Information Governance Professional (IGP) Exam — Questions and Answers

Question 1: How does encryption support data privacy?

Protects against unauthorized access (Correct answer)
Is optional
Only for backups
Slows data access

Correct answer: Protects against unauthorized access

Encryption supports data privacy by transforming data into a coded format, making it unreadable to anyone without the correct decryption key. This protective measure safeguards information both at rest (e.g., on a server) and in transit (e.g., over a network). By rendering sensitive data unintelligible to unauthorized individuals, encryption effectively prevents unauthorized access and maintains confidentiality.

Question 2: Which risk assessment methodology uses numeric values to calculate expected monetary loss from a risk event?

Bow-tie analysis
Qualitative risk assessment
Delphi technique
Quantitative risk assessment (Correct answer)

Correct answer: Quantitative risk assessment

Quantitative risk assessment assigns numerical values to likelihood and impact to calculate metrics like Annual Loss Expectancy (ALE).

Question 3: What is the purpose of compliance in information governance?

Ensure adherence to laws and policies (Correct answer)
Reduce data quality
Increase risks
Ignore regulations

Correct answer: Ensure adherence to laws and policies

The purpose of compliance in information governance is to ensure that an organization adheres to all relevant laws, regulations, and internal policies concerning its information assets. This includes data privacy laws, industry-specific regulations, and contractual obligations. Achieving compliance helps avoid legal penalties, reputational damage, and builds trust with customers and stakeholders.

Question 4: Which component is essential in an information governance policy?

Only IT involvement
Undefined responsibilities
Clear roles and responsibilities (Correct answer)
No training required

Correct answer: Clear roles and responsibilities

Clear roles and responsibilities are an essential component of any effective information governance policy. Defining who is accountable for what aspects of information management ensures that policies are implemented consistently and effectively. Without clear assignments, there can be confusion, gaps in oversight, and a lack of accountability, undermining the entire governance program.

Question 5: Which metric is MOST useful for measuring IG policy compliance?

Annual IG budget expenditure
Percentage of employees who have completed required IG training (Correct answer)
Total number of records stored in the repository
Number of IG policies published on the intranet

Correct answer: Percentage of employees who have completed required IG training

Training completion rates directly indicate whether employees have been exposed to and acknowledged IG requirements, serving as a key compliance metric.

Question 6: What is the MOST effective way for new IGP professionals to build competency?

Learning through trial and error
Focusing solely on advanced topics
Studying certification materials exclusively
Combining formal education, mentored practice, and ongoing professional development (Correct answer)

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 7: In risk management, the term 'residual risk' refers to:

Risk identified but not yet assessed
Risk transferred to a third party
Risk that has been fully eliminated by controls
Risk remaining after controls have been applied (Correct answer)

Correct answer: Risk remaining after controls have been applied

Residual risk is the level of risk that remains after risk treatment or controls have been implemented.

Question 8: How does risk management benefit organizations?

Identify and mitigate threats (Correct answer)
Increases liabilities
Creates confusion
Is optional

Correct answer: Identify and mitigate threats

Risk management benefits organizations by systematically identifying, assessing, and mitigating potential threats and vulnerabilities that could impact their information assets. By proactively addressing risks, organizations can minimize the likelihood of adverse events like data breaches or system failures, and reduce their potential impact. This protects valuable information, ensures business continuity, and safeguards the organization's reputation and financial stability.

Question 9: Which statement BEST describes the relationship between Information Governance Professional certification and industry evolution?

Changes only occur when government mandates them
Requirements become less stringent over time
Certification requirements never change
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 10: What is the primary purpose of an IG policy exception process?

To provide a controlled, documented mechanism for temporarily deviating from a policy when business needs require it (Correct answer)
To replace the policy with a more lenient standard
To automatically exempt executives from compliance obligations
To allow employees to permanently opt out of all IG requirements

Correct answer: To provide a controlled, documented mechanism for temporarily deviating from a policy when business needs require it

An exception process allows documented, risk-assessed deviations from policy when strict adherence is impractical, maintaining governance while accommodating legitimate business needs.

Question 11: How does multi-factor authentication enhance security?

Requires multiple verification methods (Correct answer)
Is optional
Only for admins
Reduces security

Correct answer: Requires multiple verification methods

Multi-factor authentication (MFA) enhances security by requiring users to provide two or more different verification methods to prove their identity. This typically combines something the user knows (like a password), something they have (like a phone or token), and/or something they are (like a fingerprint). Even if one factor is compromised, the additional factors prevent unauthorized access, significantly strengthening account security.

Question 12: Which compliance framework is specifically designed to protect cardholder data for organizations that process credit card transactions?

ISO 27001
PCI DSS (Correct answer)
SOX
HIPAA

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits cardholder data.

Question 13: How should organizations enforce information governance policies?

