Information Governance Professional (IGP) Exam — Questions and Answers

Question 1: When conducting a risk assessment for IGP operations, which factor should receive the HIGHEST priority?

Time required for safety training
Cost of implementing safety measures
Probability and severity of potential harm (Correct answer)
Convenience for daily operations

Correct answer: Probability and severity of potential harm

The probability and severity of potential harm are the primary factors in risk assessment.

Question 2: In Information Governance Professional, what is the PRIMARY purpose of conducting regular safety drills and exercises?

To ensure personnel can respond effectively in emergencies (Correct answer)
To satisfy insurance requirements only
To evaluate employee performance reviews
To reduce daily workload

Correct answer: To ensure personnel can respond effectively in emergencies

Regular safety drills ensure that all personnel are prepared to respond effectively during actual emergencies.

Question 3: How should Information Governance Professional professionals handle procedures that have been updated or revised?

Wait for mandatory enforcement
Only apply updates to new cases
Review updates, complete required training, and implement revised procedures (Correct answer)
Continue using the original method

Correct answer: Review updates, complete required training, and implement revised procedures

Professionals must review changes, complete training, and implement revised procedures.

Question 4: In Information Governance Professional practice, what is the CORRECT sequence when performing a technical procedure?

Execute, then plan and review
Document, execute, then plan
Plan, prepare, execute, verify, and document (Correct answer)
Execute immediately and document only if issues arise

Correct answer: Plan, prepare, execute, verify, and document

The correct sequence follows: plan, prepare, execute, verify, and document.

Question 5: The California Consumer Privacy Act (CCPA) grants consumers the right to:

Erasure, access, and portability only for health data
Data minimization and purpose limitation enforcement
Restrict automated decision-making and profiling
Know, delete, and opt out of sale of their personal information (Correct answer)

Correct answer: Know, delete, and opt out of sale of their personal information

CCPA grants California consumers the rights to know what personal information is collected, to delete it, and to opt out of its sale.

Question 6: Which element distinguishes a 'standard' from a 'policy' in an IG framework hierarchy?

Standards apply only to IT systems while policies apply to all information
Standards are written by vendors; policies are written internally
Standards are optional; policies are mandatory
Standards provide specific, measurable requirements that support policy compliance (Correct answer)

Correct answer: Standards provide specific, measurable requirements that support policy compliance

Standards define specific, quantifiable requirements (e.g., password length minimums) that operationalize policies, making compliance measurable and auditable.

Question 7: A company's IG framework should address privacy requirements under which US federal law applicable to healthcare information?

GLBA
COPPA
FERPA
HIPAA (Correct answer)

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information (PHI) and must be addressed in healthcare IG frameworks.

Question 8: Which of the following BEST describes 'information governance' as distinct from 'records management'?

Information governance is a broader strategic framework that encompasses records management along with data governance, privacy, security, and compliance (Correct answer)
Information governance focuses only on physical documents while records management covers digital files
Information governance is limited to legal and compliance departments
Records management is a newer discipline that has replaced information governance

Correct answer: Information governance is a broader strategic framework that encompasses records management along with data governance, privacy, security, and compliance

IG is a holistic, strategic discipline that encompasses records management and extends to include data governance, privacy, security, compliance, and risk management across all information assets.

Question 9: What is the primary purpose of an information governance framework?

Manage information securely and effectively (Correct answer)
Ignore compliance requirements
To delete all data
Increase data redundancy

Correct answer: Manage information securely and effectively

The primary purpose of an information governance (IG) framework is to manage an organization's information assets securely, effectively, and compliantly throughout their lifecycle. It establishes policies, processes, and controls to ensure information is accurate, accessible, protected, and retained or disposed of appropriately. This holistic approach maximizes information value while minimizing risks and costs.

Question 10: When classifying information in an IG program, which factor is MOST important when determining security controls?

The age of the information
The size of the data set
The file format of the document
The sensitivity and criticality of the information (Correct answer)

Correct answer: The sensitivity and criticality of the information

Security controls in an IG program are driven by the sensitivity (confidentiality) and criticality (availability/integrity) of the information, not its format or size.

Question 11: Which compliance framework is specifically designed to protect cardholder data for organizations that process credit card transactions?

PCI DSS (Correct answer)
SOX
HIPAA
ISO 27001

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits cardholder data.

Question 12: What role does calibration play in maintaining technical accuracy for Information Governance Professional professionals?

It only matters during inspections
It ensures instruments produce accurate, consistent results over time (Correct answer)
It is only necessary for new equipment
It is optional for advanced professionals

Correct answer: It ensures instruments produce accurate, consistent results over time

Regular calibration ensures instruments continue producing accurate results over time.

Question 13: Which personal protective equipment (PPE) principle applies to ALL IGP certified professionals regardless of their specific role?

