FREE CIPM IAPP Questions and Answers

Question 1

What is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program?

Accepted Answer

Crafting policies which ensure minimal data is collected.

Answer

Reducing storage costs.

Answer

Ensuring data is kept for no longer than necessary.

Answer

Increasing awareness of the importance of confidentiality.

Question 2

How do privacy audits differ from privacy assessments?

Accepted Answer

They are evidence-based.

Answer

They are non-binding.

Answer

They are based on standards.

Answer

They are conducted by external parties.

Question 3

An organization's internal audit team should do all of the following EXCEPT?

Accepted Answer

Implement processes to correct audit failures.

Answer

Verify that technical measures are in place.

Answer

Review how operations work in practice.

Answer

Ensure policies are being adhered to.

Question 4

Respond'' in the privacy operational lifecycle includes which of the following?

Accepted Answer

Information requests and privacy rights requests.

Answer

Information security practices and functional area integration.

Answer

Privacy awareness training and compliance monitoring.

Answer

Communication to stakeholders and alignment to laws.

Question 5

Which of the following is a physical control that can limit privacy risk?

Accepted Answer

Keypad or biometric access.

Answer

user access reviews.

Answer

Encryption

Answer

Tokenization.

Question 6

When a data breach incident has occurred. the first priority is to determine?

Accepted Answer

How to contain the breach.

Answer

Who caused the breach.

Answer

How the breach occurred.

Answer

When the breach occurred.

Question 7

Your company provides a SaaS tool for B2B services and does not interact with individual consumers. A client's current employee reaches out with a right to delete request. what is the most appropriate response?

Accepted Answer

Redirect the individual back to their employer to understand their rights and how this might impact access to company tools.

Answer

Forward the request to the contact on file for the client asking them how they would like you to proceed.

Answer

Process the request assuming that the individual understands the implications to their organization if their information is deleted.

Question 8

While trying to e-mail her manager, an employee has e-mailed a list of all the company's customers, including their bank details, to an employee with the same name at a different company. Which of the following would be the first stage in the incident response plan under the General Data Protection Regulation (GDPR)?

Accepted Answer

Containment of impact of breach.

Answer

Notification to data subjects.

Answer

Remediation offers to data subjects.

Answer

Notification to the Information Commissioner's Office (ICO).

Question 9

A systems audit uncovered a shared drive folder containing sensitive employee data with no access controls and therefore was available for all employees to view. What is the first step to mitigate further risks?

Accepted Answer

Restrict access to the folder.

Answer

Notify all employees whose information was contained in the file.

Answer

Check access logs to see who accessed the folder.

Answer

Notify legal counsel of a privacy incident.

Question 10

If your organization has a recurring issue with colleagues not reporting personal data breaches, all of the following are advisable to do EXCEPT?

Accepted Answer

Distribute a phishing exercise to all employees to test their ability to recognize a threat attempt.

Answer

Review reporting activity on breaches to understand when incidents are being reported and when they are not to improve communication and training.

Answer

Improve communication to reinforce to everyone that breaches must be reported and how they should be reported.

Answer

Provide role-specific training to areas where breaches are happening so they are more aware.