Training and consistent application (Correct answer)
Allow exceptions freely
Only punish violations
Ignore policies

Correct answer: Training and consistent application

Organizations should enforce information governance policies through a combination of comprehensive training and consistent application across all departments and employees. Training ensures that everyone understands their responsibilities and the importance of the policies. Consistent application, supported by monitoring and accountability, embeds these practices into the organizational culture, making compliance a routine part of daily operations rather than an exception.

Question 14: What distinguishes a Information Governance Professional certified professional from a non-certified practitioner?

Certified professionals always have more experience
Certified professionals only work in larger organizations
Certification validates competency through standardized assessment against benchmarks (Correct answer)
There is no meaningful difference

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 15: Why is data classification important in information governance?

To delay processing
Determine handling and security (Correct answer)
To increase storage costs
To confuse users

Correct answer: Determine handling and security

Data classification is critical in information governance because it allows organizations to categorize information based on its sensitivity, value, and regulatory requirements. This classification determines the appropriate level of security, access controls, retention periods, and handling procedures for different types of data. Proper classification ensures that sensitive information receives adequate protection while less critical data is managed efficiently.

Question 16: Which encryption standard is currently recommended by NIST for protecting sensitive US government data at rest?

AES-256 (Correct answer)
RC4 with 128-bit keys
3DES with 168-bit keys
Blowfish with 256-bit keys

Correct answer: AES-256

NIST recommends AES-256 for protecting sensitive government data at rest, as 3DES is deprecated and RC4/Blowfish are not approved for federal use.

Question 17: Why is continuous monitoring important?

Is optional
Slows response
Increases risk
Detect new risks promptly (Correct answer)

Correct answer: Detect new risks promptly

Continuous monitoring is important because the threat landscape and organizational environment are constantly evolving. It allows organizations to detect new risks, vulnerabilities, or changes in existing risk profiles promptly. By continuously observing systems, processes, and external factors, organizations can respond quickly to emerging threats, maintain security effectiveness, and ensure ongoing compliance.

Question 18: Which of the following is a key characteristic of an effective IG policy lifecycle?

Policies are created solely by IT without business input
Policies are distributed only to senior management
Policies are written once and never revised
Policies undergo regular review and updates to reflect regulatory and business changes (Correct answer)

Correct answer: Policies undergo regular review and updates to reflect regulatory and business changes

Effective IG policies must be periodically reviewed and updated to remain aligned with evolving laws, regulations, business needs, and technology changes.

Question 19: Which scenario BEST illustrates a failure of IG policy enforcement?

The IT team upgrades the records management system during off-hours
Legal counsel reviews contracts before they are signed
An employee requests access to a restricted database and is denied
A manager approves deletion of records still under a legal hold (Correct answer)

Correct answer: A manager approves deletion of records still under a legal hold

Deleting records subject to a legal hold violates IG policy and can result in spoliation sanctions, making it a clear enforcement failure.

Question 20: How should organizations respond to security incidents?

Follow response plan (Correct answer)
Delete evidence
Wait for audits
Ignore incidents

Correct answer: Follow response plan

Following a well-defined security incident response plan ensures a structured and efficient approach to managing breaches. This plan guides organizations through containment, eradication, recovery, and post-incident analysis, minimizing damage and facilitating a swift return to normal operations while learning from the event.

Question 21: An information governance maturity model is primarily used to:

Set quarterly sales goals for the compliance department
Assess and benchmark the sophistication of an organization's IG program over time (Correct answer)
Rank employees based on their IG knowledge
Determine software licensing costs for records management tools

Correct answer: Assess and benchmark the sophistication of an organization's IG program over time

Maturity models provide a structured way to assess where an organization's IG program stands and chart a path for continuous improvement.

Question 22: Under the NIST Risk Management Framework (RMF), which step involves continuously tracking security controls over time?

Assess
Monitor (Correct answer)
Implement
Authorize

Correct answer: Monitor

The Monitor step in the NIST RMF involves ongoing assessment of security controls to detect changes that may affect risk posture.

Question 23: Why is security awareness training important?

Is unnecessary
Educates users on threats (Correct answer)
Only for IT staff
Increases risk

Correct answer: Educates users on threats

Security awareness training is vital because it educates employees about various cyber threats like phishing, malware, and social engineering. By understanding these risks and best practices, users become a crucial first line of defense, significantly reducing the likelihood of human error leading to a security incident.

Question 24: Under GDPR, which IG principle requires that personal data be kept only as long as necessary for its stated purpose?

Purpose limitation
Data minimization
Integrity and confidentiality
Storage limitation (Correct answer)

Correct answer: Storage limitation

GDPR's storage limitation principle requires that personal data not be kept longer than necessary for the purposes for which it was collected.

Question 25: Why is employee training important for data privacy?

Only for IT
Increases risks
Is unnecessary
Ensures policy understanding (Correct answer)

Correct answer: Ensures policy understanding

Employee training is crucial for data privacy because human error is a significant cause of data breaches. Training ensures that all employees understand the organization's data privacy policies, their responsibilities, and best practices for handling sensitive information. This knowledge empowers them to make informed decisions, recognize threats like phishing, and act as a strong line of defense against privacy incidents.