PPE must be properly fitted, maintained, and replaced as needed (Correct answer)
Any PPE will provide adequate protection
PPE is only necessary during formal inspections
PPE is optional if experienced in the field

Correct answer: PPE must be properly fitted, maintained, and replaced as needed

Regardless of experience level, PPE must be properly fitted, regularly maintained, and replaced when worn or damaged.

Question 14: When a IGP professional identifies a potential regulatory violation, the CORRECT first step is to:

Document the violation and report through proper channels (Correct answer)
Wait to see if it resolves on its own
Discuss it casually with coworkers
Address it only if directly affected

Correct answer: Document the violation and report through proper channels

Proper documentation and reporting through established channels ensures accountability.

Question 15: When a IGP professional encounters an unexpected result during a procedure, the FIRST action should be to:

Continue and address it later
Report without preliminary assessment
Repeat the procedure immediately
Stop, assess the situation, and determine whether to proceed or seek guidance (Correct answer)

Correct answer: Stop, assess the situation, and determine whether to proceed or seek guidance

Stopping to assess unexpected results is critical for safety and quality.

Question 16: How are controls used in risk management?

Reduce risk likelihood or impact (Correct answer)
Ignore risks
Only for audits
Increase risks

Correct answer: Reduce risk likelihood or impact

Controls are integral to risk management as they are measures implemented to reduce the likelihood or impact of identified risks. These can be preventative (e.g., access controls to stop unauthorized access) or detective (e.g., monitoring systems to identify breaches). By applying appropriate controls, organizations can effectively manage and mitigate threats to their information assets and operations.

Question 17: Which document formally defines an organization's acceptable level of risk exposure?

Risk appetite statement (Correct answer)
Risk register
Risk treatment plan
Business impact analysis

Correct answer: Risk appetite statement

A risk appetite statement formally articulates the amount and type of risk an organization is willing to accept in pursuit of its objectives.

Question 18: In Information Governance Professional, what is the PRIMARY purpose of conducting regular safety drills and exercises?

To satisfy insurance requirements only
To ensure personnel can respond effectively in emergencies (Correct answer)
To evaluate employee performance reviews
To reduce daily workload

Correct answer: To ensure personnel can respond effectively in emergencies

Regular safety drills ensure that all personnel are prepared to respond effectively during actual emergencies.

Question 19: What is the primary purpose of a Security Information and Event Management (SIEM) system?

Manage user identity provisioning
Encrypt emails sent between employees
Aggregate and correlate security logs for threat detection (Correct answer)
Automatically patch vulnerabilities on servers

Correct answer: Aggregate and correlate security logs for threat detection

SIEM systems collect, aggregate, and correlate security event logs from multiple sources to enable real-time threat detection and incident response.

Question 20: Which term describes Electronically Stored Information as defined under the Federal Rules of Civil Procedure?

Information created, stored, or transmitted in electronic form that may be subject to discovery (Correct answer)
Any information stored on paper or electronic media
Only structured data held in enterprise databases
Email messages archived by a third-party provider

Correct answer: Information created, stored, or transmitted in electronic form that may be subject to discovery

ESI under the FRCP broadly includes any information created, stored, or transmitted in electronic form, encompassing emails, documents, databases, voicemails, and metadata.

Question 21: What is the benefit of policy review and updates?

Keeps policies current (Correct answer)
Increases risks
Confuses employees
Is optional

Correct answer: Keeps policies current

Regular policy review and updates are essential in information governance to ensure that policies remain current, effective, and compliant with evolving legal, regulatory, and technological landscapes. Information environments and business needs are constantly changing, so outdated policies can lead to compliance gaps or inefficiencies. Periodic reviews allow organizations to adapt their governance framework to new challenges and opportunities, maintaining its relevance and efficacy.

Question 22: Which regulatory requirement is UNIVERSAL across all Information Governance Professional practice settings?

Maintaining current certification and continuing education (Correct answer)
Using specific proprietary software
Working exclusively during business hours
Limiting services to local jurisdictions

Correct answer: Maintaining current certification and continuing education

Maintaining current certification and continuing education is a universal regulatory requirement.

Question 23: In an IG framework, a 'policy' differs from a 'procedure' primarily because a policy:

States the organization's intent and high-level rules (Correct answer)
Defines technical configurations for IT systems
Describes step-by-step instructions for task completion
Assigns specific roles to named individuals

Correct answer: States the organization's intent and high-level rules

Policies express organizational intent and mandatory rules, while procedures provide the step-by-step instructions for implementing those policies.

Question 24: Which policy element defines the consequences for employees who violate IG requirements?

Enforcement and sanctions clause (Correct answer)
Glossary of terms
Purpose and objectives section
Scope statement

Correct answer: Enforcement and sanctions clause

The enforcement and sanctions clause specifies disciplinary actions that may result from policy violations, making the policy credible and actionable.

Question 25: Which factor MOST significantly affects the quality of technical outcomes in IGP practice?

The practitioner's training, preparation, and attention to detail (Correct answer)
The brand of equipment
Speed of procedure completion
The time of day

Correct answer: The practitioner's training, preparation, and attention to detail

Quality depends primarily on training, preparation, and attention to detail.

