general play a significant role in privacy enforcement within their respective states. They have the authority to investigate and bring legal actions against companies that violate state consumer protection laws, including those related to data privacy and security. They often work in conjunction with federal agencies or lead multi-state investigations.

Question 71: When should established methodologies be reconsidered?

Only during annual reviews regardless of performance
Never, once established they should remain permanent
When evidence shows better alternatives exist or when outcomes decline (Correct answer)
Whenever a new employee joins the organization

Correct answer: When evidence shows better alternatives exist or when outcomes decline

Established methodologies should be reconsidered when new evidence suggests better alternatives, when outcomes decline, or when the operating context changes significantly.

Question 72: What is the Plan-Do-Check-Act (PDCA) cycle used for?

Annual budget allocation
Employee performance reviews exclusively
One-time project planning only
Continuous improvement of processes and practices (Correct answer)

Correct answer: Continuous improvement of processes and practices

The PDCA cycle is a systematic approach to continuous improvement where processes are planned, implemented, evaluated, and refined in an ongoing cycle.

Question 73: What type of action can the FTC take against companies violating privacy laws?

Collect taxes
Issue patents
Enact new laws
File civil enforcement actions (Correct answer)

Correct answer: File civil enforcement actions

The Federal Trade Commission (FTC) has significant enforcement powers to address violations of privacy laws and unfair or deceptive trade practices. These powers include filing civil enforcement actions in federal court, negotiating consent decrees with companies, and imposing monetary penalties or requiring specific remedial actions to protect consumers.

Question 74: An employer wants to conduct pre-employment background checks. Under the Fair Credit Reporting Act (FCRA), what must the employer provide to the applicant before taking adverse action based on the report?

A written explanation without the report
No notice is required for employment purposes
Only a final adverse action notice
A pre-adverse action notice and a copy of the report (Correct answer)

Correct answer: A pre-adverse action notice and a copy of the report

FCRA requires employers to provide a pre-adverse action notice, a copy of the consumer report, and a summary of consumer rights before taking adverse action.

Question 75: Which federal law restricts the government's ability to compel disclosure of stored electronic communications held by service providers?

FERPA
COPPA
CAN-SPAM Act
ECPA Stored Communications Act (Correct answer)

Correct answer: ECPA Stored Communications Act

The Stored Communications Act (Title II of ECPA) restricts voluntary disclosure by service providers and limits the government's ability to compel access to stored electronic communications.

Question 76: What is the primary purpose of an employee privacy notice under the California Consumer Privacy Act (CCPA) as amended by the CPRA?

To inform employees about the categories of personal information collected about them and the purposes for which it is used (Correct answer)
To obtain employee consent before collecting any personal data
To satisfy FCRA's pre-adverse action disclosure obligations
To comply with HIPAA's notice of privacy practices requirement

Correct answer: To inform employees about the categories of personal information collected about them and the purposes for which it is used

The CPRA requires employers to provide a privacy notice at or before collection informing California employees about the categories of personal information collected and the purposes of use.

Question 77: Which federal agency enforces the Children's Online Privacy Protection Act (COPPA)?

Federal Trade Commission (Correct answer)
Department of Health and Human Services
Department of Education
Federal Communications Commission

Correct answer: Federal Trade Commission

The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law designed to protect the online privacy of children under 13. The Federal Trade Commission (FTC) is the primary agency responsible for enforcing COPPA, issuing rules and taking enforcement actions against companies that violate its provisions regarding the collection of personal information from children.

Question 78: What does a privacy notice typically include?

A list of all employees
Only the organization's mission
Details about data collection and user rights (Correct answer)
Procedures for financial auditing

Correct answer: Details about data collection and user rights

A privacy notice is a public statement explaining an organization's data handling practices. It typically informs individuals about what personal data is collected, the purposes for collection, how it will be used and shared, and the rights individuals have regarding their data, such as access or deletion. This transparency is fundamental for building trust and complying with privacy regulations.

Question 79: HIPAA enforcement actions for civil violations are primarily handled by which agency?

The Federal Trade Commission (FTC)
The Department of Health and Human Services Office for Civil Rights (HHS OCR) (Correct answer)
The Department of Justice (DOJ)
State attorneys general exclusively

Correct answer: The Department of Health and Human Services Office for Civil Rights (HHS OCR)

HHS OCR is the primary federal enforcement body for HIPAA civil violations, including failure to safeguard PHI and improper disclosures.

Question 80: What is the appropriate action when discovering a colleague has violated professional standards?

Report through proper channels as outlined in the code of ethics (Correct answer)
Post about it on social media
Handle it privately without documentation
Ignore it to maintain the relationship

Correct answer: Report through proper channels as outlined in the code of ethics

Professional standards require reporting violations through proper channels to protect the public and maintain the integrity of the profession.

Question 81: Which law requires businesses to implement reasonable security practices?