Question 26: Which factor MOST significantly affects the quality of technical outcomes in IGP practice?

The brand of equipment
The practitioner's training, preparation, and attention to detail (Correct answer)
Speed of procedure completion
The time of day

Correct answer: The practitioner's training, preparation, and attention to detail

Quality depends primarily on training, preparation, and attention to detail.

Question 27: Which approach is MOST important for IGP professionals when applying technical procedures?

Using the fastest method regardless of standards
Following personal shortcuts
Adhering to established protocols while adapting to specific conditions (Correct answer)
Applying the same technique without variation

Correct answer: Adhering to established protocols while adapting to specific conditions

Technical procedures require adherence to protocols with professional judgment for adaptation.

Question 28: In the context of IG frameworks, 'accountability' means that:

Only IT staff are accountable for data security incidents
All employees share equal responsibility for all information assets
Accountability is distributed equally across all departments
A senior executive or designated officer is responsible for the IG program and its outcomes (Correct answer)

Correct answer: A senior executive or designated officer is responsible for the IG program and its outcomes

Accountability requires that a senior executive or designated officer take ownership of the IG program, ensuring it is resourced, enforced, and aligned with organizational goals.

Question 29: What is encryption used for in information security?

Ignore data
Encode data for protection (Correct answer)
To delete data
To speed up processing

Correct answer: Encode data for protection

Encryption is used in information security to encode data, transforming it into an unreadable format that protects it from unauthorized access. This process makes the data unintelligible to anyone without the correct decryption key. It is a vital tool for safeguarding sensitive information both when it is stored (data at rest) and when it is transmitted across networks (data in transit).

Question 30: A data subject requests deletion of their personal data under CCPA. Under which circumstance may the business lawfully refuse?

The consumer did not provide opt-in consent originally
The data is more than two years old
The business employs fewer than 50 people
The data is necessary to complete a transaction the consumer requested (Correct answer)

Correct answer: The data is necessary to complete a transaction the consumer requested

CCPA allows businesses to deny deletion requests when the data is necessary to complete a transaction the consumer requested or reasonably anticipated.

Question 31: What role does antivirus software play?

Ignore threats
Detect and remove malware (Correct answer)
Delete important files
Install malware

Correct answer: Detect and remove malware

Antivirus software plays a critical role in information security by detecting, preventing, and removing malicious software (malware) such as viruses, worms, and Trojans. It scans files and systems for known threats and suspicious behavior, protecting computers and networks from infection. This helps maintain the integrity and availability of data and systems, preventing data loss or compromise.

Question 32: How should Information Governance Professional professionals handle procedures that have been updated or revised?

Review updates, complete required training, and implement revised procedures (Correct answer)
Only apply updates to new cases
Continue using the original method
Wait for mandatory enforcement

Correct answer: Review updates, complete required training, and implement revised procedures

Professionals must review changes, complete training, and implement revised procedures.

Question 33: What is a common cause of data breaches?

Multi-factor authentication
Regular updates
Strong encryption
Weak passwords and phishing (Correct answer)

Correct answer: Weak passwords and phishing

Weak passwords are easily compromised through guessing or brute-force attacks, while phishing schemes trick users into divulging sensitive information. Both methods exploit human vulnerabilities and are among the most common and effective ways attackers gain unauthorized access, leading to significant data breaches.

Question 34: An IG policy that applies to all employees, contractors, and vendors who access organizational information reflects which best practice?

Applying separate, unconnected policies for each vendor individually
Limiting IG obligations to full-time employees only to reduce training costs
Restricting IG requirements to data processed within the organization's primary country
Defining a broad scope that covers all parties who interact with organizational information regardless of employment status (Correct answer)

Correct answer: Defining a broad scope that covers all parties who interact with organizational information regardless of employment status

Effective IG policies must extend to all parties accessing organizational information — including contractors and vendors — since data risks are not limited to internal employees.

Question 35: A records retention schedule that conflicts with a legal hold should be:

Applied as written since the schedule takes precedence
Deleted from the system to avoid confusion
Escalated to HR for employee discipline
Suspended for the records covered by the legal hold until it is lifted (Correct answer)

Correct answer: Suspended for the records covered by the legal hold until it is lifted

Legal holds override normal retention schedules; records subject to a hold must be preserved until the hold is lifted, regardless of their scheduled destruction date.

Question 36: Which policy element defines the consequences for employees who violate IG requirements?

Purpose and objectives section
Scope statement
Enforcement and sanctions clause (Correct answer)
Glossary of terms

Correct answer: Enforcement and sanctions clause

The enforcement and sanctions clause specifies disciplinary actions that may result from policy violations, making the policy credible and actionable.

Question 37: How does an effective policy support regulatory compliance?