Question 26: Why are firewalls important?

Block unauthorized traffic (Correct answer)
Allow all traffic
Slow systems
Create vulnerabilities

Correct answer: Block unauthorized traffic

Firewalls are crucial security components that act as a barrier between a trusted internal network and untrusted external networks, like the internet. Their primary function is to block unauthorized traffic and control network access based on predefined security rules. By filtering incoming and outgoing data packets, firewalls prevent malicious attacks and unauthorized access attempts, protecting the internal network from external threats.

Question 27: How does compliance impact organizational reputation?

Has no effect
Only affects finances
Builds trust and credibility (Correct answer)
Decreases trust

Correct answer: Builds trust and credibility

Compliance significantly impacts organizational reputation by demonstrating a commitment to ethical practices, legal adherence, and responsible data handling. Organizations that consistently comply with regulations build trust and credibility with customers, partners, and the public. Conversely, non-compliance can lead to severe reputational damage, eroding trust and potentially affecting customer loyalty and market value.

Question 28: What is the PRIMARY purpose of obtaining IGP certification in Information Governance Professional?

To guarantee employment
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 29: What is the PRIMARY reason for regulatory compliance in the Information Governance Professional profession?

To justify higher service fees
To create additional paperwork
To avoid penalties and fines only
To protect public safety, ensure quality, and maintain professional integrity (Correct answer)

Correct answer: To protect public safety, ensure quality, and maintain professional integrity

Regulatory compliance protects public safety, ensures quality, and maintains professional integrity.

Question 30: Which approach is MOST important for IGP professionals when applying technical procedures?

Applying the same technique without variation
Adhering to established protocols while adapting to specific conditions (Correct answer)
Using the fastest method regardless of standards
Following personal shortcuts

Correct answer: Adhering to established protocols while adapting to specific conditions

Technical procedures require adherence to protocols with professional judgment for adaptation.

Question 31: Which factor MOST significantly affects the quality of technical outcomes in IGP practice?

The practitioner's training, preparation, and attention to detail (Correct answer)
The brand of equipment
Speed of procedure completion
The time of day

Correct answer: The practitioner's training, preparation, and attention to detail

Quality depends primarily on training, preparation, and attention to detail.

Question 32: How should organizations enforce information governance policies?

Only punish violations
Ignore policies
Allow exceptions freely
Training and consistent application (Correct answer)

Correct answer: Training and consistent application

Organizations should enforce information governance policies through a combination of comprehensive training and consistent application across all departments and employees. Training ensures that everyone understands their responsibilities and the importance of the policies. Consistent application, supported by monitoring and accountability, embeds these practices into the organizational culture, making compliance a routine part of daily operations rather than an exception.

Question 33: What role does antivirus software play?

Install malware
Ignore threats
Detect and remove malware (Correct answer)
Delete important files

Correct answer: Detect and remove malware

Antivirus software plays a critical role in information security by detecting, preventing, and removing malicious software (malware) such as viruses, worms, and Trojans. It scans files and systems for known threats and suspicious behavior, protecting computers and networks from infection. This helps maintain the integrity and availability of data and systems, preventing data loss or compromise.

Question 34: Which technology helps prevent unauthorized access?

Public sharing
Open networks
Access controls such as passwords (Correct answer)
Weak passwords

Correct answer: Access controls such as passwords

Access controls, such as strong passwords, multi-factor authentication, and role-based access, are fundamental technologies that help prevent unauthorized access to systems and data. They ensure that only authenticated and authorized individuals can gain entry to specific resources. By verifying user identities and permissions, these controls act as a critical barrier against malicious actors and insider threats.

Question 35: What is a compliance audit?

Only for IT systems
Evaluate adherence to regulations (Correct answer)
A financial review
An informal check

Correct answer: Evaluate adherence to regulations

A compliance audit is a formal, independent examination that evaluates an organization's adherence to specific laws, regulations, industry standards, and internal policies. It assesses whether controls are in place and operating effectively to meet compliance requirements. The audit identifies gaps or non-compliance issues, allowing the organization to take corrective actions and demonstrate due diligence.

Question 36: How does encryption support data privacy?

Only for backups
Is optional
Slows data access
Protects against unauthorized access (Correct answer)

Correct answer: Protects against unauthorized access

Encryption supports data privacy by transforming data into a coded format, making it unreadable to anyone without the correct decryption key. This protective measure safeguards information both at rest (e.g., on a server) and in transit (e.g., over a network). By rendering sensitive data unintelligible to unauthorized individuals, encryption effectively prevents unauthorized access and maintains confidentiality.

Question 37: What documentation is MOST critical to maintain for safety compliance in the Information Governance Professional field?

Incident reports, training records, and inspection logs (Correct answer)
Annual revenue reports
Client marketing preferences
Employee vacation schedules

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation for demonstrating compliance.

Question 38: When an organization undergoes a merger, which IG activity is MOST urgent to perform regarding information assets?