CCPA (Correct answer)
GDPR
CAN-SPAM
FERPA

Correct answer: CCPA

The California Consumer Privacy Act (CCPA) specifically requires businesses to implement and maintain reasonable security procedures and practices appropriate to the nature of the information they handle. This mandate aims to protect consumers' personal information from unauthorized access, destruction, use, modification, or disclosure. While other privacy laws also address security, CCPA explicitly outlines this requirement for businesses operating in California.

Question 82: Which role typically owns the responsibility of data stewardship?

Customer Support Agent
Marketing Manager
HR Representative
Data Steward ensures data quality and compliance (Correct answer)

Correct answer: Data Steward ensures data quality and compliance

A Data Steward is a role within an organization responsible for the operational oversight and management of specific data assets. They ensure data quality, integrity, and compliance with established policies and regulations, acting as a liaison between data users and data governance bodies. This role is critical for maintaining trustworthy and compliant data.

Question 83: Under the HIPAA 'Safe Harbor' de-identification method, PHI is considered de-identified when:

All 18 specified categories of identifiers are removed and the covered entity has no actual knowledge the remaining information can re-identify an individual (Correct answer)
A third-party vendor certifies the de-identification
All data is encrypted using AES-256
Data is aggregated across at least 100 patients

Correct answer: All 18 specified categories of identifiers are removed and the covered entity has no actual knowledge the remaining information can re-identify an individual

The Safe Harbor method requires removal of all 18 enumerated identifiers and a certification that the covered entity has no actual knowledge the remaining data could re-identify individuals.

Question 84: When facing an ethical dilemma, what is the recommended first step?

Identify all stakeholders affected and review applicable codes of conduct (Correct answer)
Defer to the most senior person present
Make a quick decision to avoid delays
Ignore the situation until it resolves itself

Correct answer: Identify all stakeholders affected and review applicable codes of conduct

The first step in resolving an ethical dilemma is to identify all affected stakeholders and review relevant codes of professional conduct for guidance.

Question 85: A company implements keystroke logging software on all employee computers. What is the most important step the company should take to limit privacy risk?

Provide clear notice to employees through an acceptable use policy (Correct answer)
Encrypt all logged keystrokes and never review them
Limit monitoring to only remote workers
Obtain a court order before deploying the software

Correct answer: Provide clear notice to employees through an acceptable use policy

Providing clear notice through an acceptable use or monitoring policy reduces privacy risk and supports the business extension exception under ECPA.

Question 86: Which role is typically responsible for managing an organization's privacy program?

Chief Marketing Officer
Chief Operations Officer
Chief Compliance Technician
Chief Privacy Officer (Correct answer)

Correct answer: Chief Privacy Officer

The Chief Privacy Officer (CPO) is a senior executive role responsible for developing, implementing, and overseeing an organization's privacy program and strategy. The CPO ensures compliance with privacy laws and regulations, manages privacy risks, and fosters a culture of privacy throughout the enterprise, making them central to privacy program management.

Question 87: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with privacy notices and:

Implement a comprehensive information security program to safeguard customer financial information (Correct answer)
Register all data sharing activities with the FTC annually
Encrypt all customer financial data using government-approved algorithms
Obtain opt-in consent before collecting any financial data

Correct answer: Implement a comprehensive information security program to safeguard customer financial information

The GLBA requires financial institutions to provide privacy notices and, under the Safeguards Rule, to develop and maintain a comprehensive written information security program.

Question 88: What should be the first action when a new regulation is enacted that affects your practice?

Review the regulation, assess its impact, and develop an implementation plan (Correct answer)
Delegate review to the newest team member
Wait for enforcement before making changes
Assume existing procedures already comply

Correct answer: Review the regulation, assess its impact, and develop an implementation plan

When new regulations are enacted, professionals should promptly review them, assess their impact on current practices, and develop a structured implementation plan.

Question 89: What role does metadata play in information governance?

It provides context and helps in data lifecycle management (Correct answer)
It compresses files.
It deletes outdated records.
It hides the data.

Correct answer: It provides context and helps in data lifecycle management

Metadata, or "data about data," is crucial in information governance because it describes the characteristics of data, such as its origin, format, and usage. This context helps organizations understand what data they possess, how it should be handled, and when it should be retained or deleted. Therefore, it supports effective data lifecycle management and compliance.

Question 90: What is a root cause analysis used for?

To assign blame to individuals who made mistakes
To document problems for annual reporting
To identify the underlying cause of a problem rather than just addressing symptoms (Correct answer)
To calculate the financial cost of errors

Correct answer: To identify the underlying cause of a problem rather than just addressing symptoms

Root cause analysis is a systematic method used to identify the fundamental underlying cause of a problem, enabling solutions that prevent recurrence rather than just treating symptoms.

Certified Information Privacy Professional/United States (CIPP/US) Exam

This exam certifies individuals in the comprehensive knowledge of privacy laws, regulations, and frameworks specific to the United States.

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

assets.contentstack.io — Retake policy, score release, exam information · verified Nov 2026
iapp.org — Registration deadline, score validity, passing score, registration, test dates · verified Oct 2026
store.iapp.org — Test delivery, fees · verified Oct 2026
pages.iapp.org — Exam format · verified Oct 2026