Handles info per laws and standards (Correct answer)
Slows operations
By ignoring laws
Only addresses internal rules

Correct answer: Handles info per laws and standards

An effective information governance policy supports regulatory compliance by establishing clear guidelines and procedures for how information must be handled in accordance with applicable laws, industry standards, and internal rules. By defining requirements for data privacy, security, retention, and disposal, the policy helps organizations meet their legal obligations. This proactive approach minimizes the risk of non-compliance penalties and reputational damage.

Question 38: What is the PRIMARY purpose of obtaining IGP certification in Information Governance Professional?

To guarantee employment
To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 39: Which technology helps prevent unauthorized access?

Access controls such as passwords (Correct answer)
Open networks
Weak passwords
Public sharing

Correct answer: Access controls such as passwords

Access controls, such as strong passwords, multi-factor authentication, and role-based access, are fundamental technologies that help prevent unauthorized access to systems and data. They ensure that only authenticated and authorized individuals can gain entry to specific resources. By verifying user identities and permissions, these controls act as a critical barrier against malicious actors and insider threats.

Question 40: Why is employee training important in risk management?

Only for managers
Ensures understanding of risks (Correct answer)
Is optional
Increases risks

Correct answer: Ensures understanding of risks

Employee training is important in risk management because employees are often the first line of defense against various risks, including cybersecurity threats and operational errors. Training ensures they understand potential risks, their role in mitigating them, and the proper procedures to follow. This knowledge empowers them to identify and report risks, adhere to security protocols, and contribute to a stronger overall risk posture for the organization.

Question 41: Which EDRM stage immediately follows the Identification stage?

Collection
Review
Preservation (Correct answer)
Processing

Correct answer: Preservation

In the EDRM, Preservation follows Identification; once potentially relevant data sources are identified, they must be preserved to prevent loss or alteration before collection occurs.

Question 42: Which documentation practice BEST demonstrates regulatory compliance for IGP certified professionals?

Maintaining organized, dated, and signed records of all activities (Correct answer)
Keeping informal handwritten notes
Filing documents only when audited
Relying on memory for routine procedures

Correct answer: Maintaining organized, dated, and signed records of all activities

Organized, dated, and signed records demonstrate systematic regulatory compliance.

Question 43: Which foundational principle is MOST important for success in Information Governance Professional?

Maximizing financial returns
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining minimum certification requirements
Specializing in only one narrow area

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 44: What is the benefit of policy review and updates?

Confuses employees
Is optional
Increases risks
Keeps policies current (Correct answer)

Correct answer: Keeps policies current

Regular policy review and updates are essential in information governance to ensure that policies remain current, effective, and compliant with evolving legal, regulatory, and technological landscapes. Information environments and business needs are constantly changing, so outdated policies can lead to compliance gaps or inefficiencies. Periodic reviews allow organizations to adapt their governance framework to new challenges and opportunities, maintaining its relevance and efficacy.

Question 45: When an organization undergoes a merger, which IG activity is MOST urgent to perform regarding information assets?

Suspending all IG policies until the merger is complete
Transferring all IT systems to the acquiring company's platform within 30 days
Immediately deleting all records from the acquired company
Conducting an information inventory and gap analysis of both organizations' IG frameworks (Correct answer)

Correct answer: Conducting an information inventory and gap analysis of both organizations' IG frameworks

A merger requires an information inventory and gap analysis to identify IG framework differences, redundancies, and risks before integration decisions are made.

Question 46: What distinguishes a Information Governance Professional certified professional from a non-certified practitioner?

Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals always have more experience
Certified professionals only work in larger organizations
There is no meaningful difference

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 47: Which element distinguishes a 'standard' from a 'policy' in an IG framework hierarchy?

Standards provide specific, measurable requirements that support policy compliance (Correct answer)
Standards apply only to IT systems while policies apply to all information
Standards are written by vendors; policies are written internally
Standards are optional; policies are mandatory

Correct answer: Standards provide specific, measurable requirements that support policy compliance

Standards define specific, quantifiable requirements (e.g., password length minimums) that operationalize policies, making compliance measurable and auditable.

Question 48: Which ISO standard specifically addresses records management systems and their requirements?

ISO 9001
ISO 31000
ISO 15489 (Correct answer)
ISO 27001

Correct answer: ISO 15489

ISO 15489 is the international standard specifically dedicated to records management, covering principles and implementation guidelines.

Question 49: What is personally identifiable information (PII)?

Information identifying individuals (Correct answer)
Product specifications
Public data
General company info

Correct answer: Information identifying individuals

Personally identifiable information (PII) refers to any data that can be used to directly or indirectly identify an individual. Examples include names, addresses, social security numbers, email addresses, and biometric data. Protecting PII is a cornerstone of data privacy, as its compromise can lead to identity theft, fraud, or other personal harm.

Question 50: What role does calibration play in maintaining technical accuracy for Information Governance Professional professionals?

It is only necessary for new equipment
It only matters during inspections
It ensures instruments produce accurate, consistent results over time (Correct answer)
It is optional for advanced professionals

Correct answer: It ensures instruments produce accurate, consistent results over time

Regular calibration ensures instruments continue producing accurate results over time.