Suspending all IG policies until the merger is complete
Transferring all IT systems to the acquiring company's platform within 30 days
Conducting an information inventory and gap analysis of both organizations' IG frameworks (Correct answer)
Immediately deleting all records from the acquired company

Correct answer: Conducting an information inventory and gap analysis of both organizations' IG frameworks

A merger requires an information inventory and gap analysis to identify IG framework differences, redundancies, and risks before integration decisions are made.

Question 39: Which of the following would be considered a 'defensible disposition' practice in IG?

Destroying records according to documented retention schedules after confirming no legal holds apply (Correct answer)
Allowing individual employees to decide when to delete their own emails
Retaining all records indefinitely to avoid any potential legal risk
Randomly deleting files when storage is running low

Correct answer: Destroying records according to documented retention schedules after confirming no legal holds apply

Defensible disposition requires systematic destruction based on approved retention schedules, with legal hold checks and documented authorization to withstand legal scrutiny.

Question 40: Which of the following is a key characteristic of an effective IG policy lifecycle?

Policies undergo regular review and updates to reflect regulatory and business changes (Correct answer)
Policies are written once and never revised
Policies are distributed only to senior management
Policies are created solely by IT without business input

Correct answer: Policies undergo regular review and updates to reflect regulatory and business changes

Effective IG policies must be periodically reviewed and updated to remain aligned with evolving laws, regulations, business needs, and technology changes.

Question 41: How should organizations respond to security incidents?

Ignore incidents
Follow response plan (Correct answer)
Wait for audits
Delete evidence

Correct answer: Follow response plan

Following a well-defined security incident response plan ensures a structured and efficient approach to managing breaches. This plan guides organizations through containment, eradication, recovery, and post-incident analysis, minimizing damage and facilitating a swift return to normal operations while learning from the event.

Question 42: What does the acronym EDRM stand for in the context of electronic discovery?

Electronic Document Review Management
Electronic Data Retention Model
Enterprise Data Recovery Method
Electronic Discovery Reference Model (Correct answer)

Correct answer: Electronic Discovery Reference Model

EDRM stands for Electronic Discovery Reference Model, a widely adopted framework that describes the stages of the e-discovery process from information governance through presentation.

Question 43: Which foundational principle is MOST important for success in Information Governance Professional?

Maximizing financial returns
Specializing in only one narrow area
Maintaining minimum certification requirements
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 44: Why is data privacy critical in records management?

Protect sensitive information (Correct answer)
Only for public records
Increases risks
Is optional

Correct answer: Protect sensitive information

Data privacy is critical in records management because many records contain sensitive information, including personally identifiable information (PII) or confidential business data. Proper privacy measures ensure that this sensitive information is protected from unauthorized access, use, or disclosure. This is crucial for maintaining trust, complying with regulations like GDPR or HIPAA, and avoiding legal and reputational damage.

Question 45: Which scenario BEST illustrates a failure of IG policy enforcement?

An employee requests access to a restricted database and is denied
A manager approves deletion of records still under a legal hold (Correct answer)
Legal counsel reviews contracts before they are signed
The IT team upgrades the records management system during off-hours

Correct answer: A manager approves deletion of records still under a legal hold

Deleting records subject to a legal hold violates IG policy and can result in spoliation sanctions, making it a clear enforcement failure.

Question 46: Which EDRM stage immediately follows the Identification stage?

Processing
Collection
Preservation (Correct answer)
Review

Correct answer: Preservation

In the EDRM, Preservation follows Identification; once potentially relevant data sources are identified, they must be preserved to prevent loss or alteration before collection occurs.

Question 47: Under the NIST Risk Management Framework (RMF), which step involves continuously tracking security controls over time?

Monitor (Correct answer)
Assess
Implement
Authorize

Correct answer: Monitor

The Monitor step in the NIST RMF involves ongoing assessment of security controls to detect changes that may affect risk posture.

Question 48: What role does risk management play in information governance?

Identify and mitigate risks (Correct answer)
Only for audits
Increase risks
Ignore risks

Correct answer: Identify and mitigate risks

Risk management plays a fundamental role in information governance by systematically identifying, assessing, and mitigating potential risks associated with an organization's information assets. This includes risks related to data breaches, non-compliance, data loss, and unauthorized access. By proactively managing these risks, information governance helps protect the organization's reputation, financial stability, and legal standing.

Question 49: Which regulatory requirement is UNIVERSAL across all Information Governance Professional practice settings?

Limiting services to local jurisdictions
Working exclusively during business hours
Using specific proprietary software
Maintaining current certification and continuing education (Correct answer)

Correct answer: Maintaining current certification and continuing education

Maintaining current certification and continuing education is a universal regulatory requirement.

Question 50: What documentation is MOST critical to maintain for safety compliance in the Information Governance Professional field?

Employee vacation schedules
Client marketing preferences
Annual revenue reports
Incident reports, training records, and inspection logs (Correct answer)

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation for demonstrating compliance.

Question 51: In Information Governance Professional practice, what is the CORRECT sequence when performing a technical procedure?

Execute, then plan and review
Execute immediately and document only if issues arise
Plan, prepare, execute, verify, and document (Correct answer)
Document, execute, then plan

Correct answer: Plan, prepare, execute, verify, and document

The correct sequence follows: plan, prepare, execute, verify, and document.

Question 52: Why is employee training important for data privacy?

Ensures policy understanding (Correct answer)
Only for IT
Increases risks
Is unnecessary

Correct answer: Ensures policy understanding

Employee training is crucial for data privacy because human error is a significant cause of data breaches. Training ensures that all employees understand the organization's data privacy policies, their responsibilities, and best practices for handling sensitive information. This knowledge empowers them to make informed decisions, recognize threats like phishing, and act as a strong line of defense against privacy incidents.

Question 53: What is the primary trigger for issuing a litigation hold?

Approval of the legal budget for discovery
Filing of a formal lawsuit only
Reasonable anticipation of litigation or regulatory investigation (Correct answer)
Receipt of a subpoena from a court

Correct answer: Reasonable anticipation of litigation or regulatory investigation

A litigation hold must be issued when litigation is reasonably anticipated, which can occur before a lawsuit is formally filed, such as when a demand letter is received.

Question 54: How does an effective policy support regulatory compliance?

Handles info per laws and standards (Correct answer)
Slows operations
Only addresses internal rules
By ignoring laws

Correct answer: Handles info per laws and standards

An effective information governance policy supports regulatory compliance by establishing clear guidelines and procedures for how information must be handled in accordance with applicable laws, industry standards, and internal rules. By defining requirements for data privacy, security, retention, and disposal, the policy helps organizations meet their legal obligations. This proactive approach minimizes the risk of non-compliance penalties and reputational damage.

Question 55: What is the main goal of records management?

Ignore records
To destroy all records
Increase storage costs
Control creation, maintenance, disposal (Correct answer)

Correct answer: Control creation, maintenance, disposal

The main goal of records management is to systematically control the entire lifecycle of an organization's records. This encompasses their creation, receipt, maintenance, use, and ultimate disposition. By managing records effectively, organizations ensure that necessary information is available when needed, while also meeting legal, regulatory, and operational requirements efficiently and securely.

Question 56: Why is continuous monitoring important?

Increases risk
Detect new risks promptly (Correct answer)
Is optional
Slows response

Correct answer: Detect new risks promptly

Continuous monitoring is important because the threat landscape and organizational environment are constantly evolving. It allows organizations to detect new risks, vulnerabilities, or changes in existing risk profiles promptly. By continuously observing systems, processes, and external factors, organizations can respond quickly to emerging threats, maintain security effectiveness, and ensure ongoing compliance.

Question 57: Which data privacy concept gives individuals the right to receive their personal data in a structured, commonly used, machine-readable format?

Right to object
Right to restriction of processing
Right to erasure
Right to data portability (Correct answer)

Correct answer: Right to data portability

The right to data portability, established under GDPR Article 20, allows individuals to receive and transfer their personal data in a reusable format.

Question 58: Why is security awareness training important?

Increases risk
Educates users on threats (Correct answer)
Is unnecessary
Only for IT staff

Correct answer: Educates users on threats

Security awareness training is vital because it educates employees about various cyber threats like phishing, malware, and social engineering. By understanding these risks and best practices, users become a crucial first line of defense, significantly reducing the likelihood of human error leading to a security incident.

Question 59: Which risk management approach is MOST effective for IGP professionals when evaluating potential workplace hazards?

Proactive hazard identification and assessment (Correct answer)
Reactive analysis after incidents occur
Delegating all safety decisions to management
Relying solely on historical accident data

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur.

Question 60: Which encryption standard is currently recommended by NIST for protecting sensitive US government data at rest?

RC4 with 128-bit keys
Blowfish with 256-bit keys
3DES with 168-bit keys
AES-256 (Correct answer)

Correct answer: AES-256

NIST recommends AES-256 for protecting sensitive government data at rest, as 3DES is deprecated and RC4/Blowfish are not approved for federal use.

Question 61: Why is stakeholder engagement important in governance?

Ensures policy relevance and support (Correct answer)
Is unnecessary
Slows decision-making
Only for legal teams

Correct answer: Ensures policy relevance and support

Stakeholder engagement is crucial in information governance because it ensures that policies are relevant, practical, and receive widespread support across the organization. By involving representatives from various departments—such as legal, IT, HR, and business units—policies can be developed that address diverse needs and perspectives. This collaborative approach fosters buy-in and makes the implementation of governance initiatives more successful.

Question 62: A records retention schedule that conflicts with a legal hold should be:

Applied as written since the schedule takes precedence
Suspended for the records covered by the legal hold until it is lifted (Correct answer)
Escalated to HR for employee discipline
Deleted from the system to avoid confusion

Correct answer: Suspended for the records covered by the legal hold until it is lifted

Legal holds override normal retention schedules; records subject to a hold must be preserved until the hold is lifted, regardless of their scheduled destruction date.