Question 51: When developing an IG policy for email, which element is MOST critical to include to ensure legal defensibility?

Employee personal email usage limits
Email server vendor specifications
Font size and formatting requirements
Retention schedule aligned with legal holds and regulations (Correct answer)

Correct answer: Retention schedule aligned with legal holds and regulations

A legally defensible email policy must include retention schedules that align with applicable regulations and the organization's legal hold obligations.

Question 52: Which risk management approach is MOST effective for IGP professionals when evaluating potential workplace hazards?

Delegating all safety decisions to management
Reactive analysis after incidents occur
Proactive hazard identification and assessment (Correct answer)
Relying solely on historical accident data

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur.

Question 53: What is the BEST way for a Information Governance Professional professional to stay current with regulatory changes?

Check regulations only during renewal
Monitor regulatory bodies, attend CE, and participate in professional associations (Correct answer)
Depend on colleagues to share updates
Rely solely on employer notifications

Correct answer: Monitor regulatory bodies, attend CE, and participate in professional associations

Staying current requires monitoring agencies, attending CE, and participating in professional associations.

Question 54: When performing a gap analysis for compliance, an organization is primarily trying to:

Compare current state against required compliance standards (Correct answer)
Rank risks by likelihood and impact
Identify the cost of non-compliance penalties
Document all data flows across the enterprise

Correct answer: Compare current state against required compliance standards

A gap analysis compares an organization's current compliance posture to what is required by a standard or regulation to identify deficiencies.

Question 55: What is the primary purpose of a Security Information and Event Management (SIEM) system?

Aggregate and correlate security logs for threat detection (Correct answer)
Automatically patch vulnerabilities on servers
Manage user identity provisioning
Encrypt emails sent between employees

Correct answer: Aggregate and correlate security logs for threat detection

SIEM systems collect, aggregate, and correlate security event logs from multiple sources to enable real-time threat detection and incident response.

Question 56: What does the acronym EDRM stand for in the context of electronic discovery?

Electronic Discovery Reference Model (Correct answer)
Electronic Data Retention Model
Electronic Document Review Management
Enterprise Data Recovery Method

Correct answer: Electronic Discovery Reference Model

EDRM stands for Electronic Discovery Reference Model, a widely adopted framework that describes the stages of the e-discovery process from information governance through presentation.

Question 57: A Chief Information Governance Officer (CIGO) is MOST responsible for:

Directly managing individual employee compliance with IT security policies
Managing the organization's IT infrastructure and helpdesk
Conducting financial audits of the IG department's budget
Overseeing the enterprise IG program, ensuring alignment with strategy, and driving policy adoption across business units (Correct answer)

Correct answer: Overseeing the enterprise IG program, ensuring alignment with strategy, and driving policy adoption across business units

The CIGO provides strategic leadership for the enterprise IG program, aligning IG initiatives with organizational objectives and driving cross-functional adoption.

Question 58: When a IGP professional encounters an unexpected result during a procedure, the FIRST action should be to:

Stop, assess the situation, and determine whether to proceed or seek guidance (Correct answer)
Report without preliminary assessment
Repeat the procedure immediately
Continue and address it later

Correct answer: Stop, assess the situation, and determine whether to proceed or seek guidance

Stopping to assess unexpected results is critical for safety and quality.

Question 59: The concept of 'information stewardship' in IG frameworks refers to:

Designated individuals responsible for overseeing the quality and governance of specific data domains (Correct answer)
Automated software that classifies documents without human intervention
The CIO's authority to purchase information technology
The legal department's control over litigation records

Correct answer: Designated individuals responsible for overseeing the quality and governance of specific data domains

Information stewards are accountable business representatives who oversee the accuracy, accessibility, and appropriate use of information within their domain.

Question 60: Under GDPR, which principle requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary?

Integrity and confidentiality
Data minimization
Storage limitation (Correct answer)
Purpose limitation

Correct answer: Storage limitation

The storage limitation principle under GDPR requires that personal data be kept in identifiable form only as long as necessary for the stated purpose.

Question 61: A company discovers that a third-party vendor has been improperly handling customer PII. Under a risk management framework, this is best classified as:

Operational risk
Strategic risk
Reputational risk
Third-party/supply chain risk (Correct answer)

Correct answer: Third-party/supply chain risk

Risks arising from vendor or supplier relationships are classified as third-party or supply chain risk in standard risk frameworks.

Question 62: Which factor MOST significantly affects the quality of technical outcomes in IGP practice?

The time of day
The brand of equipment
Speed of procedure completion
The practitioner's training, preparation, and attention to detail (Correct answer)

Correct answer: The practitioner's training, preparation, and attention to detail

Quality depends primarily on training, preparation, and attention to detail.

Question 63: Which regulatory requirement is UNIVERSAL across all Information Governance Professional practice settings?

Working exclusively during business hours
Limiting services to local jurisdictions
Using specific proprietary software
Maintaining current certification and continuing education (Correct answer)

Correct answer: Maintaining current certification and continuing education

Maintaining current certification and continuing education is a universal regulatory requirement.