Question 63: Which governance body is typically responsible for approving enterprise-level IG policies?

External auditors
IT Help Desk
Executive leadership or a steering committee (Correct answer)
Individual department managers

Correct answer: Executive leadership or a steering committee

Enterprise IG policies require approval at the executive or steering committee level to ensure enterprise-wide authority and cross-departmental compliance.

Question 64: In Information Governance Professional practice, what is the FIRST step when a safety hazard is identified in the workplace?

Wait for a supervisor to notice the issue
Continue working and report at end of shift
Document it for the next safety audit
Immediately secure the area and report the hazard (Correct answer)

Correct answer: Immediately secure the area and report the hazard

When a safety hazard is identified, the immediate priority is to secure the area to prevent injury and report the hazard through proper channels.

Question 65: Which framework is commonly used to align IT governance with business objectives and includes information governance components?

SOX
HIPAA
FERPA
COBIT (Correct answer)

Correct answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is a framework for IT governance and management that includes information governance components.

Question 66: What is the MOST effective way for new IGP professionals to build competency?

Studying certification materials exclusively
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on advanced topics
Learning through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 67: What is encryption used for in information security?

To speed up processing
Encode data for protection (Correct answer)
To delete data
Ignore data

Correct answer: Encode data for protection

Encryption is used in information security to encode data, transforming it into an unreadable format that protects it from unauthorized access. This process makes the data unintelligible to anyone without the correct decryption key. It is a vital tool for safeguarding sensitive information both when it is stored (data at rest) and when it is transmitted across networks (data in transit).

Question 68: Which statement BEST describes the relationship between Information Governance Professional certification and industry evolution?

Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Requirements become less stringent over time
Certification requirements never change
Changes only occur when government mandates them

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 69: When a IGP professional encounters an unexpected result during a procedure, the FIRST action should be to:

Report without preliminary assessment
Repeat the procedure immediately
Stop, assess the situation, and determine whether to proceed or seek guidance (Correct answer)
Continue and address it later

Correct answer: Stop, assess the situation, and determine whether to proceed or seek guidance

Stopping to assess unexpected results is critical for safety and quality.

Question 70: An IG policy that applies to all employees, contractors, and vendors who access organizational information reflects which best practice?

Applying separate, unconnected policies for each vendor individually
Limiting IG obligations to full-time employees only to reduce training costs
Defining a broad scope that covers all parties who interact with organizational information regardless of employment status (Correct answer)
Restricting IG requirements to data processed within the organization's primary country

Correct answer: Defining a broad scope that covers all parties who interact with organizational information regardless of employment status

Effective IG policies must extend to all parties accessing organizational information — including contractors and vendors — since data risks are not limited to internal employees.

Question 71: The Sarbanes-Oxley Act (SOX) Section 302 primarily requires:

CEO and CFO certification of financial statement accuracy (Correct answer)
Mandatory data breach notification within 72 hours
Board-level approval for all IT projects
Annual IT security audits

Correct answer: CEO and CFO certification of financial statement accuracy

SOX Section 302 requires senior executives to personally certify the accuracy and completeness of corporate financial reports.

Question 72: In records management, what distinguishes a 'record' from a 'non-record'?

Records are stored on-premises; non-records are in the cloud
Records document organizational activities and have ongoing value; non-records are transitory (Correct answer)
Records require encryption; non-records do not
Records are digital; non-records are physical

Correct answer: Records document organizational activities and have ongoing value; non-records are transitory

Records are documents that provide evidence of organizational activities and have ongoing business, legal, or historical value, distinguishing them from transitory non-records like draft copies.

Question 73: What distinguishes a Information Governance Professional certified professional from a non-certified practitioner?

Certified professionals always have more experience
Certified professionals only work in larger organizations
There is no meaningful difference
Certification validates competency through standardized assessment against benchmarks (Correct answer)

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 74: An organization implementing a new IG framework should prioritize stakeholder engagement PRIMARILY because:

It allows the IG team to delegate all work to other departments
Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs (Correct answer)
It reduces the cost of IG software licenses
Regulatory agencies require documented stakeholder meetings

Correct answer: Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs

Stakeholder engagement builds organizational buy-in, surfaces critical requirements from different business units, and increases the likelihood of successful IG program adoption.

Question 75: Which foundational principle is MOST important for success in Information Governance Professional?

Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maximizing financial returns
Maintaining minimum certification requirements
Specializing in only one narrow area

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 76: Which risk management approach is MOST effective for IGP professionals when evaluating potential workplace hazards?

Reactive analysis after incidents occur
Relying solely on historical accident data
Proactive hazard identification and assessment (Correct answer)
Delegating all safety decisions to management

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur.

Question 77: Why is data classification important in information governance?

Determine handling and security (Correct answer)
To delay processing
To confuse users
To increase storage costs

Correct answer: Determine handling and security

Data classification is critical in information governance because it allows organizations to categorize information based on its sensitivity, value, and regulatory requirements. This classification determines the appropriate level of security, access controls, retention periods, and handling procedures for different types of data. Proper classification ensures that sensitive information receives adequate protection while less critical data is managed efficiently.

Question 78: An information governance maturity model is primarily used to:

Rank employees based on their IG knowledge
Assess and benchmark the sophistication of an organization's IG program over time (Correct answer)
Determine software licensing costs for records management tools
Set quarterly sales goals for the compliance department

Correct answer: Assess and benchmark the sophistication of an organization's IG program over time

Maturity models provide a structured way to assess where an organization's IG program stands and chart a path for continuous improvement.

Question 79: How should records be disposed securely?

Throw in trash
Shred or securely delete (Correct answer)
Donate to public
Archive indefinitely

Correct answer: Shred or securely delete

Records should be disposed of securely to prevent unauthorized access to sensitive information after it is no longer needed. Methods like shredding physical documents or securely deleting/wiping electronic data ensure that the information is irrecoverable. This practice is vital for maintaining data privacy, complying with regulations, and mitigating the risk of data breaches even after a record's retention period expires.

Question 80: When performing a gap analysis for compliance, an organization is primarily trying to:

Document all data flows across the enterprise
Identify the cost of non-compliance penalties
Compare current state against required compliance standards (Correct answer)
Rank risks by likelihood and impact

Correct answer: Compare current state against required compliance standards

A gap analysis compares an organization's current compliance posture to what is required by a standard or regulation to identify deficiencies.

Question 81: The concept of 'information stewardship' in IG frameworks refers to:

Designated individuals responsible for overseeing the quality and governance of specific data domains (Correct answer)
The legal department's control over litigation records
The CIO's authority to purchase information technology
Automated software that classifies documents without human intervention

Correct answer: Designated individuals responsible for overseeing the quality and governance of specific data domains

Information stewards are accountable business representatives who oversee the accuracy, accessibility, and appropriate use of information within their domain.

Question 82: What is the PRIMARY purpose of obtaining IGP certification in Information Governance Professional?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment
To satisfy a personal achievement goal
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 83: When developing an IG policy for email, which element is MOST critical to include to ensure legal defensibility?

Retention schedule aligned with legal holds and regulations (Correct answer)
Email server vendor specifications
Font size and formatting requirements
Employee personal email usage limits

Correct answer: Retention schedule aligned with legal holds and regulations

A legally defensible email policy must include retention schedules that align with applicable regulations and the organization's legal hold obligations.

Question 84: In risk management, the term 'residual risk' refers to:

Risk identified but not yet assessed
Risk transferred to a third party
Risk that has been fully eliminated by controls
Risk remaining after controls have been applied (Correct answer)

Correct answer: Risk remaining after controls have been applied

Residual risk is the level of risk that remains after risk treatment or controls have been implemented.

Question 85: Which approach is MOST important for IGP professionals when applying technical procedures?

Using the fastest method regardless of standards
Adhering to established protocols while adapting to specific conditions (Correct answer)
Applying the same technique without variation
Following personal shortcuts

Correct answer: Adhering to established protocols while adapting to specific conditions

Technical procedures require adherence to protocols with professional judgment for adaptation.

Question 86: What distinguishes a Information Governance Professional certified professional from a non-certified practitioner?

There is no meaningful difference
Certified professionals only work in larger organizations
Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals always have more experience

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 87: A data subject requests deletion of their personal data under CCPA. Under which circumstance may the business lawfully refuse?

The data is necessary to complete a transaction the consumer requested (Correct answer)
The consumer did not provide opt-in consent originally
The data is more than two years old
The business employs fewer than 50 people

Correct answer: The data is necessary to complete a transaction the consumer requested

CCPA allows businesses to deny deletion requests when the data is necessary to complete a transaction the consumer requested or reasonably anticipated.

Question 88: A Compliance Management Program (CMP) should be reviewed and updated:

Only when a new regulation is enacted
On a regular schedule and when significant changes occur (Correct answer)
Every five years regardless of changes
Only after a compliance incident occurs

Correct answer: On a regular schedule and when significant changes occur

An effective CMP requires periodic scheduled reviews as well as triggered reviews when regulations, business operations, or risk profiles change.

Question 89: Which component is essential in an information governance policy?

Clear roles and responsibilities (Correct answer)
Undefined responsibilities
Only IT involvement
No training required

Correct answer: Clear roles and responsibilities

Clear roles and responsibilities are an essential component of any effective information governance policy. Defining who is accountable for what aspects of information management ensures that policies are implemented consistently and effectively. Without clear assignments, there can be confusion, gaps in oversight, and a lack of accountability, undermining the entire governance program.

Question 90: How should Information Governance Professional professionals handle procedures that have been updated or revised?