Question 64: A gap analysis in IG framework development is used to:

Audit vendor compliance with data sharing agreements
Calculate the cost of IG technology investments
Train employees on records management procedures
Identify differences between the current state and desired IG program maturity (Correct answer)

Correct answer: Identify differences between the current state and desired IG program maturity

A gap analysis compares the organization's current IG capabilities and practices against its desired or required state to prioritize improvements.

Question 65: Which foundational principle is MOST important for success in Information Governance Professional?

Maximizing financial returns
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Specializing in only one narrow area
Maintaining minimum certification requirements

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 66: How does the IGP body of knowledge relate to daily professional practice?

It is theoretical with limited application
It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It only applies during exams

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 67: Which personal protective equipment (PPE) principle applies to ALL IGP certified professionals regardless of their specific role?

PPE must be properly fitted, maintained, and replaced as needed (Correct answer)
PPE is only necessary during formal inspections
PPE is optional if experienced in the field
Any PPE will provide adequate protection

Correct answer: PPE must be properly fitted, maintained, and replaced as needed

Regardless of experience level, PPE must be properly fitted, regularly maintained, and replaced when worn or damaged.

Question 68: How does compliance impact organizational reputation?

Has no effect
Decreases trust
Only affects finances
Builds trust and credibility (Correct answer)

Correct answer: Builds trust and credibility

Compliance significantly impacts organizational reputation by demonstrating a commitment to ethical practices, legal adherence, and responsible data handling. Organizations that consistently comply with regulations build trust and credibility with customers, partners, and the public. Conversely, non-compliance can lead to severe reputational damage, eroding trust and potentially affecting customer loyalty and market value.

Question 69: Which term describes Electronically Stored Information as defined under the Federal Rules of Civil Procedure?

Any information stored on paper or electronic media
Email messages archived by a third-party provider
Only structured data held in enterprise databases
Information created, stored, or transmitted in electronic form that may be subject to discovery (Correct answer)

Correct answer: Information created, stored, or transmitted in electronic form that may be subject to discovery

ESI under the FRCP broadly includes any information created, stored, or transmitted in electronic form, encompassing emails, documents, databases, voicemails, and metadata.

Question 70: A company's IG framework should address privacy requirements under which US federal law applicable to healthcare information?

FERPA
HIPAA (Correct answer)
COPPA
GLBA

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information (PHI) and must be addressed in healthcare IG frameworks.

Question 71: A company receives a litigation hold notice after existing records have already been scheduled for destruction. What is the correct action?

Destroy only records not mentioned in the notice
Transfer the records to outside counsel immediately
Proceed with destruction since it was already scheduled
Suspend the destruction and preserve all potentially relevant records (Correct answer)

Correct answer: Suspend the destruction and preserve all potentially relevant records

A litigation hold supersedes any existing retention schedules and requires immediate suspension of destruction for all potentially relevant records.

Question 72: An organization wants to ensure that only authorized users access specific cloud resources. Which control best enforces this at the identity layer?

Network firewall rules
SSL/TLS certificates
Role-Based Access Control (RBAC) (Correct answer)
Intrusion detection signatures

Correct answer: Role-Based Access Control (RBAC)

RBAC restricts cloud resource access based on users' assigned roles, ensuring only authorized individuals can access specific resources.

Question 73: An organization implementing a new IG framework should prioritize stakeholder engagement PRIMARILY because:

It allows the IG team to delegate all work to other departments
It reduces the cost of IG software licenses
Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs (Correct answer)
Regulatory agencies require documented stakeholder meetings

Correct answer: Buy-in from key stakeholders increases adoption and ensures the framework reflects real business needs

Stakeholder engagement builds organizational buy-in, surfaces critical requirements from different business units, and increases the likelihood of successful IG program adoption.

Question 74: In information governance, what does a Data Loss Prevention (DLP) system primarily do?

Monitors and restricts unauthorized transfer of sensitive data (Correct answer)
Scans for malware on corporate networks
Backs up data to offsite locations
Encrypts data stored on endpoints

Correct answer: Monitors and restricts unauthorized transfer of sensitive data

DLP systems detect and prevent unauthorized transmission or exfiltration of sensitive information across network, endpoint, and cloud channels.

Question 75: Which approach BEST supports continuous improvement of an IG framework over time?

Replacing the IG team annually to bring fresh perspectives
Establishing ongoing monitoring, periodic audits, and a feedback loop that drives policy revisions (Correct answer)
Delegating all IG improvement decisions to an external consultant
Implementing a one-time IG audit with no follow-up

Correct answer: Establishing ongoing monitoring, periodic audits, and a feedback loop that drives policy revisions

Continuous improvement requires regular audits, monitoring of compliance metrics, and a formal feedback process to update policies as regulations, technology, and business needs evolve.

Question 76: What is the PRIMARY purpose of obtaining IGP certification in Information Governance Professional?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment
To bypass educational requirements
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 77: What is the PRIMARY reason for regulatory compliance in the Information Governance Professional profession?

To create additional paperwork
To justify higher service fees
To avoid penalties and fines only
To protect public safety, ensure quality, and maintain professional integrity (Correct answer)

Correct answer: To protect public safety, ensure quality, and maintain professional integrity

Regulatory compliance protects public safety, ensures quality, and maintains professional integrity.

Question 78: What documentation is MOST critical to maintain for safety compliance in the Information Governance Professional field?

Incident reports, training records, and inspection logs (Correct answer)
Employee vacation schedules
Annual revenue reports
Client marketing preferences

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation for demonstrating compliance.

Question 79: In IGP practice, what happens when regulations are updated?

Changes apply only to new professionals
Professionals must update knowledge and practices to meet new requirements (Correct answer)
Existing professionals are grandfathered in
Previous certifications are revoked

Correct answer: Professionals must update knowledge and practices to meet new requirements

All professionals must update their knowledge and practices when regulations change.

Question 80: The ARMA International Generally Accepted Recordkeeping Principles (GARP) include how many core principles?

10
12
6
8 (Correct answer)

Correct answer: 8

ARMA's GARP framework consists of 8 core principles: Accountability, Transparency, Integrity, Protection, Compliance, Availability, Retention, and Disposition.

Question 81: Which standard provides a globally recognized framework specifically for information security management systems (ISMS)?

COBIT 5
ISO/IEC 27001 (Correct answer)
ARMA Generally Accepted Recordkeeping Principles
NIST SP 800-53

Correct answer: ISO/IEC 27001

ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Question 82: Which regulatory requirement is UNIVERSAL across all Information Governance Professional practice settings?

Limiting services to local jurisdictions
Using specific proprietary software
Working exclusively during business hours
Maintaining current certification and continuing education (Correct answer)

Correct answer: Maintaining current certification and continuing education

Maintaining current certification and continuing education is a universal regulatory requirement.

Question 83: What is a compliance audit?

Evaluate adherence to regulations (Correct answer)
Only for IT systems
A financial review
An informal check

Correct answer: Evaluate adherence to regulations

A compliance audit is a formal, independent examination that evaluates an organization's adherence to specific laws, regulations, industry standards, and internal policies. It assesses whether controls are in place and operating effectively to meet compliance requirements. The audit identifies gaps or non-compliance issues, allowing the organization to take corrective actions and demonstrate due diligence.

Question 84: An employee intentionally leaks confidential corporate data to a competitor. This is an example of:

External threat
Insider threat (Correct answer)
Residual risk
Systemic risk

Correct answer: Insider threat

An insider threat involves a current or former employee, contractor, or partner who misuses authorized access to harm the organization.

Question 85: Which governance body is typically responsible for approving enterprise-level IG policies?

External auditors
Individual department managers
Executive leadership or a steering committee (Correct answer)
IT Help Desk

Correct answer: Executive leadership or a steering committee

Enterprise IG policies require approval at the executive or steering committee level to ensure enterprise-wide authority and cross-departmental compliance.

Question 86: What role does calibration play in maintaining technical accuracy for Information Governance Professional professionals?

It ensures instruments produce accurate, consistent results over time (Correct answer)
It is optional for advanced professionals
It is only necessary for new equipment
It only matters during inspections

Correct answer: It ensures instruments produce accurate, consistent results over time

Regular calibration ensures instruments continue producing accurate results over time.

Question 87: What is the BEST way for a Information Governance Professional professional to stay current with regulatory changes?

Rely solely on employer notifications
Depend on colleagues to share updates
Monitor regulatory bodies, attend CE, and participate in professional associations (Correct answer)
Check regulations only during renewal

Correct answer: Monitor regulatory bodies, attend CE, and participate in professional associations

Staying current requires monitoring agencies, attending CE, and participating in professional associations.

Question 88: Under FRCP Rule 26(f), parties involved in litigation are required to:

Submit all ESI to the court within 30 days of the complaint
Retain a certified e-discovery vendor before depositions begin
Produce all documents in native format without exception
Meet and confer to discuss discovery issues including ESI scope and format (Correct answer)

Correct answer: Meet and confer to discuss discovery issues including ESI scope and format

FRCP Rule 26(f) requires parties to meet and confer early in the litigation to discuss the nature of claims, preservation obligations, and the scope and form of ESI production.

Question 89: Which personal protective equipment (PPE) principle applies to ALL IGP certified professionals regardless of their specific role?

PPE is only necessary during formal inspections
PPE must be properly fitted, maintained, and replaced as needed (Correct answer)
PPE is optional if experienced in the field
Any PPE will provide adequate protection

Correct answer: PPE must be properly fitted, maintained, and replaced as needed

Regardless of experience level, PPE must be properly fitted, regularly maintained, and replaced when worn or damaged.

Question 90: Why is stakeholder engagement important in governance?