Only apply updates to new cases
Continue using the original method
Review updates, complete required training, and implement revised procedures (Correct answer)
Wait for mandatory enforcement

Correct answer: Review updates, complete required training, and implement revised procedures

Professionals must review changes, complete training, and implement revised procedures.

Question 91: Under GDPR, which principle requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary?

Purpose limitation
Storage limitation (Correct answer)
Data minimization
Integrity and confidentiality

Correct answer: Storage limitation

The storage limitation principle under GDPR requires that personal data be kept in identifiable form only as long as necessary for the stated purpose.

Question 92: What is a common cause of data breaches?

Strong encryption
Multi-factor authentication
Weak passwords and phishing (Correct answer)
Regular updates

Correct answer: Weak passwords and phishing

Weak passwords are easily compromised through guessing or brute-force attacks, while phishing schemes trick users into divulging sensitive information. Both methods exploit human vulnerabilities and are among the most common and effective ways attackers gain unauthorized access, leading to significant data breaches.

Question 93: Which risk assessment methodology uses numeric values to calculate expected monetary loss from a risk event?

Qualitative risk assessment
Delphi technique
Quantitative risk assessment (Correct answer)
Bow-tie analysis

Correct answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical values to likelihood and impact to calculate metrics like Annual Loss Expectancy (ALE).

Question 94: A gap analysis in IG framework development is used to:

Audit vendor compliance with data sharing agreements
Calculate the cost of IG technology investments
Train employees on records management procedures
Identify differences between the current state and desired IG program maturity (Correct answer)

Correct answer: Identify differences between the current state and desired IG program maturity

A gap analysis compares the organization's current IG capabilities and practices against its desired or required state to prioritize improvements.

Question 95: In IGP practice, what happens when regulations are updated?

Professionals must update knowledge and practices to meet new requirements (Correct answer)
Previous certifications are revoked
Existing professionals are grandfathered in
Changes apply only to new professionals

Correct answer: Professionals must update knowledge and practices to meet new requirements

All professionals must update their knowledge and practices when regulations change.

Question 96: In the context of IG frameworks, 'accountability' means that:

Accountability is distributed equally across all departments
All employees share equal responsibility for all information assets
A senior executive or designated officer is responsible for the IG program and its outcomes (Correct answer)
Only IT staff are accountable for data security incidents

Correct answer: A senior executive or designated officer is responsible for the IG program and its outcomes

Accountability requires that a senior executive or designated officer take ownership of the IG program, ensuring it is resourced, enforced, and aligned with organizational goals.

Question 97: Which statement BEST describes the relationship between Information Governance Professional certification and industry evolution?

Changes only occur when government mandates them
Requirements become less stringent over time
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Certification requirements never change

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 98: A Chief Information Governance Officer (CIGO) is MOST responsible for:

Overseeing the enterprise IG program, ensuring alignment with strategy, and driving policy adoption across business units (Correct answer)
Conducting financial audits of the IG department's budget
Managing the organization's IT infrastructure and helpdesk
Directly managing individual employee compliance with IT security policies

Correct answer: Overseeing the enterprise IG program, ensuring alignment with strategy, and driving policy adoption across business units

The CIGO provides strategic leadership for the enterprise IG program, aligning IG initiatives with organizational objectives and driving cross-functional adoption.

Question 99: In information governance, what does a Data Loss Prevention (DLP) system primarily do?

Monitors and restricts unauthorized transfer of sensitive data (Correct answer)
Scans for malware on corporate networks
Encrypts data stored on endpoints
Backs up data to offsite locations

Correct answer: Monitors and restricts unauthorized transfer of sensitive data

DLP systems detect and prevent unauthorized transmission or exfiltration of sensitive information across network, endpoint, and cloud channels.

Question 100: Which personal protective equipment (PPE) principle applies to ALL IGP certified professionals regardless of their specific role?

PPE is only necessary during formal inspections
Any PPE will provide adequate protection
PPE is optional if experienced in the field
PPE must be properly fitted, maintained, and replaced as needed (Correct answer)

Correct answer: PPE must be properly fitted, maintained, and replaced as needed

Regardless of experience level, PPE must be properly fitted, regularly maintained, and replaced when worn or damaged.

Question 101: Why is employee training important in risk management?

Is optional
Only for managers
Increases risks
Ensures understanding of risks (Correct answer)

Correct answer: Ensures understanding of risks

Employee training is important in risk management because employees are often the first line of defense against various risks, including cybersecurity threats and operational errors. Training ensures they understand potential risks, their role in mitigating them, and the proper procedures to follow. This knowledge empowers them to identify and report risks, adhere to security protocols, and contribute to a stronger overall risk posture for the organization.

Information Governance Professional (IGP) Exam

The IGP certification validates an individual's knowledge and skills in information governance, encompassing legal, regulatory, and business requirements for information management.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

pathlms.com — Fees, passing score, exam information · verified Oct 2026
cdn.fs.pathlms.com — Test delivery, eligibility, exam format, late registration, registration, renewal, retake fee, score release, time limit, score validity · verified Oct 2026