Slows decision-making
Ensures policy relevance and support (Correct answer)
Is unnecessary
Only for legal teams

Correct answer: Ensures policy relevance and support

Stakeholder engagement is crucial in information governance because it ensures that policies are relevant, practical, and receive widespread support across the organization. By involving representatives from various departments—such as legal, IT, HR, and business units—policies can be developed that address diverse needs and perspectives. This collaborative approach fosters buy-in and makes the implementation of governance initiatives more successful.

Question 91: What is the MOST effective way for new IGP professionals to build competency?

Focusing solely on advanced topics
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Learning through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 92: When classifying information in an IG program, which factor is MOST important when determining security controls?

The file format of the document
The sensitivity and criticality of the information (Correct answer)
The age of the information
The size of the data set

Correct answer: The sensitivity and criticality of the information

Security controls in an IG program are driven by the sensitivity (confidentiality) and criticality (availability/integrity) of the information, not its format or size.

Question 93: What documentation is MOST critical to maintain for safety compliance in the Information Governance Professional field?

Annual revenue reports
Client marketing preferences
Employee vacation schedules
Incident reports, training records, and inspection logs (Correct answer)

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation for demonstrating compliance.

Question 94: In Information Governance Professional practice, what is the CORRECT sequence when performing a technical procedure?

Execute immediately and document only if issues arise
Execute, then plan and review
Document, execute, then plan
Plan, prepare, execute, verify, and document (Correct answer)

Correct answer: Plan, prepare, execute, verify, and document

The correct sequence follows: plan, prepare, execute, verify, and document.

Question 95: Which concept describes the practice of granting users only the minimum access rights necessary to perform their job functions?

Need to know
Defense in depth
Separation of duties
Least privilege (Correct answer)

Correct answer: Least privilege

The principle of least privilege limits user permissions to the minimum required for their role, reducing the attack surface if credentials are compromised.

Question 96: What is the primary goal of information security?

Protect confidentiality, integrity, availability (Correct answer)
Reduce system performance
To share all data openly
Ignore security threats

Correct answer: Protect confidentiality, integrity, availability

The primary goal of information security is to protect the confidentiality, integrity, and availability (CIA triad) of information assets. Confidentiality ensures data is accessible only to authorized individuals, integrity ensures data is accurate and unaltered, and availability ensures authorized users can access data when needed. Achieving these three pillars safeguards information from unauthorized access, modification, or destruction.

Question 97: How are controls used in risk management?

Ignore risks
Increase risks
Only for audits
Reduce risk likelihood or impact (Correct answer)

Correct answer: Reduce risk likelihood or impact

Controls are integral to risk management as they are measures implemented to reduce the likelihood or impact of identified risks. These can be preventative (e.g., access controls to stop unauthorized access) or detective (e.g., monitoring systems to identify breaches). By applying appropriate controls, organizations can effectively manage and mitigate threats to their information assets and operations.

Question 98: What is the key difference between a vulnerability assessment and a penetration test?

A vulnerability assessment identifies weaknesses while a penetration test actively exploits them (Correct answer)
Vulnerability assessments are performed by vendors and penetration tests by internal staff
A vulnerability assessment exploits flaws while a penetration test only identifies them
Penetration tests are automated and vulnerability assessments are manual

Correct answer: A vulnerability assessment identifies weaknesses while a penetration test actively exploits them

Vulnerability assessments identify and rank security weaknesses, while penetration tests go further by actively attempting to exploit those weaknesses to demonstrate real impact.

Question 99: Why are firewalls important?

Allow all traffic
Block unauthorized traffic (Correct answer)
Create vulnerabilities
Slow systems

Correct answer: Block unauthorized traffic

Firewalls are crucial security components that act as a barrier between a trusted internal network and untrusted external networks, like the internet. Their primary function is to block unauthorized traffic and control network access based on predefined security rules. By filtering incoming and outgoing data packets, firewalls prevent malicious attacks and unauthorized access attempts, protecting the internal network from external threats.

Question 100: Which type of risk treatment involves purchasing cyber liability insurance?

Risk transfer (Correct answer)
Risk avoidance
Risk mitigation
Risk acceptance

Correct answer: Risk transfer

Purchasing insurance shifts the financial consequence of a risk to a third party, which is the definition of risk transfer.

Question 101: Which approach is MOST important for IGP professionals when applying technical procedures?

Applying the same technique without variation
Adhering to established protocols while adapting to specific conditions (Correct answer)
Following personal shortcuts
Using the fastest method regardless of standards

Correct answer: Adhering to established protocols while adapting to specific conditions

Technical procedures require adherence to protocols with professional judgment for adaptation.

Information Governance Professional (IGP) Exam

The IGP certification validates an individual's knowledge and skills in information governance, encompassing legal, regulatory, and business requirements for information management.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

pathlms.com — Fees, passing score, exam information · verified Oct 2026
cdn.fs.pathlms.com — Test delivery, eligibility, exam format, late registration, registration, renewal, retake fee, score release, time limit, score validity · verified Oct 2026